VBS/Samok-A is a worm for the Windows platform that spreads via removable shared drives.
The following registry entries are set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCR\Folder\shell\explore
(default)
Owned!
HKCR\Folder\shell\open
(default)
b-b2g
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
autoMe
wscript.exe "<Windows>\samok.vbs\"