Symptoms

Removal instructions:

Analyzed By

Technical Description:

• deletes all files recursively from \My documents\
• process all directories under the current root (\) and creates one copy of the virus under \windows with a random name ([random-number].exe)
• creates a shortcut under \Windows\Startup for the new exe to ensure automatic execution of the virus on next reboot.
  

• creates a new copy of the virus under \windows with a random name ([random-nr].exe)
• creates an entry under SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ to ensure automatic execution of the virus on next reboot
• opens a RAPI (Remote API) connection and waits until a mobile device is available
• moves a copy of the virus to the mobile device under \Windows\[random-nr].exe
• executes the new example of the virus under the mobile device