Technical Information
- %ProgramFiles%\win32games\bb.tmp
- %HOMEPATH%\favorites\³£óã\î÷óîïé½£.lnk
- %HOMEPATH%\desktop\î÷óîГГё.lnk
- %WINDIR%\syswow64\doifa.bat
- %HOMEPATH%\desktop\î÷óîïé½£.lnk
- %HOMEPATH%\desktop\ìô±¦ГГё.lnk
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
- %TEMP%\is-44mhi.tmp\setup1.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bg0n0zou\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\bullet[1]
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %TEMP%\is-l4v68.tmp\_isetup\_regdll.tmp
- %TEMP%\is-l4v68.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l4v68.tmp\_isetup\_shfoldr.dll
- %WINDIR%\syswow64\url.txt
- %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-l347n.tmp
- %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-rripb.tmp
- %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-4ge4j.tmp
- %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-bort7.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\·½±ã°ù¶èëñë÷\·½±ã°ù¶èëñë÷.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\·½±ã°ù¶èëñë÷.lnk
- %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\unins000.dat
- %TEMP%\awewqw.bat
- %TEMP%\reeie.bat
- %HOMEPATH%\favorites\î÷óîïé½£.lnk
- %TEMP%\openonepage.bat
- %APPDATA%\microsoft\windows\start menu\internet explorer.lnk
- %HOMEPATH%\favorites\ВіВЈГіГЈ\î÷óîГГё.lnk
- %ProgramFiles%\win32games\2xi.ico
- %ProgramFiles%\win32games\addurl.bat
- %ProgramFiles%\win32games\addurl.dll
- %ProgramFiles%\win32games\baidu.ico
- %ProgramFiles%\win32games\config.ini
- %ProgramFiles%\win32games\dangdangwang.ico
- %ProgramFiles%\win32games\install.exe
- %ProgramFiles%\win32games\jiuzhou.ico
- %ProgramFiles%\win32games\setup.bat
- %ProgramFiles%\win32games\setup.exe
- %ProgramFiles%\win32games\shffolder.dll
- %ProgramFiles%\win32games\superrepair.dll
- %ProgramFiles%\win32games\sysdkeys.dll
- %ProgramFiles%\win32games\taobao.ico
- %ProgramFiles%\win32games\thumbs.db
- %ProgramFiles%\win32games\url.txt
- %ProgramFiles%\win32games\wingames.exe
- %ProgramFiles%\win32games\xianjian.ico
- %ProgramFiles%\win32games\zhuoyue.ico
- %ProgramFiles%\win32games\runbat.bat
- %HOMEPATH%\favorites\µ±µ±ГГё.lnk
- %HOMEPATH%\favorites\ВіВЈГіГЈ\µ±µ±ГГё.lnk
- %HOMEPATH%\favorites\Г—ВїГґВЅГГё.lnk
- %HOMEPATH%\favorites\ВіВЈГіГЈ\Г—ВїГґВЅГГё.lnk
- %HOMEPATH%\favorites\ìô±¦ГГё.lnk
- %HOMEPATH%\favorites\ВіВЈГіГЈ\ìô±¦ГГё.lnk
- %HOMEPATH%\favorites\î÷óîГГё.lnk
- %APPDATA%\microsoft\windows\start menu\ìô±¦ГГё.lnk
- %WINDIR%\syswow64\runfonce.bat
- %WINDIR%\syswow64\url.txt
- %TEMP%\is-l4v68.tmp\_isetup\_regdll.tmp
- %TEMP%\is-l4v68.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l4v68.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-44mhi.tmp\setup1.tmp
- from %ProgramFiles%\win32games\url.txt to %ProgramFiles%\internet explorer\signup\url.txt
- from %ProgramFiles%\win32games\install.exe to %ProgramFiles%\internet explorer\signup\install.exe
- from %ProgramFiles%\win32games\sysdkeys.dll to %WINDIR%\syswow64\sysdkeys.dll
- from %ProgramFiles%\win32games\setup.exe to %WINDIR%\syswow64\setup1.exe
- from %ProgramFiles%\win32games\superrepair.dll to %WINDIR%\syswow64\superrepair.dll
- from %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-l347n.tmp to %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\unins000.exe
- from %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-rripb.tmp to %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\fangbian.exe
- from %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-4ge4j.tmp to %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\getmessage.dll
- from %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\is-bort7.tmp to %ProgramFiles(x86)%\·½±ã°ù¶èëñë÷\endpro.exe
- %HOMEPATH%\desktop\google chrome.lnk
- C:\users\public\desktop\firefox.lnk
- DNS ASK so#.5k5.net
- DNS ASK bz.#ee.cn
- DNS ASK re#.2xi.com
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%ProgramFiles%\win32games\wingames.exe' http://reg.2xi.com/2010011201/
- '%WINDIR%\syswow64\setup1.exe' /SUPPRESSMSGBOXES /VERYSILENT
- '%TEMP%\is-44mhi.tmp\setup1.tmp' /SL5="$70184,266382,51712,%WINDIR%\SysWOW64\setup1.exe" /SUPPRESSMSGBOXES /VERYSILENT
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\AddURL.bat" "
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\InProcServer32" /v "ThreadingModel" /d "Apartment" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.iehwz.com/index1.html /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\DefaultIcon" /v "" /d "%ProgramFiles%\Internet Explorer\iexplore.exe" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\InProcServer32" /v "" /d "shdocvw.dll" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\ShellFolder" /v "Attributes" /t REG_BINARY /d 00000000 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\Shell\Open(&O)\Command" /v "" /d "%ProgramFiles%\Internet Explorer\iexplore.exe" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}\Shell\╩⌠╨╘(&D)\Command" /v "" /d "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{8057A9A5-6027-4E5F-8217-4CE744410A3C}"! /v "Internet Exp1oer" /d "" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /t reg_sz /d "%ProgramFiles%\Internet Explorer\iexplore.exe http://www.iehwz.com/index1.htm...
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\awewqw.bat
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{8057A9A5-6027-4E5F-8217-4CE744410A3C}" /v "" /d "Internet" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\reeIE.bat
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\openonepage.bat
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Win32Games\shffolder.dll" movefilesuper
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Win32Games\AddURL.dll" addurlp
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\runbat.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\doifa.bat" "
- '%WINDIR%\syswow64\rundll32.exe' "<SYSTEM32>\sysdkeys.dll" huise
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" /SILENT /SUPPRESSMSGBOXES"
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\runbat.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\AddURL.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\awewqw.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\openonepage.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\doifa.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" /SILENT /SUPPRESSMSGBOXES"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\reeIE.bat' (with hidden window)