Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\msg.exe * Acaba de ser eliminado el Messenger por el virus concha
- <SYSTEM32>\shutdown.exe -s -t 150 -c "Se te ha borrado el MSN, cortesia de Anti-Desocupados y la concha de la lora "
- <SYSTEM32>\taskkill.exe /f /im "msnmsgr.exe"
- <SYSTEM32>\msg.exe * Gracias por tu tiempo
Terminates or attempts to terminate
the following user processes:
- msnmsgr.exe
Modifies file system :
Creates the following files:
- %TEMP%\a57486.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\a57486.bat
Deletes the following files:
- %TEMP%\a57486.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
