Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\xvwyndn.exe
- %WINDIR%\tasks.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\fuck.ini
- %ProgramFiles%\sdraw.exe
- %ProgramFiles%\sdtrayapp.exe
- %ProgramFiles%\seamonkey.exe
- %ProgramFiles%\seccenter.exe
- %ProgramFiles%\sfagent.exe
- %ProgramFiles%\sigtool.exe
- %ProgramFiles%\simpress.exe
- %ProgramFiles%\runsetup.exe
- %ProgramFiles%\sitecli.exe
- %ProgramFiles%\skypepm.exe
- %ProgramFiles%\smartftp.exe
- %ProgramFiles%\smath.exe
- %ProgramFiles%\smc.exe
- %ProgramFiles%\sndsrvc.exe
- %ProgramFiles%\sniffer.exe
- %ProgramFiles%\so3d.exe
- %ProgramFiles%\soffice.exe
- %ProgramFiles%\sdhelp.exe
- %ProgramFiles%\skype.exe
- %ProgramFiles%\sdloader.exe
- %ProgramFiles%\sdinvoker.exe
- %ProgramFiles%\sched.exe
- %ProgramFiles%\scanningprocess.exe
- %ProgramFiles%\register.exe
- %ProgramFiles%\removeit.exe
- %ProgramFiles%\remover.exe
- %ProgramFiles%\rescue.exe
- %ProgramFiles%\rfwmain.exe
- %ProgramFiles%\rq.exe
- %ProgramFiles%\rtvscan.exe
- %ProgramFiles%\spamcfg.exe
- %ProgramFiles%\rulaunch.exe
- %ProgramFiles%\rcimlby.exe
- %ProgramFiles%\safari.exe
- %ProgramFiles%\sargui.exe
- %ProgramFiles%\savadminservice.exe
- %ProgramFiles%\savmain.exe
- %ProgramFiles%\savprogress.exe
- %ProgramFiles%\savscan.exe
- %ProgramFiles%\sbase.exe
- %ProgramFiles%\scalc.exe
- %ProgramFiles%\realmon.exe
- %ProgramFiles%\scanner.exe
- %ProgramFiles%\sarcli.exe
- %ProgramFiles%\reference assemblies.exe
- %ProgramFiles%\spbbcsvc.exe
- %ProgramFiles%\spiderui.exe
- %ProgramFiles%\thebat.exe
- %ProgramFiles%\thgnard.exe
- %ProgramFiles%\thunderbird.exe
- %ProgramFiles%\tmas.exe
- %ProgramFiles%\tmlisten.exe
- %ProgramFiles%\tmntsrv.exe
- %ProgramFiles%\tmpfw.exe
- %ProgramFiles%\tmproxy.exe
- %ProgramFiles%\tbmon.exe
- %ProgramFiles%\tnbutil.exe
- %ProgramFiles%\tracelog.exe
- %ProgramFiles%\traymon.exe
- %ProgramFiles%\trillian.exe
- %ProgramFiles%\trojanguarder.exe
- %ProgramFiles%\trojanhunter.exe
- %ProgramFiles%\trtddptr.exe
- %ProgramFiles%\twelvesky2.exe
- %ProgramFiles%\uiscan.exe
- %ProgramFiles%\teatimer.exe
- %ProgramFiles%\tgsvcstp.exe
- %ProgramFiles%\tca.exe
- %ProgramFiles%\sysinfo.exe
- %ProgramFiles%\postinstall.exe
- %ProgramFiles%\sporder.exe
- %ProgramFiles%\spybotsd.exe
- %ProgramFiles%\sro_client.exe
- %ProgramFiles%\start_diag.exe
- %ProgramFiles%\stopsignav.exe
- %ProgramFiles%\streetsolkshim.exe
- %ProgramFiles%\submitfiles.exe
- %ProgramFiles%\spider.exe
- %ProgramFiles%\spidernt.exe
- %ProgramFiles%\spiderml.exe
- %ProgramFiles%\svcntaux.exe
- %ProgramFiles%\sweb.exe
- %ProgramFiles%\swriter.exe
- %ProgramFiles%\symantecrootinstaller.exe
- %ProgramFiles%\symlcsvc.exe
- %ProgramFiles%\symproxysvc.exe
- %ProgramFiles%\symsport.exe
- %ProgramFiles%\symwsc.exe
- %ProgramFiles%\swagent.exe
- %ProgramFiles%\swdoctor.exe
- %ProgramFiles%\swdsvc.exe
