Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<216>'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TermService] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\TerminalServer\logging\TerminalServer.utf8.log
- C:\Documents and Settings\Default User\NTUSER.DAT.LOG
- C:\Documents and Settings\LocalService\NTUSER
- C:\Documents and Settings\NetworkService\NTUSER
- %HOMEPATH%\NTUSER
Deletes the following files:
- %WINDIR%\Temp\Perflib_Perfdata_7e8.dat
Miscellaneous:
Searches for the following windows:
- ClassName: 'StatusWindowClass' WindowName: ''
Executes the following:
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /dl /n "TerminalServer Printer" /q
- '<SYSTEM32>\spoolsv.exe'
Attempts to shut down the Windows operating system.
