Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe <SYSTEM32>\com1\wmipris.exe'
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'hruser.exe - ????????????'
- ClassName: '(null)' WindowName: '????????????????????????????: hruser.exe - ????????????'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'hruser.exe'
- ClassName: '(null)' WindowName: 'Microsoft Visual C++ Debug Library'
- ClassName: '(null)' WindowName: 'Microsoft Visual C++ Runtime Library'
