W32/SillyFDC-AS is a worm for the Windows platform.
W32/SillyFDC-AS attempts to copy itself to other removable and fixed drives.
W32/SillyFDC-AS is a worm for the Windows platform.
W32/SillyFDC-AS attempts to copy itself to other removable and fixed drives, also creating the file autorun.inf in order to run the copy automatically.
W32/SillyFDC-AS includes functionality to download, install and run new software.
When first run W32/SillyFDC-AS copies itself to the following locations, with configurable filenames:
<Common Files>\Microsoft Shared\<configurable filename>.exe
<Common Files>\system\<configurable filename>.exe
<Program Files>\<configurable filename>.exe
and creates some of the following files:
<Program Files>\1.hiv
<Program Files>\2.hiv
<Program Files>\3.hiv
<Program Files>\4.hiv
<Program Files>\ReadDown.txt
<Program Files>\<configurable filename>.inf
W32/SillyFDC-AS attempts to terminate certain processes, services and windows, many of them related to security and anti-virus software.
W32/SillyFDC-AS may set registry entries under the following location:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
W32/SillyFDC-AS sets some of the following registry entries periodically in order to disable certain services:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\helpsvc
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RSPPSYS
Start
4
HKLM\SYSTEM\ControlSet001\Services\wscsvc
Start
4
HKLM\SYSTEM\ControlSet001\Services\wuauserv
Start
4
W32/SillyFDC-AS also sets the following registry entries periodically:
HKLM\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall
CheckedValue
0
HKU\S-1-5-21-1409082233-115176313-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun
91