Technical Information
- [<HKLM>\SOFTWARE\Classes\.ghi\shell\open\command] '' = '%PROGRAM_FILES%\lvegned\sysinit.exe'
- %PROGRAM_FILES%\lvegned\scvhost.exe
- %PROGRAM_FILES%\lvegned\sstatic.exe
- %TEMP%\is-LI0S3.tmp\is-9O6CB.tmp /SL4 $40036 "<Full path to virus>" 84417 52224
- %PROGRAM_FILES%\lvegned\is-KA7M5.tmp
- %PROGRAM_FILES%\lvegned\is-QS5QR.tmp
- %PROGRAM_FILES%\lvegned\is-6LV6V.tmp
- %PROGRAM_FILES%\lvegned\unins000.dat
- %PROGRAM_FILES%\lvegned\is-SS449.tmp
- %PROGRAM_FILES%\lvegned\is-NDU17.tmp
- %TEMP%\is-S8P6I.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LI0S3.tmp\is-9O6CB.tmp
- %TEMP%\is-S8P6I.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\lvegned\is-65665.tmp
- %PROGRAM_FILES%\lvegned\is-Q0OPP.tmp
- %TEMP%\is-LI0S3.tmp\is-9O6CB.tmp
- %TEMP%\is-S8P6I.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-S8P6I.tmp\_isetup\_RegDLL.tmp
- 'localhost':1036
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''