Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Wrapper' = 'runonce'
Modifies file system:
Creates the following files:
- %WINDIR%\Cursors\Л®ѕ§\SET7.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET8.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET9.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET6.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET3.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET4.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET5.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETA.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETF.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET10.tmp
- %WINDIR%\Cursors\Л®ѕ§\SET11.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETE.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETB.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETC.tmp
- %WINDIR%\Cursors\Л®ѕ§\SETD.tmp
- %TEMP%\RarSFX0\Help.cur
- %TEMP%\RarSFX0\SizeNESW.cur
- %TEMP%\RarSFX0\SizeNS.cur
- %TEMP%\RarSFX0\SizeNWSE.cur
- %TEMP%\RarSFX0\SizeAll.cur
- %TEMP%\RarSFX0\IBeam.cur
- %TEMP%\RarSFX0\NO.cur
- %TEMP%\RarSFX0\NWPen.cur
- %TEMP%\RarSFX0\SizeWE.cur
- %TEMP%\RarSFX0\AutoSetup.inf
- %TEMP%\RarSFX0\Cross.cur
- %TEMP%\RarSFX0\Hand.cur
- %TEMP%\RarSFX0\Arrow.cur
- %TEMP%\RarSFX0\UpArrow.cur
- %TEMP%\RarSFX0\Wait.ani
- %TEMP%\RarSFX0\AppStarting.ani
Moves the following files:
- from %WINDIR%\Cursors\Л®ѕ§\SETD.tmp to %WINDIR%\Cursors\Л®ѕ§\SizeNWSE.cur
- from %WINDIR%\Cursors\Л®ѕ§\SETC.tmp to %WINDIR%\Cursors\Л®ѕ§\SizeWE.cur
- from %WINDIR%\Cursors\Л®ѕ§\SETB.tmp to %WINDIR%\Cursors\Л®ѕ§\SizeNS.cur
- from %WINDIR%\Cursors\Л®ѕ§\SETE.tmp to %WINDIR%\Cursors\Л®ѕ§\SizeNESW.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET11.tmp to %WINDIR%\Cursors\Л®ѕ§\Hand.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET10.tmp to %WINDIR%\Cursors\Л®ѕ§\UpArrow.cur
- from %WINDIR%\Cursors\Л®ѕ§\SETF.tmp to %WINDIR%\Cursors\Л®ѕ§\SizeAll.cur
- from %WINDIR%\Cursors\Л®ѕ§\SETA.tmp to %WINDIR%\Cursors\Л®ѕ§\NO.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET5.tmp to %WINDIR%\Cursors\Л®ѕ§\Wait.ani
- from %WINDIR%\Cursors\Л®ѕ§\SET4.tmp to %WINDIR%\Cursors\Л®ѕ§\Help.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET3.tmp to %WINDIR%\Cursors\Л®ѕ§\Arrow.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET6.tmp to %WINDIR%\Cursors\Л®ѕ§\AppStarting.ani
- from %WINDIR%\Cursors\Л®ѕ§\SET9.tmp to %WINDIR%\Cursors\Л®ѕ§\NWPen.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET8.tmp to %WINDIR%\Cursors\Л®ѕ§\IBeam.cur
- from %WINDIR%\Cursors\Л®ѕ§\SET7.tmp to %WINDIR%\Cursors\Л®ѕ§\Cross.cur
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Executes the following:
- '<SYSTEM32>\runonce.exe'
- '<SYSTEM32>\rundll32.exe' shell32.dll,Control_RunDLL main.cpl @0,1
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\RarSFX0\AutoSetup.inf
- '<SYSTEM32>\runonce.exe' -r
