Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\Ghost\shell\open\command] '' = 'C:\dosh\ghos\Ghostexp.exe "%1"'
- [<HKLM>\SOFTWARE\Classes\Applications\Ghostexp.exe\shell\open\command] '' = 'C:\dosh\ghos\Ghostexp.exe "%1"'
Modifies file system:
Creates the following files:
- C:\dosh\ghos\uninstall.dat
- C:\dosh\ghos\dp1.fne
- C:\dosh\ghos\gho_swit.ini
- C:\dosh\ghos\NTDETECT.COM
- C:\dosh\ghos\eAPI.fne
- C:\dosh\ghos\shellEx.fne
- C:\dosh\ghos\iext.fnr
- C:\dosh\ghos\iext2.fne
- C:\dosh\ghos\shell.fne
- C:\dosh\ghos\ds_nor.txt
- C:\dosh\ghos\ds_nor_d.txt
- C:\dosh\ghos\ds_all3.txt
- C:\dosh\ghos\ds_all4.txt
- C:\dosh\ghos\gho_pass.txt
- C:\dosh\ghos\gho_drv.ini
- C:\dosh\ghos\gho_pass.ini
- %WINDIR%\gg.reg
- C:\dosh\ghos\boot.ini
- C:\dosh\ghos\menu4.lst
- C:\dosh\ghos\ghldr.mbr
- C:\dosh\ghos\menu2.lst
- C:\dosh\ghos\menu3.lst
- C:\dosh\ghos\1KG_su.exe
- C:\dosh\ghos\uninstall.exe
- %TEMP%\7ZSfx000.cmd
- C:\dosh\ghos\Ghostexp.exe
- C:\dosh\ghos\gho_run.exe
- %HOMEPATH%\桌面\一键GHOST.lnk
- %HOMEPATH%\「开始」菜单\程序\一键GHOST\一键GHOST.lnk
- C:\dosh\ghos\krnln.fnr
- %HOMEPATH%\「开始」菜单\程序\一键GHOST\GhostExp.lnk
- %HOMEPATH%\「开始」菜单\程序\一键GHOST\卸载 一键GHOST.lnk
- C:\dosh\ghos\menu.lst
- C:\dosh\ghos\menu1.lst
- C:\dosh\ghos\卸载 一键GHOST.lnk
- %HOMEPATH%\「开始」菜单\程序\一键GHOST\帮助文件.lnk
- C:\dosh\ghos\ds_all2.txt
- C:\dosh\ghos\ds
- C:\dosh\ghos\fi
- C:\dosh\ghos\BCD_SET
- C:\dosh\ghos\del_gho
- C:\dosh\ghos\fr
- C:\GHLDR
- C:\dosh\ghos\GHLDR_0
- C:\dosh\ghos\ft
- C:\dosh\ghos\GHLDR
- %WINDIR%\Temp\ghost.exe
- C:\dosh\ghos\1KG_rd
- C:\boot.old
- %TEMP%\aut1.tmp
- C:\dosh\ghos\1KG_rd0
- C:\dosh\ghos\1KG_un
- C:\dosh\ghos\1KG_unis
- C:\dosh\ghos\1KG_rd1
- C:\dosh\ghos\1KG_SU
- C:\dosh\ghos\IRIMG1.BMP
- C:\dosh\ghos\bootfont.bin
- C:\dosh\ghos\help.chm
- C:\dosh\ghos\IRIMG1.JPG
- C:\dosh\ghos\ghost.img
- C:\dosh\ghos\ds_all.txt
- C:\dosh\ghos\ds_all0.txt
- C:\dosh\ghos\uninstall.xml
- C:\dosh\ghos\c_pan.txt
- C:\dosh\ghos\grub0
- C:\dosh\ghos\grub2_15
- C:\dosh\ghos\ghostexp
- C:\dosh\ghos\gho_run
- C:\dosh\ghos\md5
- C:\dosh\ghos\ntldr
- C:\dosh\ghos\xc
- C:\dosh\ghos\memdisk
- C:\dosh\ghos\nt
Sets the 'hidden' attribute to the following files:
- C:\GHLDR
- C:\boot.old
Deletes the following files:
- %TEMP%\7ZSfx000.cmd
- %WINDIR%\gg.reg
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\ghost.exe
Substitutes the following files:
- C:\boot.ini
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following:
- '%WINDIR%\Temp\ghost.exe'
Executes the following:
- '%WINDIR%\regedit.exe' /s %WINDIR%\gg.reg
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