- %ProgramFiles%\ravtimer.exe
- %ProgramFiles%\ravmon.exe
- %ProgramFiles%\rat.exe
- %ProgramFiles%\oladdin.exe
- %ProgramFiles%\onaccessinstaller.exe
- %ProgramFiles%\opera.exe
- %ProgramFiles%\oscheck.exe
- %ProgramFiles%\outlook.exe
- %ProgramFiles%\outpost.exe
- %ProgramFiles%\partin.exe
- %ProgramFiles%\partin9x.exe
- %ProgramFiles%\pccntmon.exe
- %ProgramFiles%\partinfo.exe
- %ProgramFiles%\pavfires.exe
- %ProgramFiles%\pavfnsvr.exe
- %ProgramFiles%\pavkre.exe
- %ProgramFiles%\pavprot.exe
- %ProgramFiles%\pavproxy.exe
- %ProgramFiles%\pavprsrv.exe
- %ProgramFiles%\pavsrv51.exe
- %ProgramFiles%\oaui.exe
- %ProgramFiles%\oasrv.exe
- %ProgramFiles%\oget.exe
- %ProgramFiles%\nwservice.exe
- %ProgramFiles%\nvcut.exe
- %ProgramFiles%\netstatviewer.exe
- %ProgramFiles%\nisoptui.exe
- %ProgramFiles%\nod.exe
- %ProgramFiles%\nod32.exe
- %ProgramFiles%\nod32krn.exe
- %ProgramFiles%\nod32kui.exe
- %ProgramFiles%\notifyha.exe
- %ProgramFiles%\notstart.exe
- %ProgramFiles%\pccguide.exe
- %ProgramFiles%\npavtray.exe
- %ProgramFiles%\partinnt.exe
- %ProgramFiles%\nsmdtr.exe
- %ProgramFiles%\nsstray.exe
- %ProgramFiles%\ntoskrnl.exe
- %ProgramFiles%\ntrtscan.exe
- %ProgramFiles%\ntxconfig.exe
- %ProgramFiles%\nupgrade.exe
- %ProgramFiles%\nvcod.exe
- %ProgramFiles%\nvcte.exe
- %ProgramFiles%\npfmsg.exe
- %ProgramFiles%\netxray.exe
- %ProgramFiles%\nssserv.exe
- %ProgramFiles%\ofcpfwsvc.exe
- %ProgramFiles%\pccpfw.exe
- %ProgramFiles%\ps.exe
- %ProgramFiles%\pshost.exe
- %ProgramFiles%\psimsvc.exe
- %ProgramFiles%\pxagent.exe
- %ProgramFiles%\pxconsole.exe
- %ProgramFiles%\pxl.exe
- %ProgramFiles%\pxl1.exe
- %ProgramFiles%\pxreset.exe
- %ProgramFiles%\protect.exe
- %ProgramFiles%\pcctlcom.exe
- %ProgramFiles%\psctrls.exe
- %ProgramFiles%\pxsupport.exe
- %ProgramFiles%\qklez.exe
- %ProgramFiles%\qrtfix.exe
- %ProgramFiles%\quaranti.exe
- %ProgramFiles%\quickstart.exe
- %ProgramFiles%\ragexe.exe
- %ProgramFiles%\ragfree.exe
- %ProgramFiles%\rapget.exe
- %ProgramFiles%\python.exe
- %ProgramFiles%\qhwscsvc.exe
- %ProgramFiles%\qip.exe
- %ProgramFiles%\totalcmd.exe
- %ProgramFiles%\una.exe
- %ProgramFiles%\prevxsetup.exe
- %ProgramFiles%\pertsk.exe
- %ProgramFiles%\pidgin.exe
- %ProgramFiles%\pm.exe
- %ProgramFiles%\pm8flash.exe
- %ProgramFiles%\pmagic.exe
- %ProgramFiles%\pmagic9x.exe
- %ProgramFiles%\pmagicbt.exe
- %ProgramFiles%\pmagicnt.exe
- %ProgramFiles%\privatebrowser.exe
- %ProgramFiles%\processviewer.exe
- %ProgramFiles%\polutil.exe
- %ProgramFiles%\pqboot32.exe
- %ProgramFiles%\pqbw.exe
- %ProgramFiles%\pqpe.exe
- %ProgramFiles%\pqpe9x.exe
- %ProgramFiles%\pqpent.exe
- %ProgramFiles%\preconfig.exe
- %ProgramFiles%\preupd.exe
- %ProgramFiles%\prevsrv.exe
- %ProgramFiles%\pctav.exe
- %ProgramFiles%\ppfw.exe
- %ProgramFiles%\winssnotify.exe
- %WINDIR%\winsxs.exe
- %ProgramFiles%\uninstaller.exe
