W32/Stration-F is a worm for the Windows platform.
When W32/Stration-F is installed the following files are created:
<System>\plussisb.exe
<System>\vjoyterm.dll
<System>\vjoyterm.exe
The files vjoyterm.exe and vjoyterm.dll are also detected as W32/Stration-F. The file plussisb.exe is not inherently malicious.
The following registry entries are created to run code exported by vjoyterm.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vjoyterm
DllName
<System>\vjoyterm.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vjoyterm
Startup
WlxStartupEvent
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vjoyterm
Impersonate
0