Characteristics
-
Installs itself in the registry
-
Opens links to websites
Affected Operating Systems
Recovery Instructions:
Please follow the instructions for removing worms.
The following registry entries should be restored to their original or desired values:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous