To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
Creates and executes the following:
- '%WINDIR%\winnt.exe' /pid=3476
- '%WINDIR%\winnt.exe' /pid=3436
- '%WINDIR%\winnt.exe' /pid=2428
- '%WINDIR%\winnt.exe' /pid=412
- '%WINDIR%\winnt.exe' /pid=3256
- '%WINDIR%\winnt.exe'
- '%WINDIR%\winnt.exe' /pid=3420
- '%WINDIR%\winnt.exe' /pid=3340
Executes the following:
- '<SYSTEM32>\at.exe'
- '<SYSTEM32>\at.exe' 09:00 /interactive /EVERY:m,t,w,th,f,s,su <SYSTEM32>\winfiles.exe
- '<SYSTEM32>\at.exe' /delete /yes
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\at.exe
Terminates or attempts to terminate
the following system processes:
a large number of user processes.
Forces autoplay for removable media.