CRC32: 519CA5C7
MD5: E429D7B1E43860A5D311E9141F37AD2D
SHA-1: 2FD71465964DE6066871A45B9E90A7569C3F7747
===================================================
MD5: E429D7B1E43860A5D311E9141F37AD2D
SHA-1: 2FD71465964DE6066871A45B9E90A7569C3F7747
===================================================
- create folder C:\WINDOWS\uninstall\
- Creates c:\windows\uninstall\rundl132.exe
- Creates c:\windows\Logo1_.exe
- Deletes c:\docume~1\user\locals~1\temp\$$aA.bat
- Creates c:\docume~1\user\locals~1\temp\$$aA.bat
- Creates c:\windows\RichDll.dll
- Creates c:\_desktop.ini
- Deletes c:\PREVXEDGEFREE.EXE
- Creates c:\PREVXEDGEFREE.EXE
- Deletes c:\windows\system32\drivers\cdaudio.sys
- Copies file4�_CHAR(0x03)_ \dllcache\cdaudio.sys to c:\windows\system32\drivers\cdaudio.sys
- Deletes c:\docume~1\user\locals~1\temp\herss.exe
- Deletes c:\docume~1\user\locals~1\temp\cvasds0.dll
- Creates c:\docume~1\user\locals~1\temp\cvasds0.dll
- Deletes c:\lcw.ex
- Copies filec:\docume~1\user\locals~1\temp\herss.exe to c:\lcw.ex
- Deletes c:\autorun.in
- Creates c:\autorun.in
- Deletes d:\lcw.ex
- Copies filec:\docume~1\user\locals~1\temp\herss.exe to d:\lcw.ex
- Deletes d:\autorun.in
- Creates d:\autorun.in
- Deletes c:\docume~1\user\locals~1\temp\am1.rar
- Opens/modifes c:\autoexec.bat
- Creates c:\docume~1\user\locals~1\temp\am1.rar
- Deletes c:\docume~1\user\locals~1\temp\am.exe
- Creates c:\docume~1\user\locals~1\temp\am.exe
- Copies filec:\docume~1\user\locals~1\temp\am.exe to c:\docume~1\user\locals~1\temp\herss.exe
- Deletes c:\docume~1\user\locals~1\temp\cvasds1.dll
- Creates c:\docume~1\user\locals~1\temp\cvasds1.dll