Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\HPWombat Service] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\HPWombat Service] 'ImagePath' = '%ProgramFiles(x86)%\HPWombat\HPWombatSrv.exe'
Creates the following services
- 'HPWombat Service' %ProgramFiles(x86)%\HPWombat\HPWombatSrv.exe
Modifies file system
Creates the following files
- %TEMP%\nsz195a.tmp
- %APPDATA%\microsoft\windows\start menu\programs\intеrnеt ехрlоrеr.lnk
- %APPDATA%\microsoft\windows\start menu\programs\intеrnеt ехрlоrеr (64-bit).lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\intеrnеt ехрlоrеr (nо аdd-оns).lnk
- C:\users\public\desktop\ореrа.lnk
- C:\users\public\desktop\firеfох.lnk
- %TEMP%\nsk199a.tmp\inetc.dll
- %ProgramFiles(x86)%\hpwombat\uninstaller.exe
- %ProgramFiles(x86)%\hpwombat\resources\icons\browsers\yandex.ico
- %ProgramFiles(x86)%\hpwombat\resources\icons\browsers\opera.ico
- %ProgramFiles(x86)%\hpwombat\resources\icons\browsers\ie.ico
- %ProgramFiles(x86)%\hpwombat\resources\icons\browsers\firefox.ico
- %ProgramFiles(x86)%\hpwombat\resources\icons\browsers\chrome.ico
- %ProgramFiles(x86)%\hpwombat\wombatstarter.exe
- %ProgramFiles(x86)%\hpwombat\hpwombatsrv.exe
- %TEMP%\nsk199a.tmp\hpwombatinstaller.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firеfох.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ореrа.lnk
Deletes the following files
- %TEMP%\nsk199a.tmp\hpwombatinstaller.exe
- %TEMP%\nsk199a.tmp\inetc.dll
Moves the following files
- from C:\users\public\desktop\firefox.lnk to %ProgramFiles(x86)%\hpwombat\4.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firеfох.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\intеrnеt ехрlоrеr.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\ореrа.lnk
Modifies the following files
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firеfох.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\ореrа.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
Substitutes the following files
- %ProgramFiles(x86)%\hpwombat\4.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\intеrnеt ехрlоrеr.lnk
Network activity
UDP
- DNS ASK gi##ki.ru
Miscellaneous
Creates and executes the following
- '%TEMP%\nsk199a.tmp\hpwombatinstaller.exe' "write_patch_str_to_reg" "<Full path to file>" "HKLM" "Software\HPWombat" "jeromu"
- '%TEMP%\nsk199a.tmp\hpwombatinstaller.exe' "stop_and_remove_srv" "HPWombat Service"
- '%TEMP%\nsk199a.tmp\hpwombatinstaller.exe' "install_and_start_srv" "HPWombat Service" "%ProgramFiles(x86)%\HPWombat\HPWombatSrv.exe"
- '%ProgramFiles(x86)%\hpwombat\hpwombatsrv.exe'
