When Edelin_ is executed, it performs the following actions:


1. Copies itself as the following files:

* C:\tmp\Isass.exe
* X:\Edelin_X.exe

Note:

* X:\ is your removable drive
* Edelin_X.exe that created is hidden from the user.



2. Creates the following file:

* X:\Autorun.inf

so that Edelin_X.exe can runs every time a removable drive is plug-in.

Characteristic of Autorun.inf :

[AutoRun]
open=Edelin_X.exe
shellexecute=Edelin_X.exe
shell\Auto\command=Edelin_X.exe
shell=Auto

3. Creates the following file as a marker of infection:

* X:\Surat Untuk Edelin.txt.

Note:

* X:\ is your removable drive

Characteristic of Surat Untuk Edelin.txt:

Dearest Edelin bt. Baharum

*** ***
* * * *
* * *
* *
* *
* *
* *
* *
* *
*

From:
ur_edmirer@yahoo.com

011001010110010001100101011011000110100101101110
011010010110110001101001011010110110010101110101


4. Disable the following process:

* tskmgr.exe
* regedit.exe
* cmd.exe

5. Adds the value:

"EDxMC110" = "C:\tmp\Isass.exe"
to the registry subkey:
HKEY_CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Run
so that it can runs every time Windows starts.
6. Adds the value:

"ShowSuperHidden" = "0"
to the registry subkey:
HKEY_CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
in attempt to hide itself from the user.
7. Adds the value:

"NoFolderOptions" = "1"
to the registry subkey:
HKEY_CURRENT USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
to disable Folder Options from Tools menu and from the Control Panel.