W32/Cuebot-K is a instant messaging worm and backdoor for the Windows platform.
W32/Cuebot-K spreads via AOL Instant Messenger.
W32/Cuebot-K is a instant messaging worm and backdoor for the Windows platform.
W32/Cuebot-K spreads via AOL Instant Messenger.
When first run W32/Cuebot-K copies itself to <Windows system folder>\wgavn.exe and creates the file <Windows folder>\Debug\dcpromo.log.
The file wgavn.exe is registered as a new system driver service named "wgavn", with a display name of "Windows Genuine Advantage Validation Notification" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\wgavn\
W32/Cuebot-K sets the following registry entries, disabling the automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
n
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\security center\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\domainprofile\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\standardprofile\