Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Media Player' = '<SYSTEM32>\WMPlayer.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\vai.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\MSBuexe
- %PROGRAM_FILES%\Movie Maexe
- %PROGRAM_FILES%\exe
- %PROGRAM_FILES%\NetMeetexe
- %PROGRAM_FILES%\MSN Gaming Zexe
- %PROGRAM_FILES%\Fireexe
- %PROGRAM_FILES%\ComPlus Applicatiexe
- %PROGRAM_FILES%\Internet Exploexe
- %PROGRAM_FILES%\microsoft frontpexe
- %PROGRAM_FILES%\Messenexe
- %PROGRAM_FILES%\WindowsUpdexe
- %PROGRAM_FILES%\Windowsexe
- %PROGRAM_FILES%\xeexe
- C:\<Auxiliary name>exe
- C:\Muldroexe
- %PROGRAM_FILES%\Outlook Exprexe
- %PROGRAM_FILES%\Online Serviexe
- %PROGRAM_FILES%\Reference Assemblexe
- %PROGRAM_FILES%\Windows Media Plaexe
- %PROGRAM_FILES%\Uninstall Informatexe
- %PROGRAM_FILES%\Common Fiexe
- C:\Muldexe
- C:\Fexe
- C:\ntexe
- C:\RECYCexe
- C:\Program Fiexe
- C:\vai.exe
- <SYSTEM32>\WMPlayer.exe
- C:\autorun.inf
- C:\Documents and Settiexe
- C:\bf32dexe
- C:\RECYCLERexe
- C:\RECYCLEexe
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1exe
- %PROGRAM_FILES%exe
- C:\Program Fileexe
- C:\System Volume Informatexe
- C:\Stexe
- C:\WINDexe
- <Auxiliary element>
- C:\Stubexe
Deletes the following files:
- %PROGRAM_FILES%\MSBuexe
- %PROGRAM_FILES%\MSN Gaming Zexe
- %PROGRAM_FILES%\NetMeetexe
- %PROGRAM_FILES%\Movie Maexe
- %PROGRAM_FILES%\Internet Exploexe
- %PROGRAM_FILES%\Messenexe
- %PROGRAM_FILES%\microsoft frontpexe
- %PROGRAM_FILES%\Online Serviexe
- %PROGRAM_FILES%\Windowsexe
- %PROGRAM_FILES%\WindowsUpdexe
- %PROGRAM_FILES%\xeexe
- %PROGRAM_FILES%\Windows Media Plaexe
- %PROGRAM_FILES%\Outlook Exprexe
- %PROGRAM_FILES%\Reference Assemblexe
- %PROGRAM_FILES%\Uninstall Informatexe
- %PROGRAM_FILES%\Fireexe
- C:\ntexe
- C:\Program Fiexe
- C:\RECYCexe
- C:\Muldexe
- C:\bf32dexe
- C:\Documents and Settiexe
- C:\Fexe
- C:\Stexe
- %PROGRAM_FILES%\Common Fiexe
- %PROGRAM_FILES%\ComPlus Applicatiexe
- %PROGRAM_FILES%\exe
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1exe
- C:\System Volume Informatexe
- C:\WINDexe
- <Auxiliary element>
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'Safely Remove USB Disks'
- ClassName: '(null)' WindowName: 'Safely Remove Hardware'
