Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QuickTime Task' = '%WINDIR%\Media\AvMsUpd.exe'
- %WINDIR%\wnetsock08.dll
- <Current directory>\upset1.dat
- <Current directory>\user.dat
- <Current directory>\Temp.tjp
- %WINDIR%\Media\AvMsUpd.exe
- <Current directory>\Temp.tjp
- 'sm####10.tripod.com':80
- '<Private IP address>':80
- 'se#####10.tripod.com':80
- '72.##9.145.229':80
- sm####10.tripod.com/set.txt
- <Private IP address>
- se#####10.tripod.com/CurrVer.txt
- 72.##9.145.229/server/ok.php?id##
- <Private IP address>
- DNS ASK sm####10.tripod.com
- DNS ASK se#####10.tripod.com
- ClassName: 'Shell_TrayWnd' WindowName: ''