Troj/VbInject-R includes functionality to run automatically.
When Troj/VbInject-R copies itself to <Windows>\conmsyrtl.exe.
The following registry entries are created to run conmsyrtl.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sistema de Comm
conmsyrtl.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
Sistema de Comm
conmsyrtl.exe
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\
<Root>\sample.exe:*:Enabled:Sistema de Comm