Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wondos' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{E0C83A0D-E247-C42D-D8E1-C73D33BA7D5F}] 'StubPath' = '<Full path to virus>'
- %WINDIR%\Explorer.EXE
- Idle
- msnmsgr.exe
- 'gr####b.no-ip.org':3460
- 'localhost':3460
- DNS ASK gr####b.no-ip.org