Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Twain' = '%WINDIR%\twain.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Service' = '%WINDIR%\System.exe'
- <Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe
- <Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\desktop.ini
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\Scandals.exe
- '%WINDIR%\msngr.exe' MZђ
- '%WINDIR%\winlogon64.exe'
- '%WINDIR%\msngr.exe'
- '%WINDIR%\explorer.exe' C:\
- %TEMP%\aut1D.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut5.tmp
- %WINDIR%\ecruoser.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\IP-h4[1].htm
- %TEMP%\aut6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adds-h2[1].htm
- %WINDIR%\sliame.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mails-h3[1].htm
- %WINDIR%\msngr.exe
- %TEMP%\aut1.tmp
- %WINDIR%\System.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %WINDIR%\winlogon64.exe
- %WINDIR%\stnemmoc.ocx
- %TEMP%\autF.tmp
- %TEMP%\autE.tmp
- %TEMP%\autD.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %TEMP%\autA.tmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\friendster[1]
- <Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\desktop.ini
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe
- %TEMP%\aut20.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut7.tmp
- <Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe
- <Drive name for removable media>:\Scandals.exe
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut15.tmp
- %TEMP%\autE.tmp
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- 'www.fr###dster.com':80
- 'ir#.dal.net':6667
- 'localhost':1044
- 'gu#####ns.niceboard.net':80
- 'any':6667
- gu#####ns.niceboard.net/adds-h2.htm
- www.fr###dster.com/
- gu#####ns.niceboard.net/IP-h4.htm
- gu#####ns.niceboard.net/mails-h3.htm
- DNS ASK www.fr###dster.com
- DNS ASK ir#.dal.net
- DNS ASK gu#####ns.niceboard.net
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'