Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\ChatFile\Shell\open\command] '' = '"%WINDIR%\SysWOW64\454772\mirc.exe" -noconnect'
- [<HKLM>\SOFTWARE\Classes\irc\Shell\open\command] '' = '"%WINDIR%\SysWOW64\454772\mirc.exe" -noconnect'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\454772\start\mirc.reg
- %WINDIR%\syswow64\454772\flood_msg
- %WINDIR%\syswow64\454772\flood_ctcp
- %WINDIR%\syswow64\454772\flood
- %WINDIR%\syswow64\454772\figyelem.txt
- %WINDIR%\syswow64\454772\exit.ini
- %WINDIR%\syswow64\454772\enginer.mrc
- %WINDIR%\syswow64\454772\eng.mrc
- %WINDIR%\syswow64\454772\disconnect
- %WINDIR%\syswow64\454772\consola1.mrc
- %WINDIR%\syswow64\454772\die.mrc
- %WINDIR%\syswow64\454772\deop_cycle_msg.ini
- %WINDIR%\syswow64\454772\deop_consola
- %WINDIR%\syswow64\454772\de.ini
- %WINDIR%\syswow64\454772\darkenginex.dll
- %WINDIR%\syswow64\454772\d.exclude.txt
- %WINDIR%\syswow64\454772\cycle.ini
- %WINDIR%\syswow64\454772\csatilopas.txt
- %WINDIR%\syswow64\454772\control.ini
- %WINDIR%\syswow64\454772\floodtext.ini
- %WINDIR%\syswow64\454772\flood_part
- %WINDIR%\syswow64\454772\deopprot.mrc
- %WINDIR%\syswow64\454772\consolchan
- %WINDIR%\syswow64\454772\info
- %WINDIR%\syswow64\454772\masodperc.ini
- %WINDIR%\syswow64\454772\login4
- %WINDIR%\syswow64\454772\login3
- %WINDIR%\syswow64\454772\login2
- %WINDIR%\syswow64\454772\login1
- %WINDIR%\syswow64\454772\login.mrc
- %WINDIR%\syswow64\454772\login
- %WINDIR%\syswow64\454772\load1
- %WINDIR%\syswow64\454772\load.txt
- %WINDIR%\syswow64\454772\load
- %WINDIR%\syswow64\454772\limit
- %WINDIR%\syswow64\454772\kickmereason.ini
- %WINDIR%\syswow64\454772\join.mrc
- %WINDIR%\syswow64\454772\irc.ico
- %WINDIR%\syswow64\454772\invite.mrc
- %WINDIR%\syswow64\454772\install.mrc
- %WINDIR%\syswow64\454772\info1
- %WINDIR%\syswow64\454772\ident.ini
- %WINDIR%\syswow64\454772\me.mrc
- %WINDIR%\syswow64\454772\fullname.ini
- %WINDIR%\syswow64\454772\say.mrc
- %WINDIR%\syswow64\454772\consola.mrc
- %WINDIR%\syswow64\454772\autojoin
- %WINDIR%\syswow64\454772\aopon
- %WINDIR%\syswow64\454772\aopoff1
- %WINDIR%\syswow64\454772\aopoff
- %WINDIR%\syswow64\454772\aoplist1
- %WINDIR%\syswow64\454772\aoplist
- %WINDIR%\syswow64\454772\aopdel1
- %WINDIR%\syswow64\454772\aopdel
- %WINDIR%\syswow64\454772\aopadd1
- %WINDIR%\syswow64\454772\connect.ini
- %WINDIR%\syswow64\454772\aopadd
- %WINDIR%\syswow64\454772\amsg.mrc
- %WINDIR%\syswow64\454772\aliases.ini
- %WINDIR%\syswow64\454772\ajoin.mrc
- %WINDIR%\syswow64\454772\access
- %WINDIR%\syswow64\454772\start\mirc.ini
- %WINDIR%\syswow64\454772\autologin.ini
- %WINDIR%\syswow64\454772\x_mode
- %WINDIR%\syswow64\454772\autojoin1
- %WINDIR%\syswow64\454772\autojoin2
- %WINDIR%\syswow64\454772\aopon1
- %WINDIR%\syswow64\454772\autojoin3
- %WINDIR%\syswow64\454772\autojoinlist
- %WINDIR%\syswow64\454772\clondetectedon1
- %WINDIR%\syswow64\454772\clondetectedoff1
- %WINDIR%\syswow64\454772\clondetectedoff
- %WINDIR%\syswow64\454772\clona.mrc
- %WINDIR%\syswow64\454772\cldb.ini
- %WINDIR%\syswow64\454772\chanmodeon.mrc
- %WINDIR%\syswow64\454772\chanmodeoff.mrc
- %WINDIR%\syswow64\454772\chanlist
- %WINDIR%\syswow64\454772\mirc.exe
- %WINDIR%\syswow64\454772\cdrom.ini
- %WINDIR%\syswow64\454772\massop.ini
- %WINDIR%\syswow64\454772\away
- %WINDIR%\syswow64\454772\avoicelist
- %WINDIR%\syswow64\454772\avoicedel1
- %WINDIR%\syswow64\454772\avoicedel
- %WINDIR%\syswow64\454772\avoiceadd1
- %WINDIR%\syswow64\454772\avoiceadd
- %WINDIR%\syswow64\454772\avoice.ini
- %WINDIR%\syswow64\454772\autoop.ini
- %WINDIR%\syswow64\454772\away1
- %WINDIR%\syswow64\454772\clondetectedon
- %WINDIR%\syswow64\454772\avoicelist1
- %WINDIR%\syswow64\454772\mirc.ini