- %ALLUSERSPROFILE%\templates.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2.exe
- C:\totalcmd\language.exe
- %ALLUSERSPROFILE%.exe
- C:\users\default.exe
- C:\users\default user.exe
- C:\users\public.exe
- %ProgramFiles(x86)%\windows photo viewer.exe
- %HOMEPATH%.exe
- %WINDIR%\appcompat.exe
- %WINDIR%\apppatch.exe
- %WINDIR%\assembly.exe
- %WINDIR%\bitlockerdiscoveryvolumecontents.exe
- %WINDIR%\boot.exe
- %WINDIR%\branding.exe
- %WINDIR%\csc.exe
- %WINDIR%\cursors.exe
- %ALLUSERSPROFILE%\package cache.exe
- %WINDIR%\addins.exe
- %ALLUSERSPROFILE%\sun.exe
- %ALLUSERSPROFILE%\start menu.exe
- %ALLUSERSPROFILE%\oracle.exe
- %ALLUSERSPROFILE%\mozilla.exe
- %ProgramFiles(x86)%\reference assemblies.exe
- %ProgramFiles(x86)%\steam.exe
- %ProgramFiles(x86)%\uninstall information.exe
- %ProgramFiles(x86)%\winamp.exe
- %ProgramFiles(x86)%\windows defender.exe
- %ProgramFiles(x86)%\windows mail.exe
- %ProgramFiles(x86)%\windows media player.exe
- %WINDIR%\debug.exe
- %ProgramFiles(x86)%\windows nt.exe
- %ProgramFiles(x86)%\opera.exe
- %ProgramFiles(x86)%\windows portable devices.exe
- %ALLUSERSPROFILE%\adobe.exe
- %ALLUSERSPROFILE%\application data.exe
- %ALLUSERSPROFILE%\desktop.exe
- %ALLUSERSPROFILE%\documents.exe
- %ALLUSERSPROFILE%\favorites.exe
- %ALLUSERSPROFILE%\microsoft.exe
- %ALLUSERSPROFILE%\microsoft help.exe
- %ProgramFiles(x86)%\pidgin.exe
- %ALLUSERSPROFILE%\microsoft toolkit.exe
- %ProgramFiles(x86)%\windows sidebar.exe
- %ProgramFiles(x86)%\qip 2012.exe
- %WINDIR%\diagnostics.exe
- %WINDIR%\en-us.exe
- %WINDIR%\schcache.exe
- %WINDIR%\schemas.exe
- %WINDIR%\security.exe
- %WINDIR%\serviceprofiles.exe
- %WINDIR%\servicing.exe
- %WINDIR%\setup.exe
- %WINDIR%\shellnew.exe
- %WINDIR%\softwaredistribution.exe
- %WINDIR%\prefetch.exe
- %WINDIR%\speech.exe
- <SYSTEM32>.exe
- %WINDIR%\syswow64.exe
- %WINDIR%\tapi.exe
- %WINDIR%\temp.exe
- %WINDIR%\tracing.exe
- %WINDIR%\twain_32.exe
- %WINDIR%\vss.exe
- %WINDIR%\web.exe
- %WINDIR%\remotepackages.exe
- %WINDIR%\resources.exe
- %WINDIR%\registration.exe
- %WINDIR%\policydefinitions.exe
- %ProgramFiles%\uninstall information.exe
- %WINDIR%\fonts.exe
- %WINDIR%\globalization.exe
- %WINDIR%\help.exe
- %WINDIR%\ime.exe
- %WINDIR%\inf.exe
- %WINDIR%\installer.exe
- %WINDIR%\l2schemas.exe
- %WINDIR%\digitallocker.exe
- %WINDIR%\ehome.exe
- %WINDIR%\downloaded program files.exe
- %WINDIR%\livekernelreports.exe
- %WINDIR%\migration.exe
- %WINDIR%\modemlogs.exe
- %WINDIR%\offline web pages.exe
- %WINDIR%\panther.exe
- %WINDIR%\pchealth.exe
- %WINDIR%\performance.exe
- %WINDIR%\pla.exe
- %WINDIR%\logs.exe
- %WINDIR%\media.exe
- %WINDIR%\microsoft.net.exe
- %ProgramFiles(x86)%\msbuild.exe
- %ProgramFiles(x86)%\mozilla thunderbird.exe
- %ProgramFiles(x86)%\mozilla firefox.exe
- %ProgramFiles%\visthupd.exe
- %ProgramFiles%\vrfwsvc.exe
- %ProgramFiles%\vrmonsvc.exe
- %ProgramFiles%\vrrw32.exe
