Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Micr0soft' = '<SYSTEM32>\foto.exe'
- Windows Task Manager (Taskmgr)
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Soap Bubbles.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Zapotec.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Windows NT\Pinball\table.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Blue Lace 16.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Coffee Bean.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\whowhere.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\FeatherTexture.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Rhododendron.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\River Sumida.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Santa Fe Stucco.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Gone Fishing.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Greenstone.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Prairie Wind.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img004b.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img014.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img033.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\folder_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\gradient.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\icon_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img033a.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img060.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img068.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img072.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img034.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img040.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img046.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\end_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\control_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /t reg_dword /d 00000001
- '<SYSTEM32>\attrib.exe' +s +r <SYSTEM32>\foto.exe /s
- '<SYSTEM32>\attrib.exe' +h +s +r <SYSTEM32>\windows_update.bat /s
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\run /v Micr0soft /t reg_sz /d "<SYSTEM32>\foto.exe" /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 00000001
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t reg_dword /d 00000001 /f
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\winword2.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\excel.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\excel4.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\bigfoot.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\verisign.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\excel.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\excel4.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\winword.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\winword.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\winword2.system"
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMorePrograms' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- <SYSTEM32>\windows_update.bat
- <SYSTEM32>\windows_update.bat
- from <SYSTEM32>\config\systemprofile\Templates\excel.xls to <SYSTEM32>\config\systemprofile\Templates\excel.systeme
- from <SYSTEM32>\config\systemprofile\Templates\excel4.xls to <SYSTEM32>\config\systemprofile\Templates\excel4.systeme
- from <SYSTEM32>\config\systemprofile\Templates\winword.doc to <SYSTEM32>\config\systemprofile\Templates\winword.system
- from <SYSTEM32>\config\systemprofile\Templates\winword2.doc to <SYSTEM32>\config\systemprofile\Templates\winword2.system