W32/Winur.C

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
"windir" = C:\windows\winrun.exe
"sysdir" = C:\winnt\winrun.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
"winrun" = C:\windows\winrun.exe
"winur" = C:\winnt\winrun.exe

Virus checks if “Winnt” folder exists, if so, it copies “winrun.exe” to that folder

If the path folders exist, the virus will attempt to copy itself to any of the following locations –
C:\winnt\profiles\user default\programma's\opstarten\winrun.exe
C:\winnt\profiles\user default\start menu\programma's\opstarten\winrun.exe
C:\winnt\profiles\all users\programma's\opstarten\winrun.exe
C:\winnt\profiles\all users\programs\startup\winrun.exe
C:\winnt\profiles\all users\start menu\programma's\opstarten\winrun.exe

Virus will write itself to the hard drive in several files

c:\Program Files\Kazaa\.exe
c:\WINDOWS\winrun.exe
c:\sharedDocs\.exe
c:\sharedDocs\Adult movie.exe
c:\sharedDocs\adult(hardcore sex movie xxx)movie.exe
c:\sharedDocs\Age of Empires 2 crack.exe
c:\sharedDocs\Age of mythology crack noCD.exe
c:\sharedDocs\Age of mythology crack.exe
c:\sharedDocs\All Microsoft product license cracker! ( windows me, windows XP, windows 2000, etc.exe
c:\sharedDocs\American Conquest Crack nocd.exe
c:\sharedDocs\American Conquest Crack.exe
c:\sharedDocs\anal sex nude bitch whore 43.exe
c:\sharedDocs\Anno 1503 crack nocd.exe
c:\sharedDocs\Anno 1503 crack.exe
c:\sharedDocs\Anonymous email.exe
c:\sharedDocs\Anstoss 4 crack.exe
c:\sharedDocs\AOL Hacker password hacker.exe
c:\sharedDocs\Bathroom sex.exe
c:\sharedDocs\Beach Life Crack.exe
c:\sharedDocs\Billy Crwaford movie.exe
c:\sharedDocs\Britney Spears anal movie.exe
c:\sharedDocs\Britney Spears Blowjob movie.exe
c:\sharedDocs\Britney Spears hardcore xx movie.exe
c:\sharedDocs\Britney Spears in bath (movie).exe
c:\sharedDocs\Britney Spears naked.exe
c:\sharedDocs\Britney Spears Nipple slip.exe
c:\sharedDocs\Bumfight (movie).exe
c:\sharedDocs\Bush vs Saddam (funny flash movie).exe
c:\sharedDocs\Cable cracker.exe
c:\sharedDocs\Car Tycoon crack.exe
c:\sharedDocs\Catch me if you can (DVD).exe
c:\sharedDocs\Chasey Lane adult porn movie (mov) 18+.exe
c:\sharedDocs\Christina Aguilera adult movie.exe
c:\sharedDocs\Christina Aguilera having sex(mov).exe
c:\sharedDocs\Christina Aguilera movie.exe
c:\sharedDocs\Christina Aguilera sucks cock.exe
c:\sharedDocs\CKY 1.exe
c:\sharedDocs\CKY 2.exe
c:\sharedDocs\CKY 3.exe
c:\sharedDocs\CKY 4.exe
c:\sharedDocs\Combat mission 2 crack.exe
c:\sharedDocs\Conflict desert storm crack.exe
c:\sharedDocs\Cossacks - Back to war- crack.exe
c:\sharedDocs\Davideo 2 crack.exe
c:\sharedDocs\Doom (first shoot em up game).exe
c:\sharedDocs\dr. Dre flash (movie).exe
c:\sharedDocs\Dragonball Z game.exe
c:\sharedDocs\Driver 2 crack.exe
c:\sharedDocs\Driver crack.exe
c:\sharedDocs\Dungeon crack nocd.exe
c:\sharedDocs\Emailbomber.exe
c:\sharedDocs\Emergency 2 crack noCD.exe
c:\sharedDocs\Emergency 2 crack.exe
c:\sharedDocs\Emergency crack noCD.exe
c:\sharedDocs\Emergency crack.exe
c:\sharedDocs\Eminem - 8 mile (mpeg).exe
c:\sharedDocs\Eminem flash game.exe
c:\sharedDocs\Empire Earth crack.exe
c:\sharedDocs\Encarta 2003 crack.exe
c:\sharedDocs\Encarta 2004 crack.exe
c:\sharedDocs\Esafe crack nocd.exe
c:\sharedDocs\Esafe desktiop Protection crack.exe
c:\sharedDocs\Free SMS v1.0.exe