- %ProgramFiles%\vshwin32.exe
- %ProgramFiles%\vsmon.exe
- %ProgramFiles%\vsserv.exe
- %ProgramFiles%\vsstat.exe
- %ProgramFiles%\windows defender.exe
- %ProgramFiles%\wclose.exe
- %ProgramFiles%\webmoney.exe
- %ProgramFiles%\webproxy.exe
- %ProgramFiles%\webscanx.exe
- %ProgramFiles%\wil.exe
- %ProgramFiles%\winaw32.exe
- %ProgramFiles%\winbaram.exe
- %ProgramFiles%\wincmd32.exe
- %ProgramFiles%\virusnews.exe
- %ProgramFiles%\viruskeeper.exe
- %ProgramFiles%\visthlic.exe
- %ProgramFiles%\viritsvc.exe
- %ProgramFiles%\viritexp.exe
- %ProgramFiles%\uninstalllsp.exe
- %ProgramFiles%\unopkg.exe
- %ProgramFiles%\unp_test.exe
- %ProgramFiles%\up2date.exe
- %ProgramFiles%\updater.exe
- %ProgramFiles%\updaterui.exe
- %ProgramFiles%\updclient.exe
- %ProgramFiles%\upgrepl.exe
- %ProgramFiles%\windowlist.exe
- %ProgramFiles%\upsobmaker.exe
- %ProgramFiles%\webfiltr.exe
- %ProgramFiles%\uupd.exe
- %ProgramFiles%\vba32ifs.exe
- %ProgramFiles%\vba32ldr.exe
- %ProgramFiles%\vba32pp3.exe
- %ProgramFiles%\vbsntw.exe
- %ProgramFiles%\vchk.exe
- %ProgramFiles%\vcrmon.exe
- %ProgramFiles%\vettray.exe
- %ProgramFiles%\usdownloader.exe
- %ProgramFiles%\unoinfo.exe
- %ProgramFiles%\vba32ecm.exe
- %ProgramFiles%\vistaux.exe
- %ProgramFiles%\windows journal.exe
- %ProgramFiles%\yahoomessenger.exe
- %ProgramFiles%\ybclient.exe
- %ProgramFiles%\ymsgr_tray.exe
- %ProgramFiles%\zapro.exe
- %ProgramFiles%\zatutor.exe
- %ProgramFiles%\zauninst.exe
- %ProgramFiles%\zlclient.exe
- %ProgramFiles%\zonealarm.exe
- %ProgramFiles%\xcommsvr.exe
- %ProgramFiles%\windows mail.exe
- %ProgramFiles%\yahoosync.exe
- %ProgramFiles(x86)%\adobe.exe
- %ProgramFiles(x86)%\k-lite codec pack.exe
- %ProgramFiles(x86)%\microsoft analysis services.exe
- %ProgramFiles(x86)%\microsoft office.exe
- %ProgramFiles(x86)%\microsoft visual studio .net 2003.exe
- %ProgramFiles(x86)%\microsoft visual studio 8.exe
- %ProgramFiles(x86)%\microsoft.net.exe
- %ProgramFiles(x86)%\mirc.exe
- %CommonProgramFiles(x86)%.exe
- %ProgramFiles(x86)%\google.exe
- %ProgramFiles(x86)%\internet explorer.exe
- %ProgramFiles%\neowatchtray.exe
- %ProgramFiles%\uninstallcavs.exe
- %ProgramFiles%\wsctool.exe
- %ProgramFiles%\windows nt.exe
- %ProgramFiles%\windows photo viewer.exe
- %ProgramFiles%\windows portable devices.exe
- %ProgramFiles%\windows sidebar.exe
- %ProgramFiles%\windump.exe
- %ProgramFiles%\winmail.exe
- %ProgramFiles%\winrar.exe
- %ProgramFiles%\winroute.exe
- %ProgramFiles%\wsftpgui.exe
- %ProgramFiles%\wsm.exe
- %ProgramFiles%\winss.exe
- %ProgramFiles%\wlloginproxy.exe
- %ProgramFiles%\wlmail.exe
- %ProgramFiles%\wltuser.exe
- %ProgramFiles%\woool.exe
- %ProgramFiles%\wow.exe
- %ProgramFiles%\wradmin.exe
- %ProgramFiles%\wrctrl.exe
- %ProgramFiles%\writespid.exe
- %ProgramFiles%\windows media player.exe
- %ProgramFiles%\wish.exe
- %WINDIR%\system.exe
