Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'hsys' = '<Current directory>\HSYS.EXE'
Malicious functions:
Creates and executes the following:
- <Current directory>\HSYS.EXE Kill_50903C9=<Full path to virus>
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <Current directory>\kl.dll
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '*.bat'
Modifies file system :
Creates the following files:
- <Current directory>\kl.dll
- <Current directory>\hsys.log
- <Current directory>\HSYS.EXE
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