c:\sharedDocs\Frontline Attack -War over Europe - Crack.exe
c:\sharedDocs\Girl having sex 001.exe
c:\sharedDocs\Girl having sex nude anal.exe
c:\sharedDocs\GTA 2 crack noCD.exe
c:\sharedDocs\GTA 2 crack.exe
c:\sharedDocs\GTA 3 crack noCD.exe
c:\sharedDocs\GTA 3 crack.exe
c:\sharedDocs\GTA Vice City crack noCD.exe
c:\sharedDocs\GTA Vice City crack.exe
c:\sharedDocs\Hack hotmail.exe
c:\sharedDocs\Hardcore adult xxx asian fuck(movie).exe
c:\sharedDocs\Hardcore SM spanking movie 001.exe
c:\sharedDocs\Hardcore xxx secret.exe
c:\sharedDocs\Hardest pornmovie ever.exe
c:\sharedDocs\Hardest sex ever.exe
c:\sharedDocs\Harry Potter 1 crack noCD.exe
c:\sharedDocs\Harry Potter 1 crack.exe
c:\sharedDocs\Harry Potter 2 crack noCD.exe
c:\sharedDocs\Harry Potter 2 crack.exe
c:\sharedDocs\Highland Warriors crack nocd.exe
c:\sharedDocs\Highland Warriors crack.exe
c:\sharedDocs\Hitman 2 crack nocd.exe
c:\sharedDocs\Hitman 2 crack.exe
c:\sharedDocs\Hitman crack nocd.exe
c:\sharedDocs\Hitman crack.exe
c:\sharedDocs\Home Alone 1.exe
c:\sharedDocs\Home Alone 2.exe
c:\sharedDocs\Home Alone 3.exe
c:\sharedDocs\hotmail hacker.exe
c:\sharedDocs\ICQ hacker password hacker.exe
c:\sharedDocs\Idols filmp dvd.exe
c:\sharedDocs\Idols finale game.exe
c:\sharedDocs\Idols voorrondes dvd.exe
c:\sharedDocs\Install_AIM.exe
c:\sharedDocs\Jackass - never shown part.exe
c:\sharedDocs\Jackass - Steve O crocodile.exe
c:\sharedDocs\Jackass - The movie(mpeg).exe
c:\sharedDocs\Jackass game (be jackass!!).exe
c:\sharedDocs\Jim (Idols).exe
c:\sharedDocs\Kate Winslet adult movie.exe
c:\sharedDocs\Katja Schuurman having sex.exe
c:\sharedDocs\Katja Schuurman nude movie.exe
c:\sharedDocs\Katja Schuurman nude.exe
c:\sharedDocs\Keylogger v1.0.exe
c:\sharedDocs\Leonardo di Caprio.exe
c:\sharedDocs\Live Update crack.exe
c:\sharedDocs\LiveUpdate crack(4 ever!).exe
c:\sharedDocs\LiveUpdate crack.exe
c:\sharedDocs\Lord Of the ring - The Two Towers - crack.exe
c:\sharedDocs\
Lord of the Rings - The Fellowship of the ring- crack.exe
c:\sharedDocs\Lord of the Rings - TTT - crack.exe
c:\sharedDocs\Lord of the rings crack noCD.exe
c:\sharedDocs\Lord of the rings game.exe
c:\sharedDocs\Mafia crack.exe
c:\sharedDocs\magix crack.exe
c:\sharedDocs\magix music maker crack noCD.exe
c:\sharedDocs\Magix music maker 7 crack noCD.exe
c:\sharedDocs\Magix music maker 8 crack noCD.exe
c:\sharedDocs\mature housewife getting fucked 043.exe
c:\sharedDocs\Max Payne crack.exe
c:\sharedDocs\Mcafee antivirus 2003 crack.exe
c:\sharedDocs\Medieval - Total War - Crack noCD.exe
c:\sharedDocs\Medieval - Total War - Crack.exe
c:\sharedDocs\Microangelo crack.exe
c:\sharedDocs\
Microsoft office XP, Me, 2000, 98, 95 license crack.exe
c:\sharedDocs\Might and Magic 1 crack.exe
c:\sharedDocs\Might and Magic 2 crack.exe
c:\sharedDocs\Might and Magic 3 crack.exe
c:\sharedDocs\Might and Magic 4 crack.exe
c:\sharedDocs\Might and Magic 5 crack.exe
c:\sharedDocs\Might and Magic 6 crack.exe
c:\sharedDocs\Might and Magic 7 crack.exe
c:\sharedDocs\Might and Magic 8 crack.exe
c:\sharedDocs\Might and Magic 9 crack.exe
c:\sharedDocs\Migl.exe
c:\sharedDocs\mirc603.exe
c:\sharedDocs\MS Zoo tycoon crack.exe
c:\sharedDocs\MSN banner remover.exe
c:\sharedDocs\MSN hacker.exe
c:\sharedDocs\MSN Messenger PLUS !.exe
c:\sharedDocs\
my son and his girlfriend having hot xxx sex 40.exe