- %ProgramFiles%\neowatchlog.exe
- %ProgramFiles%\msn6.exe
- %ProgramFiles%\cavmud.exe
- %ProgramFiles%\cavoar.exe
- %ProgramFiles%\cavq.exe
- %ProgramFiles%\cavscons.exe
- %ProgramFiles%\cavse.exe
- %ProgramFiles%\cavsn.exe
- %ProgramFiles%\cavsub.exe
- %ProgramFiles%\bdsubmitwiz.exe
- %ProgramFiles%\cavsubmit.exe
- %ProgramFiles%\cavuserupd.exe
- %ProgramFiles%\cavvl.exe
- %ProgramFiles%\ccapp.exe
- %ProgramFiles%\ccevtmgr.exe
- %ProgramFiles%\ccleaner.exe
- %ProgramFiles%\ccproxy.exe
- %ProgramFiles%\ccsetmgr.exe
- %ProgramFiles%\cemrep.exe
- %ProgramFiles%\cavaud.exe
- %ProgramFiles%\cavumas.exe
- %ProgramFiles%\cavmr.exe
- %ProgramFiles%\cavemsrv.exe
- %ProgramFiles%\cavasm.exe
- %ProgramFiles%\cavapp.exe
- %ProgramFiles%\b2.exe
- %ProgramFiles%\backweb-4476822.exe
- %ProgramFiles%\bdagent.exe
- %ProgramFiles%\bdmcon.exe
- %ProgramFiles%\bdnews.exe
- %ProgramFiles%\bdoesrv.exe
- %ProgramFiles%\bdss.exe
- %ProgramFiles%\chrome.exe
- %ProgramFiles%\bdsubmit.exe
- %ProgramFiles%\avpm.exe
- %ProgramFiles%\bdsurvey.exe
- %ProgramFiles%\bdwizreg.exe
- %ProgramFiles%\blackd.exe
- %ProgramFiles%\blackice.exe
- %ProgramFiles%\blindman.exe
- %ProgramFiles%\btini.exe
- %ProgramFiles%\btinint.exe
- %ProgramFiles%\cabalmain.exe
- %ProgramFiles%\avscan.exe
- %ProgramFiles%\cafix.exe
- %ProgramFiles%\bdswitch.exe
- %ProgramFiles%\avsynmgr.exe
- %ProgramFiles%\clamscan.exe
- %ProgramFiles%\claw95cf.exe
- %ProgramFiles%\dislite.exe
- %ProgramFiles%\dnf.exe
- %ProgramFiles%\dpatrolq.exe
- %ProgramFiles%\drvctl.exe
- %ProgramFiles%\drvirus.exe
- %ProgramFiles%\drvmap.exe
- %ProgramFiles%\drwadins.exe
- %ProgramFiles%\drweb.exe
- %ProgramFiles%\dekaron.exe
- %ProgramFiles%\drweb32w.exe
- %ProgramFiles%\drwebscd.exe
- %ProgramFiles%\drwebupw.exe
- %ProgramFiles%\drwebwcl.exe
- %ProgramFiles%\drwreg.exe
- %ProgramFiles%\dvd maker.exe
- %ProgramFiles%\ecmd.exe
- %ProgramFiles%\egni.exe
- %ProgramFiles%\ehsniffer.exe
- %ProgramFiles%\digsby-app.exe
- %ProgramFiles%\directftp.exe
- %ProgramFiles%\digsby.exe
- %ProgramFiles%\defwatch.exe
- %ProgramFiles%\ashskpcc.exe
- %ProgramFiles%\cleaner.exe
- %ProgramFiles%\cleaner3.exe
- %ProgramFiles%\clisvc.exe
- %ProgramFiles%\clrcche.exe
- %ProgramFiles%\cmain.exe
- %ProgramFiles%\cmgrdian.exe
- %CommonProgramFiles%.exe
- %ProgramFiles%\clamtray.exe
- %ProgramFiles%\claw95.exe
- %ProgramFiles%\clamwin.exe
- %ProgramFiles%\copyx64.exe
- %ProgramFiles%\cssexc.exe
- %ProgramFiles%\custinstall.exe
- %ProgramFiles%\custsetup.exe
- %ProgramFiles%\cuteftp.exe
- %ProgramFiles%\dbconvert.exe
- %ProgramFiles%\dbtool.exe
- %ProgramFiles%\defensewall.exe
- %ProgramFiles%\courier.exe
- %ProgramFiles%\cpd.exe
- %ProgramFiles%\csendto.exe
- %ProgramFiles%\avpcc.exe
- %ProgramFiles%\avnotify.exe
- %ProgramFiles%\avkwctl.exe
- %ProgramFiles%\ackwin32.exe
- %ProgramFiles%\admunch.exe
- %ProgramFiles%\agb5.exe
