Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'f3ndhi' = '"<SYSTEM32>\ABG.exe"'
Creates the following files on removable media:
- <Drive name for removable media>:\gadis_ancol.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\gadis_bali.exe
- <Drive name for removable media>:\smu_orgasme.exe
- <Drive name for removable media>:\pemerkosaan.exe
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window Title' = '----Universitas Lampung Fakultas Matematika & Ilmu Pengetahuan----'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %WINDIR%\system\rena_orgasme.exe
- %WINDIR%\system\rena_orgasme_1.exe
- %WINDIR%\Fonts\perkosa_rame2.exe
- %WINDIR%\system\rena_virgin.exe
- C:\gadis_bali.exe
- C:\gadis_ancol.exe
- C:\smu_orgasme.exe
- C:\pemerkosaan.exe
- <SYSTEM32>\mahasiswi_virgin.exe
- <SYSTEM32>\Gadis_cina_di_perkosa_dalam_toko.exe
- C:\autorun.inf
- <SYSTEM32>\ABG.exe
- %WINDIR%\Fonts\smu_negeri_1_hot.exe
- %WINDIR%\Fonts\anak_smk_utama.exe
- <SYSTEM32>\Smu_bandung_full.exe
- <SYSTEM32>\MAkkasar_darah_perawan.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\smu_orgasme.exe
- C:\autorun.inf
- C:\smu_orgasme.exe
