Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star6' = '<SYSTEM32>\MscheldB.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star4' = '<SYSTEM32>\Zred2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star8' = '<SYSTEM32>\svscheld.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star7' = '<SYSTEM32>\Mscheldncx.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star1' = '<SYSTEM32>\Winrun.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<Full path to virus>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star3' = '<SYSTEM32>\Xred1.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star2' = '<SYSTEM32>\ischot.exe'
- %WINDIR%\control.ctr
- C:\wins\net.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\net[1].txt
- 'al#####id2013.webs.com':80
- 'localhost':1037
- al#####id2013.webs.com/net.txt
- DNS ASK al#####id2013.webs.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''