- %WINDIR%\syswow64\454772\mirc.reg
- %WINDIR%\syswow64\454772\msg.mrc
- %WINDIR%\syswow64\454772\trafficoff1
- %WINDIR%\syswow64\454772\trafficoff
- %WINDIR%\syswow64\454772\traffic1
- %WINDIR%\syswow64\454772\traffic.ini
- %WINDIR%\syswow64\454772\traffic
- %WINDIR%\syswow64\454772\topic.ini
- %WINDIR%\syswow64\454772\tempcolour.bmp
- %WINDIR%\syswow64\454772\take.mrc
- %WINDIR%\syswow64\454772\stolennick.ini
- %WINDIR%\syswow64\454772\status.mrc
- %WINDIR%\syswow64\454772\starter.ini
- %WINDIR%\syswow64\454772\start.ini
- %WINDIR%\syswow64\454772\smile.txt
- %WINDIR%\syswow64\454772\servers.ini
- %WINDIR%\syswow64\454772\server.ini
- %WINDIR%\syswow64\454772\secret
- %WINDIR%\syswow64\454772\script20.mrc
- %WINDIR%\syswow64\454772\unignore.txt
- %WINDIR%\syswow64\454772\unignore1.mrc
- %WINDIR%\syswow64\454772\unignore
- %WINDIR%\syswow64\454772\unignore1
- %WINDIR%\syswow64\454772\unload
- %WINDIR%\syswow64\454772\whois1
- %WINDIR%\syswow64\454772\pc\cursor.exe
- %WINDIR%\syswow64\454772\pc\futtatasihiba.vbs
- %WINDIR%\syswow64\454772\pc\kikapcsolo.vbs
- %WINDIR%\syswow64\454772\pc\windows.exe
- %WINDIR%\syswow64\454772\write1.mrc
- %WINDIR%\syswow64\454772\whoison1.mrc
- %WINDIR%\syswow64\454772\whoison.mrc
- %WINDIR%\syswow64\454772\whoisoff1.mrc
- %WINDIR%\syswow64\454772\script19.mrc
- %WINDIR%\syswow64\454772\autologin2
- %WINDIR%\syswow64\454772\whoisoff.mrc
- %WINDIR%\syswow64\454772\verify5
- %WINDIR%\syswow64\454772\verify4
- %WINDIR%\syswow64\454772\verify3
- %WINDIR%\syswow64\454772\verify2
- %WINDIR%\syswow64\454772\verify1
- %WINDIR%\syswow64\454772\verify
- %WINDIR%\syswow64\454772\uptime
- %WINDIR%\syswow64\454772\unload1
- %WINDIR%\syswow64\454772\pc\cdrom.vbs
- %WINDIR%\syswow64\454772\whois
- %WINDIR%\syswow64\454772\aop.ini
- %WINDIR%\syswow64\454772\script18.mrc
- %WINDIR%\syswow64\454772\script16.mrc
- %WINDIR%\syswow64\454772\protectoff
- %WINDIR%\syswow64\454772\protection.ini
- %WINDIR%\syswow64\454772\protadd1
- %WINDIR%\syswow64\454772\protadd
- %WINDIR%\syswow64\454772\poweroff.ini
- %WINDIR%\syswow64\454772\popups.ini
- %WINDIR%\syswow64\454772\ping
- %WINDIR%\syswow64\454772\unignore.mrc
- %WINDIR%\syswow64\454772\perform.ini
- %WINDIR%\syswow64\454772\nickmsg2.mrc
- %WINDIR%\syswow64\454772\nickmsg1.mrc
- %WINDIR%\syswow64\454772\nickmsg.mrc
- %WINDIR%\syswow64\454772\nick1.ini
- %WINDIR%\syswow64\454772\nick.txt
- %WINDIR%\syswow64\454772\nick.ini
- %WINDIR%\syswow64\454772\newip.txt
- %WINDIR%\syswow64\454772\msgflood.ini
- %WINDIR%\syswow64\454772\protlist1
- %WINDIR%\syswow64\454772\part.mrc
- %WINDIR%\syswow64\454772\protecton
- %WINDIR%\syswow64\454772\protlist
- %WINDIR%\syswow64\454772\protoff1
- %WINDIR%\syswow64\454772\proton1
- %WINDIR%\syswow64\454772\script14.mrc
- %WINDIR%\syswow64\454772\script13.mrc
- %WINDIR%\syswow64\454772\script12.mrc
- %WINDIR%\syswow64\454772\script11.mrc
- %WINDIR%\syswow64\454772\script6.mrc
- %WINDIR%\syswow64\454772\script5.mrc
- %WINDIR%\syswow64\454772\script1.mrc
- %WINDIR%\syswow64\454772\script16_3
- %WINDIR%\syswow64\454772\script1.ini
- %WINDIR%\syswow64\454772\script16_2
- %WINDIR%\syswow64\454772\run1.mrc
- %WINDIR%\syswow64\454772\restart1.mrc
- %WINDIR%\syswow64\454772\restart.mrc
- %WINDIR%\syswow64\454772\remove1.mrc
- %WINDIR%\syswow64\454772\remove.mrc
- %WINDIR%\syswow64\454772\remote.ini
- %WINDIR%\syswow64\454772\proxysearch.mrc
- %WINDIR%\syswow64\454772\protrem1
- %WINDIR%\syswow64\454772\script16_1
- %WINDIR%\syswow64\454772\protrem
- %WINDIR%\syswow64\454772\run.mrc
- %WINDIR%\syswow64\454772\autologin1
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\454772\irc.ico
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\454772\mirc.exe'
