Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\melter.exe
- %TEMP%\rarsfx0\shockerr.exe
- %TEMP%\rarsfx0\shocker.exe
- %TEMP%\rarsfx0\realistic format virus.exe
- %TEMP%\rarsfx0\randomness.exe
- %TEMP%\rarsfx0\invertmouse.exe
- %TEMP%\rarsfx0\harddrive.exe
- %TEMP%\rarsfx0\close programs.exe
- %TEMP%\rarsfx0\anywork.exe
- %TEMP%\rarsfx0\virus1.exe
- %TEMP%\rarsfx0\sante clous for window.exe
- %TEMP%\rarsfx0\xmaslts.exe
- %TEMP%\rarsfx0\mousepad.exe
- %TEMP%\rarsfx0\liz.exe
- %TEMP%\rarsfx0\icons.exe
- %TEMP%\rarsfx0\crazymouse.exe
- %TEMP%\rarsfx0\brisk.exe
- %TEMP%\rarsfx0\ghost.exe
- %TEMP%\flash6moviev2.cu.mvx
- %TEMP%\file.cu.mfx
- %TEMP%\registry.cu.mfx
- %TEMP%\system.cu.mfx
- %TEMP%\ole1embedstrm (2).wav
- %TEMP%\ole1embedstrm.wav
- %TEMP%\mplayer.cu.dll
- %TEMP%\rarsfx0\window move.exe
- %TEMP%\rarsfx0\free porn.exe
- %TEMP%\rarsfx0\reverse.exe
- %TEMP%\rarsfx0\ghostmouse.exe
- %TEMP%\rarsfx0\bonce.exe
- %TEMP%\rarsfx0\suprise.exe
- %TEMP%\rarsfx0\poltergeist.exe
- %TEMP%\rarsfx0\movemouse.exe
- %TEMP%\rarsfx0\icons 2.exe
- %TEMP%\rarsfx0\mdriftin.exe
- %TEMP%\rarsfx0\pen.exe
- %TEMP%\rarsfx0\come too me.exe
- %TEMP%\rarsfx0\банк_original.exe
- %TEMP%\rarsfx0\скрытие объектов.exe
- %TEMP%\rarsfx0\crazy mouse v1.2.exe
- %TEMP%\rarsfx0\evil's crazy mouse....exe
- %TEMP%\rarsfx0\жестокое скрытие объектов.exe
- %TEMP%\rarsfx0\blast button.exe
- %TEMP%\rarsfx0\readme.exe
- %TEMP%\rarsfx0\iloveyou.exe
- %TEMP%\rarsfx0\korovki.exe
- %TEMP%\rarsfx0\snow for windows.exe
- %TEMP%\rarsfx0\mighty fucker.exe
- %TEMP%\rarsfx0\australia.exe
- %TEMP%\rarsfx0\jeprus.exe
- %TEMP%\rarsfx0\iphone louckscren.scr
- %TEMP%\rarsfx0\kona_dancer.exe
- %TEMP%\rarsfx0\coringa.bat
- %TEMP%\mfpl7014.dll
- %TEMP%\rarsfx0\mouse overheat.exe
- %TEMP%\rarsfx0\deathwishdog.exe
- %TEMP%\rarsfx0\kamika.exe
- %TEMP%\rarsfx0\burp.exe
- %TEMP%\rarsfx0\larry.exe
- %TEMP%\rarsfx0\pusk4u.exe
- %TEMP%\rarsfx0\starter.exe
- %TEMP%\rarsfx0\click here.exe
- %TEMP%\rarsfx0\restat.exe
- %TEMP%\rarsfx0\float.exe
- %TEMP%\rarsfx0\santa.exe
- %TEMP%\rarsfx0\idiot.exe
- %TEMP%\rarsfx0\bug.exe
- %TEMP%\rarsfx0\hidder.exe
- %TEMP%\rarsfx0\awmulti3.exe
- %TEMP%\rarsfx0\elves.exe
- %TEMP%\rarsfx0\headache.exe
- %TEMP%\rarsfx0\hildaturkey.exe
- %TEMP%\rarsfx0\middlefinger.exe
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
Deletes the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
Moves the following files
- from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
Substitutes the following files
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
- %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_defVIEW' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'Button' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\anywork.exe'
- '%TEMP%\rarsfx0\ghostmouse.exe'
- '%TEMP%\rarsfx0\harddrive.exe'
- '%TEMP%\rarsfx0\headache.exe'
- '%TEMP%\rarsfx0\hidder.exe'
- '%TEMP%\rarsfx0\hildaturkey.exe'
- '%TEMP%\rarsfx0\icons 2.exe'
- '%TEMP%\rarsfx0\idiot.exe'
- '%TEMP%\rarsfx0\larry.exe'
- '%TEMP%\rarsfx0\iloveyou.exe'
- '%TEMP%\rarsfx0\invertmouse.exe'
- '%TEMP%\rarsfx0\jeprus.exe'
- '%TEMP%\rarsfx0\kamika.exe'
- '%TEMP%\rarsfx0\kona_dancer.exe'
- '%TEMP%\rarsfx0\korovki.exe'
- '%TEMP%\rarsfx0\ghost.exe'
- '%TEMP%\rarsfx0\icons.exe'
- '%TEMP%\rarsfx0\free porn.exe'
- '%TEMP%\rarsfx0\burp.exe'
- '%TEMP%\rarsfx0\australia.exe'
- '%TEMP%\rarsfx0\awmulti3.exe'
- '%TEMP%\rarsfx0\blast button.exe'
- '%TEMP%\rarsfx0\brisk.exe'
- '%TEMP%\rarsfx0\bonce.exe'
- '%TEMP%\rarsfx0\bug.exe'
- '%TEMP%\rarsfx0\click here.exe'
- '%TEMP%\rarsfx0\evil's crazy mouse....exe'
- '%TEMP%\rarsfx0\close programs.exe'
- '%TEMP%\rarsfx0\come too me.exe'
- '%TEMP%\rarsfx0\crazy mouse v1.2.exe'
- '%TEMP%\rarsfx0\crazymouse.exe'
- '%TEMP%\rarsfx0\deathwishdog.exe'
- '%TEMP%\rarsfx0\elves.exe'
- '%TEMP%\rarsfx0\float.exe'
- '%TEMP%\rarsfx0\liz.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\coringa.bat" "
