Technical Information
- <Drive name for removable media>:\dll.vbs
- '%TEMP%\is-1GIF1.tmp\h.tmp' /SL5="$200E2,2672624,57856,<LS_APPDATA>\Windows\h.exe"
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\dll.vbs"
- '<LS_APPDATA>\Windows\h.exe'
- '<SYSTEM32>\wscript.exe' "<LS_APPDATA>\Windows7\dll.vbs"
- '<SYSTEM32>\schtasks.exe' /Create /TN WindowsUpda2ta /xml %TEMP%\R.jpg
- %TEMP%\is-1GIF1.tmp\h.tmp
- %APPDATA%\Microsoft\dll.vbs
- <LS_APPDATA>\Windows\h.exe
- <LS_APPDATA>\Windows7\dll.vbs
- <Drive name for removable media>:\dll.vbs
- 'dl#.#ynddns.us':5550
- 'localhost':1036
- DNS ASK dl#.#ynddns.us