Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqdoctormain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimreal.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravstub.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naprdmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsescn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasclnt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfw.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmntor.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updaterui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uplive.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcr32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ulibcfg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uihost.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcrmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xnlscn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\????.] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webproxy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartup.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sndsrvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spbbcsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shstat.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secnotifier.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupLD.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccregvfy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boxmod.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frameworkservice.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrvAnti.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QQ' = '%SystemRoot%\system32\SZ.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QQ' = '%SystemRoot%\system32\SC.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avtask.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avengine.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.kxp] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdetect.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdash.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frwstub.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardfield.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvcui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kregex.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\knownsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislnchr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
- [<HKLM>\SYSTEM\ControlSet001\Services\SXmmcx] 'Start' = '00000002'
- <SYSTEM32>\sc.exe
- <SYSTEM32>\dllcache\sc.exe with <SYSTEM32>\dllcache\sc.exe.new
- <SYSTEM32>\sc.exe with <SYSTEM32>\sc.exe.new
- <Drive name for removable media>:\ADD.exe
- <Drive name for removable media>:\autorun.inf
- hidden files
- file extensions
- <SYSTEM32>\attrib.exe +s +h C:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h L:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h E:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h <Drive name for removable media>:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h I:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h H:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h K:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h J:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h F:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h L:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h K:\ADD.exe
- <SYSTEM32>\cmd.exe /c ""ki.bat""
- <SYSTEM32>\cmd.exe /c ""kill.bat""
- <SYSTEM32>\attrib.exe +s +h H:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h G:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h J:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h I:\ADD.exe
- <SYSTEM32>\attrib.exe +s +h G:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h <DRIVERS>\SXmmcx.sys
- <SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SC.exe
- <SYSTEM32>\attrib.exe +s +h %ALLUSERSPROFILE%\「开始」菜单\程序\启动\SQ.exe
- <SYSTEM32>\attrib.exe +s +h %WINDIR%\Web\Wallpaper\SA.exe
- <SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SW.exe
- <SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SS.exe
- <SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SZ.exe
- <SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SD.exe
- <SYSTEM32>\cmd.exe /c ""reg.bat""
- <SYSTEM32>\attrib.exe +s +h <Drive name for removable media>:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h C:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h F:\autorun.inf
- <SYSTEM32>\attrib.exe +s +h E:\autorun.inf
- <SYSTEM32>\reg.exe import 5.reg
- <SYSTEM32>\cmd.exe /c ""12.bat""
- <SYSTEM32>\ntvdm.exe -f
- <SYSTEM32>\cmd.exe /c ""tmp.bat""
- <Current directory>\tmp.bat
- <Current directory>\autorun.inf
- %WINDIR%\Temp\scs1.tmp
- <Current directory>\tmp33
- <Current directory>\tmp44
- <Current directory>\tmp55
- <Current directory>\kill.bat
- <Current directory>\ki.bat
- <Current directory>\TMP1
- %WINDIR%\Temp\scs2.tmp
- C:\autorun.inf
- C:\ADD.exe
- <SYSTEM32>\SD.exe
- <SYSTEM32>\SZ.exe
- <DRIVERS>\SXmmcx.sys
- <SYSTEM32>\SS.exe
- <SYSTEM32>\SW.exe
- <Current directory>\12.bat
- <Current directory>\tmp11
- <Current directory>\tmp22
- %WINDIR%\Web\Wallpaper\SA.exe
- <Current directory>\5.reg
- <Current directory>\reg.bat
- C:\autorun.inf
- %WINDIR%\Web\Wallpaper\SA.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\ADD.exe
- C:\ADD.exe
- <SYSTEM32>\SW.exe
- <SYSTEM32>\SS.exe
- <SYSTEM32>\SD.exe
- <DRIVERS>\SXmmcx.sys
- <SYSTEM32>\SZ.exe
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\~DF1E70.tmp
- %WINDIR%\Temp\scs1.tmp
- <Current directory>\reg.bat
- <Current directory>\5.reg
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c78.c7c.480001'
- ClassName: 'Indicator' WindowName: ''