- %ProgramFiles%\ageofconan.exe
- %ProgramFiles%\ahnsd.exe
- %ProgramFiles%\aim6.exe
- %ProgramFiles%\aimpro.exe
- %ProgramFiles%\airdefense.exe
- %ProgramFiles%\ashavast.exe
- %ProgramFiles%\almon.exe
- %ProgramFiles%\amon.exe
- %ProgramFiles%\amsn.exe
- %ProgramFiles%\anti-trojan.exe
- %ProgramFiles%\antivirus.exe
- %ProgramFiles%\aoltbserver.exe
- %ProgramFiles%\armor2net.exe
- %ProgramFiles%\armorsurf.exe
- %ProgramFiles%\a2wizard.exe
- %ProgramFiles%\a2upd.exe
- %ProgramFiles%\about.exe
- %ProgramFiles%\a2start.exe
- %ProgramFiles%\a2service.exe
- %HOMEPATH%\documents\ñô´º¹ºîï°é.png
- D:\ñô´º¹ºîï°é.png
- %HOMEPATH%\desktop\ñô´º¹ºîï°é.png
- %HOMEPATH%\desktop\ñô´º¹ºîï°é.lnk
- %HOMEPATH%\desktop\360°²è«µ¼º½.lnk
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001.exe
- C:\far2\addons.exe
- C:\far2\documentation.exe
- %ProgramFiles%\ash.exe
- C:\far2\encyclopedia.exe
- %ProgramFiles%\alsvc.exe
- C:\far2\plugins.exe
- C:\msocache\all users.exe
- C:\perflogs\admin.exe
- %ProgramFiles%\360tray.exe
- %ProgramFiles%\a2cmd.exe
- %ProgramFiles%\a2guard.exe
- %ProgramFiles%\a2hijackfree.exe
- %ProgramFiles%\a2scan.exe
- C:\far2\fexcept.exe
- %HOMEPATH%\favorites\ñô´º¹ºîï°é.png
- C:\far2\pluginsdk.exe
- %ProgramFiles%\aavshield.exe
- %ProgramFiles%\ashavsrv.exe
- %ProgramFiles%\avconfig.exe
- %ProgramFiles%\avgamsvr.exe
- %ProgramFiles%\avgcc.exe
- %ProgramFiles%\avgdiag.exe
- %ProgramFiles%\avgemc.exe
- %ProgramFiles%\avgfwsrv.exe
- %ProgramFiles%\avginet.exe
- %ProgramFiles%\avgnpdln.exe
- %ProgramFiles%\avcmd.exe
- %ProgramFiles%\ashchest.exe
- %ProgramFiles%\avconsol.exe
- %ProgramFiles%\avgnpsvc.exe
- %ProgramFiles%\avgupsvc.exe
- %ProgramFiles%\avgvv.exe
- %ProgramFiles%\avgw.exe
- %ProgramFiles%\avgwizfw.exe
- %ProgramFiles%\avinitnt.exe
- %ProgramFiles%\avkserv.exe
- %ProgramFiles%\avkservice.exe
- %ProgramFiles%\avgrssvc.exe
- %ProgramFiles%\avgscan.exe
- %ProgramFiles%\avgupden.exe
- %ProgramFiles%\drweb386.exe
- %ProgramFiles%\ekrn.exe
- %ProgramFiles%\avadmin.exe
- %ProgramFiles%\ashdug.exe
- %ProgramFiles%\ashenhcd.exe
- %ProgramFiles%\ashlogv.exe
- %ProgramFiles%\ashmaisv.exe
- %ProgramFiles%\ashpopwz.exe
- %ProgramFiles%\ashquick.exe
- %ProgramFiles%\ashserv.exe
- %ProgramFiles%\ashsimp2.exe
- %ProgramFiles%\avcenter.exe
- %ProgramFiles%\avciman.exe
- %ProgramFiles%\ashsimpl.exe
- %ProgramFiles%\ashupd.exe
- %ProgramFiles%\ashwebsv.exe
- %ProgramFiles%\ash_updatemediator.exe
- %ProgramFiles%\aswregsvr.exe
- %ProgramFiles%\aswupdsv.exe
- %ProgramFiles%\autodown.exe
- %ProgramFiles%\autostartexplorer.exe
- %ProgramFiles%\autotrace.exe
- %ProgramFiles%\ashdisp.exe
- %ProgramFiles%\ashskpck.exe
- %ProgramFiles%\fspc.exe
- %ProgramFiles%\navw32.exe
- %ProgramFiles%\eudora.exe
- %ProgramFiles%\isuac.exe
- %ProgramFiles%\itunes.exe
- %ProgramFiles%\java.exe
- %ProgramFiles%\k-meleon.exe
- %ProgramFiles%\kav.exe
