Script. vbs. Agent. AI Juan. vbs exclusive

Hkcu \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ showsuperhidden
Value: Type: REG_DWORD, Length: 4, data: 0
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ Hidden \

Showall \ checkedvalue
Value: Type: REG_DWORD, Length: 4, data: 0

Other aspects:

Copies are automatically copied to c: \ windows \ % username %. vbs, c: \ windows \ system32 \ % username %. vbs at intervals, and the above modifications are made to the registry;

The entire vbs file is divided into several modules, which will disrupt and re-combine these modules during infection, and the module name will also change;

If more than 2000 infected files exist, a dialog box is displayed: "You have more than 2000 files infected! But please rest assured that this virus is easily cleared! Contact 418465 ***-_-! "

Monitor the following processes: "ras.exe", "360tray.exe", "taskmgr.exe", "cmd.exe", "cmd.com", "regedit.exe", "Regedit. SCR "," Regedit. PIF "," regedit.com "," msconfig.exe "," sreng.exe "," usbantivir.exe ", which ends after discovery;

C: \ windows \ system32 \ % GetUserName %. ini contains some data, including the infection date, for future comparison.

Conclusion:

The knowledge of vbs can only be analyzed here. Other analysis is to be done by a vbs expert (a certain U;

I wonder if this is the name of virus. vbs. killav. A by Kabbah. Haha! [: 14:]