Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe'
- hidden files
- file extensions
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v item /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v inimapping /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v key /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v <Drive name for removable media>:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v C:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v hkey /f
- <SYSTEM32>\attrib.exe -s -h H:\rvhost*
- <SYSTEM32>\attrib.exe -s -h G:\rvhost*
- <SYSTEM32>\attrib.exe -s -h I:\rvhost*
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v command /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Yahoo Messengger" /f
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\ravmon*
- <SYSTEM32>\taskkill.exe /f /im ravmon*
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\Prefetch\ravmon*
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\ravmon*
- <SYSTEM32>\attrib.exe -s -h C:\ravmon*
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v J:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v F:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v E:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v G:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v I:\rvhost.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v H:\rvhost.exe /f
- <SYSTEM32>\attrib.exe -s -h H:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h G:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h C:\HistoryJMTi*
- <SYSTEM32>\attrib.exe -s -h E:\HistoryJMTi*
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\HistoryJMTi*
- <SYSTEM32>\attrib.exe -s -h F:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\autorun.inf
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\Prefetch\msagent.exe
- <SYSTEM32>\attrib.exe -s -h C:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h E:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\TOPUI*
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\rvhost.exe
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\RVHOST.exe
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\rvhost*
- <SYSTEM32>\attrib.exe -s -h F:\rvhost*
- <SYSTEM32>\attrib.exe -s -h E:\rvhost*
- <SYSTEM32>\attrib.exe -s -h C:\rvhost*
- <SYSTEM32>\attrib.exe -s -h G:\HistoryJMTi*
- <SYSTEM32>\attrib.exe -s -h F:\HistoryJMTi*
- <SYSTEM32>\attrib.exe -s -h H:\HistoryJMTi*
- <SYSTEM32>\taskkill.exe /f /im rvhost.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msagent /f
- <SYSTEM32>\attrib.exe -s -h E:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h F:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h H:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h G:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\My_Heart.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MS32DLL /f
- <SYSTEM32>\attrib.exe -s -h K:\autorun.inf
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v winboot /f
- <SYSTEM32>\taskkill.exe /f /im My_Heart.exe
- <SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Window Title" /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MS32DL /f
- <SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d <SYSTEM32>\userinit.exe, /f
- <SYSTEM32>\taskkill.exe /im explorer.exe /f
- <SYSTEM32>\notepad.exe C:\0k.txt
- %WINDIR%\explorer.exe
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\killvbs.vbs
- <SYSTEM32>\attrib.exe -s -h J:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h I:\My_Heart.exe
- <SYSTEM32>\attrib.exe -s -h K:\My_Heart.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v My_HeartMy_Heart /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v My_Heart /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v %WINDIR%\ravmone.exe /f
- <SYSTEM32>\attrib.exe -s -h K:\ravmon*
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RavAV /f
- <SYSTEM32>\attrib.exe -s -h C:\.MS32DLL.dll.vbs
- <SYSTEM32>\taskkill.exe /f /im wscript.exe
- <SYSTEM32>\attrib.exe -s -h J:\ravmon*
- <SYSTEM32>\attrib.exe -s -h F:\ravmon*
- <SYSTEM32>\attrib.exe -s -h E:\ravmon*
- <SYSTEM32>\attrib.exe -s -h G:\ravmon*
- <SYSTEM32>\attrib.exe -s -h I:\ravmon*
- <SYSTEM32>\attrib.exe -s -h H:\ravmon*
- <SYSTEM32>\attrib.exe -s -h I:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h H:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h J:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h C:\autorun.inf
- <SYSTEM32>\attrib.exe -s -h K:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h G:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\boot.ini
- <SYSTEM32>\attrib.exe -s -h <Drive name for removable media>:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h F:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h E:\.MS32DLL.dll.vbs
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\HistoryJMTi.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMyMusic /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyPictures /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuNetworkPlaces /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuNetworkPlaces /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyDocs /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyPicturess /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyDocs /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMyMusic /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogoff /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogoff /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule /v AtTaskMaxHours /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayItemsDisplay /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayItemsDisplay /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v SuperHidden /t REG_DWORD /d 1 /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 1 /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d Explorer.exe /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /f
- <SYSTEM32>\reg.exe delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v Disabletaskmgr /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {20D04FE0-3AEA-1069-A2D8-08002B30309D} /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {20D04FE0-3AEA-1069-A2D8-08002B30309D} /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideClock /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /f
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /f
- <SYSTEM32>\attrib.exe -S -H E:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H <Drive name for removable media>:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H F:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H H:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H G:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H J:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H E:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H <Drive name for removable media>:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H G:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H I:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H H:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\TOPUI.exe
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\TOPUI.exe
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\TOPUI.exe
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\HistoryJMTi.exe
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\security\Database\regedit.exe
- <SYSTEM32>\taskkill.exe /f /im mm32.dll
- <SYSTEM32>\attrib.exe -S -H J:\tokwan.exe
- <SYSTEM32>\attrib.exe -S -H I:\tokwan.exe
- <SYSTEM32>\taskkill.exe /f /im HistoryJMTi.exe
- <SYSTEM32>\taskkill.exe /f /im Proposal_FYP.exe
- <SYSTEM32>\taskkill.exe /f /im TOPUI.exe
- <SYSTEM32>\taskkill.exe /f /im haha.exe
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\jub0.exe
- <SYSTEM32>\taskkill.exe /f /im msagent.exe
- <SYSTEM32>\taskkill.exe /f /im meow.exe
- <SYSTEM32>\taskkill.exe /f /im regedit.exe
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\ssms.exe
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Tok-Cirrhatus /f
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Bron-Spizaetus /f
- <SYSTEM32>\taskkill.exe /f /im ssms.exe
- <SYSTEM32>\taskkill.exe /f /im Dato-K.exe
- <SYSTEM32>\taskkill.exe /f /im jub0.exe
- <SYSTEM32>\taskkill.exe /f /im svch0st.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ccctp /f
- <SYSTEM32>\taskkill.exe /f /im tokwan*
- <SYSTEM32>\attrib.exe -S -H F:\AUTORUN.INF
- <SYSTEM32>\attrib.exe -S -H <SYSTEM32>\svch0st.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v regedit /f
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\haha.exe
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\autorun.inf
- <SYSTEM32>\attrib.exe -s -h <SYSTEM32>\haha.exe
- <SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v haha /f
- <SYSTEM32>\attrib.exe -s -h %WINDIR%\security\Database\msagent.exe
- %WINDIR%\Explorer.EXE
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000000'
- C:\0k.txt
- %TEMP%\bt3277.bat
- %TEMP%\bt3277.bat
- %TEMP%\bt3277.bat
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'CSCHiddenWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'BaseBar' WindowName: 'ChanApp'
- ClassName: 'Shell_TrayWnd' WindowName: ''