c:\sharedDocs\Neocron crack.exe
c:\sharedDocs\netstatp.exe
c:\sharedDocs\Nikki Cox nude.exe
c:\sharedDocs\Nikki cox Playboy session.exe
c:\sharedDocs\Nikki Cox sex movie.exe
c:\sharedDocs\Norton Antivirus 2003 crack.exe
c:\sharedDocs\Norton antivirus crack nocd.exe
c:\sharedDocs\Nude poser (sex cock).exe
c:\sharedDocs\Office XP crack.exe
c:\sharedDocs\Office Xp keygen.exe
c:\sharedDocs\Old Excel Documents.exe
c:\sharedDocs\Pamela Anderson adult movie.exe
c:\sharedDocs\
Pamela Anderson and Tommy Lee hardcore holiday movie.exe
c:\sharedDocs\Pamela Anderson deepthroat.exe
c:\sharedDocs\Pamela Anderson gets fucked.exe
c:\sharedDocs\Password stealer.exe
c:\sharedDocs\Pokemon flash game.exe
c:\sharedDocs\Red alert (all versions!) crack.exe
c:\sharedDocs\Red alert 2 crack.exe
c:\sharedDocs\Red Alert crack.exe
c:\sharedDocs\Robin Hood crack.exe
c:\sharedDocs\Robin Hood -Legend of Sherwood- crack noCD.exe
c:\sharedDocs\Robin Hood -Legend of Sherwood- crack.exe
c:\sharedDocs\Rollercoaster Tycoon 1 crack.exe
c:\sharedDocs\Rollercoaster Tycoon 2 crack.exe
c:\sharedDocs\RTTCW crack(noCD).exe
c:\sharedDocs\secret.exe
c:\sharedDocs\See her pussy.exe
c:\sharedDocs\Sex movie hardcore.exe
c:\sharedDocs\sex movie(mov).exe
c:\sharedDocs\Sim city 2 crack.exe
c:\sharedDocs\Sim city 3 crack.exe
c:\sharedDocs\Sim city 4 crack.exe
c:\sharedDocs\SMS 4 free.exe
c:\sharedDocs\South park 004.exe
c:\sharedDocs\South park 046.exe
c:\sharedDocs\South Park flash game.exe
c:\sharedDocs\Splinter Cell crack nocd.exe
c:\sharedDocs\Splinter Cell crack.exe
c:\sharedDocs\Splinter Cell demo.exe
c:\sharedDocs\Stronghold Crusader Crack noCD.exe
c:\sharedDocs\Stronghold Crusader Crack.exe
c:\sharedDocs\Stuart Little 2 Crack.exe
c:\sharedDocs\SubSeven.exe
c:\sharedDocs\systemfiles.exe
c:\sharedDocs\Tatjana undressing.exe
c:\sharedDocs\tcpview.exe
c:\sharedDocs\tdimon98.exe
c:\sharedDocs\The elder Scrolls - Morrowind- crack.exe
c:\sharedDocs\The first emperor crack.exe
c:\sharedDocs\The Partners crack.exe
c:\sharedDocs\The Simpsons.exe
c:\sharedDocs\The Sims crack (all versions!).exe
c:\sharedDocs\The thing crack.exe
c:\sharedDocs\the_bat.exe
c:\sharedDocs\Theme park crack.exe
c:\sharedDocs\Theme park world crack.exe
c:\sharedDocs\This is football crack.exe
c:\sharedDocs\TMF Tooske sexy nude.exe
c:\sharedDocs\Tomb Raider 1 2 3 4 5 crack.exe
c:\sharedDocs\Tomb Raider 3 crack.exe
c:\sharedDocs\Unreal Tournament 2003 crack noCD.exe
c:\sharedDocs\Unreal Tournament 2003 crack.exe
c:\sharedDocs\Unreal Tournament crack.exe
c:\sharedDocs\UT 2003 crack.exe
c:\sharedDocs\Virus kit.exe
c:\sharedDocs\Virus maker.exe
c:\sharedDocs\Virusscanner.exe
c:\sharedDocs\Voyeur movie.exe
c:\sharedDocs\Warcraft 3 crack.exe
c:\sharedDocs\Website defacer ( deface websites !).exe
c:\sharedDocs\Winamp.exe
c:\sharedDocs\Windows 98 crack.exe
c:\sharedDocs\Windows 98 keygen.exe
c:\sharedDocs\Windows ME crack.exe
c:\sharedDocs\Windows ME keygen.exe
c:\sharedDocs\Windows NT crack.exe
c:\sharedDocs\Windows NT keygen.exe
c:\sharedDocs\Windows XP crack.exe
c:\sharedDocs\Windows XP keygen.exe
c:\sharedDocs\WINRUN.exe
c:\sharedDocs\Wolfenstein Return to the castle crack.exe
c:\sharedDocs\World War 3 crack.exe
c:\sharedDocs\zaSetup_1025.exe
c:\sharedDocs\zaSetup_37_143.exe

Virus contains the string “Winur is back” in its code