- %ProgramFiles%\kavmm.exe
- %ProgramFiles%\kavpf.exe
- %ProgramFiles%\inorpc.exe
- %ProgramFiles%\kavpfw.exe
- %ProgramFiles%\kavsvc.exe
- %ProgramFiles%\konnekt.exe
- %ProgramFiles%\launcher.exe
- %ProgramFiles%\licmgr.exe
- %ProgramFiles%\livesrv.exe
- %ProgramFiles%\liveupdate.exe
- %ProgramFiles%\logwatnt.exe
- %ProgramFiles%\lotroclient.exe
- %ProgramFiles%\ispnews.exe
- %ProgramFiles%\kavstart.exe
- %ProgramFiles%\issvc.exe
- %ProgramFiles%\ispwdsvc.exe
- %ProgramFiles%\isafe.exe
- %ProgramFiles%\iron.exe
- %ProgramFiles%\ih8.exe
- %ProgramFiles%\ih8run.exe
- %ProgramFiles%\ilaunchr.exe
- %ProgramFiles%\imapp.exe
- %ProgramFiles%\imnotfy.exe
- %ProgramFiles%\impcnt.exe
- %ProgramFiles%\incmail.exe
- %ProgramFiles%\lpfw.exe
- %ProgramFiles%\inocit.exe
- %ProgramFiles%\ieregfix.exe
- %ProgramFiles%\inort.exe
- %ProgramFiles%\inouptng.exe
- %ProgramFiles%\inphasenxd.exe
- %ProgramFiles%\installcavs.exe
- %ProgramFiles%\installlicense.exe
- %ProgramFiles%\installlsp.exe
- %ProgramFiles%\instlsp.exe
- %ProgramFiles%\internet explorer.exe
- %ProgramFiles%\ieuser.exe
- %ProgramFiles%\iris.exe
- %ProgramFiles%\inotask.exe
- %ProgramFiles%\iexplore.exe
- %ProgramFiles%\lucallbackproxy.exe
- %ProgramFiles%\luna.exe
- %ProgramFiles%\mp3toys.exe
- %ProgramFiles%\mp3toystray.exe
- %ProgramFiles%\mp3tray.exe
- %ProgramFiles%\mpeng.exe
- %ProgramFiles%\mpftray.exe
- %ProgramFiles%\mpssvc.exe
- %ProgramFiles%\msbuild.exe
- %ProgramFiles%\msimn.exe
- %ProgramFiles%\miro.exe
- %ProgramFiles%\msmpsvc.exe
- %ProgramFiles%\msnmsgr.exe
- %ProgramFiles%\mva.exe
- %ProgramFiles%\mvc.exe
- %ProgramFiles%\myagtsvc.exe
- %ProgramFiles%\myagttry.exe
- %ProgramFiles%\navapsvc.exe
- %ProgramFiles%\navlu32.exe
- %ProgramFiles%\navstub.exe
- %ProgramFiles%\monsysnt.exe
- %ProgramFiles%\mp3theater.exe
- %ProgramFiles%\monlite.exe
- %ProgramFiles%\miranda32.exe
- %ProgramFiles%\elementclient.exe
- %ProgramFiles%\luupdate.exe
- %ProgramFiles%\magent.exe
- %ProgramFiles%\malwareremoval.exe
- %ProgramFiles%\maplestory.exe
- %ProgramFiles%\maxthon.exe
- %ProgramFiles%\mcmnhdlr.exe
- %ProgramFiles%\mcregwiz.exe
- %ProgramFiles%\lucheck.exe
- %ProgramFiles%\luinit.exe
- %ProgramFiles%\luconfig.exe
- %ProgramFiles%\mcshield.exe
- %ProgramFiles%\mfpmp.exe
- %ProgramFiles%\microsoft analysis services.exe
- %ProgramFiles%\microsoft office.exe
- %ProgramFiles%\microsoft sql server compact edition.exe
- %ProgramFiles%\microsoft sync framework.exe
- %ProgramFiles%\microsoft synchronization services.exe
- %ProgramFiles%\mir3game.exe
- %ProgramFiles%\mcupdmgr.exe
- %ProgramFiles%\mcvsshld.exe
- %ProgramFiles%\memstring.exe
- %ProgramFiles%\icqlite.exe
- %ProgramFiles%\icq.exe
- %ProgramFiles%\iamserv.exe
- %ProgramFiles%\fsaua.exe
- %ProgramFiles%\fsauach.exe
- %ProgramFiles%\fsav.exe
- %ProgramFiles%\fsav32.exe
- %ProgramFiles%\fsavaui.exe
