W32/Dozic-A is a worm for the Windows platform. W32/Dozic-A attempts to spread via AOL Instant Messenger.
W32/Dozic-A is a worm for the Windows platform. W32/Dozic-A attempts to spread via AOL Instant Messenger.
When first run W32/Dozic-A copies itself to <Startup>\WinZod32.exe, <System>\zod32.exe and may create the following files:
<Program Files>\aol\info.htm
<Windows>\wininit.ini
These files are harmless and may be deleted.
The following registry entry is created to run code exported by zod32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
winup
<System>\zod32.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Winupd
<System>\zod32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
winndata
<System>\zod32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
windatea
<System>\zod32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
winnet
<System>\zod32.exe
Registry entries are created under:
HKCU\Control Panel\Desktop\
HKCR\JSEFile\Shell\Open\Command\
HKCR\JSFile\Shell\Open\Command\
HKCR\VBEFile\Shell\Open\Command\
HKCR\VBSFile\Shell\Open\Command\
HKCR\WSFFile\Shell\Open\Command\
HKCR\WSHFile\Shell\Open\Command\
HKCR\batfile\shell\open\command\
HKCR\comfile\shell\open\command\
HKCR\exefile\shell\open\command\
HKCR\piffile\shell\open\command\
HKCR\scrfile\shell\open\command\
HKLM\SYSTEM\Control\WOW\cmdline\
HKLM\SYSTEM\Control\WOW\wowcmdline\