Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DriverPath' = '%WINDIR%.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FFSetup' = '%PROGRAM_FILES%\Gunblade.scr'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Mr_CF' = 'Chocobo.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Xioma' = '%PROGRAM_FILES%\Sephiroth.bat'
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Microsoft Office.pif
Создает следующие файлы на съемном носителе:
- <Имя диска съемного носителя>:\New Folder.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%.exe
- %PROGRAM_FILES%\Gunblade.scr
- C:\New Folder.exe
- %PROGRAM_FILES%\Sephiroth.bat
- %ALLUSERSPROFILE%\Documents\My Music\Melodies of Life.exe
- <SYSTEM32>\Chocobo.exe
- %ALLUSERSPROFILE%\Documents\Final Fantasy.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Emiko Shiratori.exe
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'IRSA TA 201'
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Copying...'
- ClassName: '' WindowName: 'Moving...'
- ClassName: '' WindowName: 'Deleting...'
- ClassName: '' WindowName: 'HijackThis - v1.99.1'
- ClassName: '' WindowName: 'Pocket Killbox'
- ClassName: '' WindowName: 'Folder Options'
- ClassName: '' WindowName: 'Recycle Bin'
- ClassName: '' WindowName: 'Process Explorer - Sysinternals: www.sysinternals.com'
- ClassName: '' WindowName: 'Pinball'
- ClassName: '' WindowName: 'Minesweeper'
- ClassName: '' WindowName: 'Microsoft Visual Basic'
- ClassName: '' WindowName: 'Norton AntiVirus'
- ClassName: '' WindowName: 'Norman Virus Control'
- ClassName: '' WindowName: 'Spider'
- ClassName: '' WindowName: 'Solitaire'
- ClassName: '' WindowName: 'FreeCell'
- ClassName: '' WindowName: 'Hearts'
- ClassName: '' WindowName: 'The Microsoft Hearts Network'
- ClassName: '' WindowName: 'Startup'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Game'
- ClassName: '' WindowName: 'Games'
- ClassName: '' WindowName: 'Connectix Virtual Game Station'
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: 'System Configuration Utility'
- ClassName: '' WindowName: 'Microsoft Configuration Utility'
- ClassName: '' WindowName: 'System Restore'
- ClassName: '' WindowName: 'Lagu'
- ClassName: '' WindowName: 'Porno'
- ClassName: '' WindowName: 'Lagu-lagu'
- ClassName: '' WindowName: 'Sounds and Audio Devices Properties'
- ClassName: '' WindowName: 'Pictures'
- ClassName: '' WindowName: 'Sexy'
- ClassName: '' WindowName: 'Artis'
- ClassName: '' WindowName: 'Music'
- ClassName: '' WindowName: 'Musik'
- ClassName: '' WindowName: 'Musics'
