Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\wuauserv] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\TerminalServer\logging\TerminalServer_uninstall.utf8.log
- C:\Documents and Settings\Default User\NTUSER.DAT.LOG
- C:\Documents and Settings\LocalService\NTUSER
- C:\Documents and Settings\NetworkService\NTUSER
- %HOMEPATH%\NTUSER
Deletes the following files:
- %WINDIR%\Temp\Perflib_Perfdata_7e8.dat
Miscellaneous:
Searches for the following windows:
- ClassName: 'StatusWindowClass' WindowName: ''
Executes the following:
- '<SYSTEM32>\schtasks.exe' /delete /F /TN "tsvGuardian"
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /dl /n "TerminalServer Printer" /q
- '<SYSTEM32>\spoolsv.exe'
Attempts to shut down the Windows operating system.
