Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Kaspersky Internet Security' = '<Full path to virus>'
- '<SYSTEM32>\net1.exe' stop mpssvc
- '<SYSTEM32>\net1.exe' stop sharedaccess
- '<SYSTEM32>\net.exe' stop mpssvc
- '<SYSTEM32>\net.exe' stop sharedaccess
- %TEMP%\msvcpdll100.dll
- 'tu#.#vsonin.com':5220
- DNS ASK tu#.#vsonin.com
- ClassName: 'Indicator' WindowName: '(null)'