Technical Information
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'btdbighijtdscpj' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\bardlsaegk.DLL"'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'btdbighijtdscpj' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\bardlsaegk.dll"'
- %TEMP%\nsy516b.tmp
- %TEMP%\nsi51aa.tmp\system.dll
- %TEMP%\bardlsaegk.dll
- %WINDIR%\syswow64\xlpmnxsyfiw.exe
- %TEMP%\nsi51aa.tmp\system.dll
- from %TEMP%\bardlsaegk.dll to %WINDIR%\syswow64\bardlsaegk.dll
- DNS ASK ad#.#goads.biz
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\bardlsaegk.dll"