ThreatExpert Report: Mal/Generic-A, BAT.Trojan.FormatCQ

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 23 August 2009, 10:09:20
Processing time: 7 min 28 sec
Submitted sample:

File MD5: 0x3BC9E3894B7D6ACA2D504DFB4638D427
File SHA-1: 0x1E2A5D0DB7CA05D75A7A015C82C44C078118E2D4
Filesize: 40,960 bytes
Alias & packer info:

Mal/Generic-A [Sophos]
BAT.Trojan.FormatCQ [Ikarus]
packed with: PE_Patch.UPX [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\SABOTAGE.TXT	164 bytes	MD5: 0xC8FCBF0AB5F507A98E39CA7A655C091C SHA-1: 0x347AAC1A1E0F0DD29DFF16B0D639803D266D5F4D	(not available)
2	%Windir%\prototype.log	7 bytes	MD5: 0x57C2FA750F30911B3A92AEDBC54365A2 SHA-1: 0x1222958204DBCA4E27D5AFA9D4D7EA5337E5C6CA	(not available)
3	%Windir%\ssms.exe [file and pathname of the sample #1] %System%\update.sfx	40,960 bytes	MD5: 0x3BC9E3894B7D6ACA2D504DFB4638D427 SHA-1: 0x1E2A5D0DB7CA05D75A7A015C82C44C078118E2D4	Mal/Generic-A [Sophos] BAT.Trojan.FormatCQ [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]
4	%System%\msvbvm60.5737	1,386,496 bytes	MD5: 0xF28EB5CBC3CA6D8C787F09F047D1F9C8 SHA-1: 0x70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5	(not available)
5	%System%\sethc.bak	31,232 bytes	MD5: 0x4DB5C6C8A76EEA7C0461D5C4EE41B4AB SHA-1: 0x815043DAA4085D089B0AAE09676FC1F9CF4AC5C9	(not available)

Notes:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following files were deleted:

%System%\msvbvm60.dll
%System%\sethc.exe

The following file was modified:

%System%\drivers\etc\hosts

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
ssms.exe	%Windir%\ssms.exe	106,496 bytes
update.sfx	%System%\update.sfx	106,496 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	106,496 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\Scan for virus
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\Scan for virus\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\*
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\*\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\*\shell\Scan for virus
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\*\shell\Scan for virus\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\merge
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\merge\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Classes\exefile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Classes\sfxfile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sfx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sfxfile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\123.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\123456.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\654321.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aav.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav-beta-setup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavgd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antv-md5-pattern.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccleaner.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ChangeThisName.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FixRegistry.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killbox.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\morphost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qwerty.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regalyzer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RTPSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smadav.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TheKillerMachine.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tkm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tkm4.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UltimateWasher.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uw2rc2.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\X-RayPC.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\CONTROL
HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\CONTROL\SAFEBOOT
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKEY_CURRENT_USER\Software\Policies\Microsoft\WINDOWS
HKEY_CURRENT_USER\Software\Policies\Microsoft\WINDOWS\SYSTEM

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command]

(Default) = "logoff.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\Scan for virus\command]

(Default) = "%System%\Sab0tagE.scr"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\*\shell\Scan for virus\command]

(Default) = "%System%\Sab0tagE.scr"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command]

(Default) = "logoff.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\merge\command]

(Default) = "logoff.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Classes\sfxfile]

NeverShowExt = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Classes\exefile]

NeverShowExt = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sfx]

(Default) = "exefile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sfxfile]

(Default) = "Microsoft Update Manager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

AntiVirusDisableNotify = 0x00000001
AntiVirusOverride = 0x00000001
FirewallDisableNotify = 0x00000001
FirewallOverride = 0x00000001
UacDisableNotify = 0x00000001
UpdatesDisableNotify = 0x00000001

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]

EnableLUA = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

WinSystem = "%Windir%\ssms.exe"

so that ssms.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\123.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\123456.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\654321.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aav.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav-beta-setup.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav32.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavd.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavgd.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antv-md5-pattern.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antv.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccleaner.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ChangeThisName.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FixRegistry.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killbox.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\morphost.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qwerty.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regalyzer.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RTPSvc.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smadav.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smp.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TheKillerMachine.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tkm.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tkm4.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UltimateWasher.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uw2rc2.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe]

Debugger = "rundll32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\X-RayPC.exe]

Debugger = "cmd.exe /c del /f /q"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend]

Start = 0x00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]

Start = 0x00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET003\CONTROL\SAFEBOOT]

ALTERNATESHELL = "%System%\Sab0tagE.scr"

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]

AutoEndTasks = 0x00000001

[HKEY_CURRENT_USER\Control Panel\Desktop]

ScreenSaveActive = 0x00000001
SCRNSAVE.EXE = "%System%\Sab0tagE.scr"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

NOFind = 0x00000001
NoFolderOptions = 0x00000001
NoDrives = 0x00000010

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]

1 = "WhatEver_1.exe"
2 = "WhatEver_2.exe"
3 = "WhatEver_3.exe"
4 = "WhatEver_4.exe"
5 = "WhatEver_5.exe"
6 = "WhatEver_6.exe"
7 = "WhatEver_7.exe"
8 = "WhatEver_8.exe"
9 = "WhatEver_9.exe"
10 = "WhatEver_10.exe"
11 = "WhatEver_11.exe"
12 = "WhatEver_12.exe"
13 = "WhatEver_13.exe"
14 = "WhatEver_14.exe"
15 = "WhatEver_15.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Microsoft Update Manager = "%System%\update.sfx"

so that update.sfx runs every time Windows starts

[HKEY_CURRENT_USER\Software\Policies\Microsoft\WINDOWS\SYSTEM]

DisableCMD = 0x00000002

to disable command prompt Cmd.exe, and batch files (.cmd and .bat)

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command]

(Default) = "%System%\NOTEPAD.EXE %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command]

(Default) = "%System%\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1"

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]

AutoEndTasks = "0"

[HKEY_CURRENT_USER\Control Panel\Desktop]

ScreenSaveActive = "0"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

(Default) =

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot]

AlternateShell =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Update]

UpdateMode =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot]

AlternateShell =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]

AlternateShell =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Update]

UpdateMode =

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]

ScreenSaveTimeOut =

Other details

The HOSTS file was updated with the following URL-to-IP mappings:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.