Technical Information
Modifies file system :
Creates the following files:
- %TEMP%\afwaafr
- %TEMP%\aut1.tmp
Deletes the following files:
- %TEMP%\afwaafr
- %TEMP%\aut1.tmp
Moves itself:
- from <Full path to virus> to <Current directory>\phBot Manager.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