- %ProgramFiles%\fsavgui.exe
- %ProgramFiles%\fsavstrt.exe
- %ProgramFiles%\fsavwsch.exe
- %ProgramFiles%\fsgk32.exe
- %ProgramFiles%\fsavwscr.exe
- %ProgramFiles%\fsdbuh.exe
- %ProgramFiles%\fsdc.exe
- %ProgramFiles%\fsdfwd.exe
- %ProgramFiles%\fsdiag.exe
- %ProgramFiles%\fsdiagui.exe
- %ProgramFiles%\fsfwwsch.exe
- %ProgramFiles%\fsfwwscr.exe
- %ProgramFiles%\fpwin.exe
- %ProgramFiles%\fptrayproc.exe
- %ProgramFiles%\fsample.exe
- %ProgramFiles%\fpscan.exe
- %ProgramFiles%\fprottray.exe
- %ProgramFiles%\ewidoctrl.exe
- %ProgramFiles%\ezantivirusregistrationcheck.exe
- %ProgramFiles%\f-sched.exe
- %ProgramFiles%\fameh32.exe
- %ProgramFiles%\far.exe
- %ProgramFiles%\fch32.exe
- %ProgramFiles%\fdm.exe
- %ProgramFiles%\fdmwi.exe
- %ProgramFiles%\fsgetwab.exe
- %ProgramFiles%\filezilla.exe
- %ProgramFiles%\fsbwsys.exe
- %ProgramFiles%\firefox.exe
- %ProgramFiles%\firetray.exe
- %ProgramFiles%\flashfxp.exe
- %ProgramFiles%\flashgot.exe
- %ProgramFiles%\flock.exe
- %ProgramFiles%\foxit.exe
- %ProgramFiles%\fpavserver.exe
- %ProgramFiles%\fpavupdm.exe
- %ProgramFiles%\firebird.exe
- %ProgramFiles%\exit_av.exe
- %ProgramFiles%\firesvc.exe
- %ProgramFiles%\freshclam.exe
- %ProgramFiles%\fsgk32st.exe
- %ProgramFiles%\gcasserv.exe
- %ProgramFiles%\gg.exe
- %ProgramFiles%\giantantispywaremain.exe
- %ProgramFiles%\giantantispywareupdater.exe
- %ProgramFiles%\gnotify.exe
- %ProgramFiles%\googledesktop.exe
- %ProgramFiles%\googletalk.exe
- %ProgramFiles%\googleupdate.exe
- %ProgramFiles%\gcasdtserv.exe
- %ProgramFiles%\fsguidll.exe
- %ProgramFiles%\ge.exe
- %ProgramFiles%\guardgni.exe
- %ProgramFiles%\helper.exe
- %ProgramFiles%\hipsdiag.exe
- %ProgramFiles%\hregmon.exe
- %ProgramFiles%\hrres.exe
- %ProgramFiles%\hsockpe.exe
- %ProgramFiles%\httplook.exe
- %ProgramFiles%\iamapp.exe
- %ProgramFiles%\guardnt.exe
- %ProgramFiles%\gw.exe
- %ProgramFiles%\helpctr.exe
- %ProgramFiles%\navwnt.exe
- %ProgramFiles%\etherd.exe
- %ProgramFiles%\fsus.exe
- %ProgramFiles%\fshdll32.exe
- %ProgramFiles%\fshelp.exe
- %ProgramFiles%\fshotfix.exe
- %ProgramFiles%\fsihcomp.exe
- %ProgramFiles%\fsihs.exe
- %ProgramFiles%\fslaunch.exe
- %ProgramFiles%\fsm32.exe
- %ProgramFiles%\fsma32.exe
- %ProgramFiles%\ftpte.exe
- %ProgramFiles%\gc.exe
- %ProgramFiles%\fsmb32.exe
- %ProgramFiles%\fsqh.exe
- %ProgramFiles%\fssf.exe
- %ProgramFiles%\fssg.exe
- %ProgramFiles%\fssm32.exe
- %ProgramFiles%\fsstm.exe
- %ProgramFiles%\fssw.exe
- %ProgramFiles%\fstlui.exe
- %ProgramFiles%\fsuninst.exe
- %ProgramFiles%\fsguiexe.exe
- %ProgramFiles%\fspex.exe
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001.exe
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\[0a7ceb79e86e27f8da2c873e2763c561]
Network activity
TCP
HTTP GET requests
- http://www.ba##u.com/
UDP
- DNS ASK ba##u.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\explorer.exe' <PATH_SAMPLE>
