W32/Alcra-F is a worm for the windows platform.
W32/Alcra-F uses file sharing applications to spread.
W32/Alcra-F typically arrives with the filename Setup.exe.
W32/Alcra-F is a worm for the windows platform.
W32/Alcra-F uses file sharing applications to spread.
W32/Alcra-F typically arrives with the filename Setup.exe.
When first run W32/Alcra-F displays a dialog box with the text "Setup", "Welcome to the Setup Wizard ...".
The dialog then gives a fake error message, before closing.
W32/Alcra-F creates the folder <Program Files>\winsupdater and copies itself to this folder as
a.temp
winsupdater.exe
winsupdater.exe has the hidden file attribute and similarly the
<Program Files>\winsupdater\ folder is a hidden folder.
W32/Alcra-F creates the following files:
<root folder>\at.exe
<Program Files>\winsupdater\a.zip
Where the a.zip file contains a copy of the Setup.exe.
The file at.exe is detected as W32/Rbot-CVY.
When first run, W32/Alcra-F creates the following registry entry to ensure that it is run when an infected system starts:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winsupdater
<Program Files>\winsupdater\winsupdater.exe /auto