W32/VB-DOC is a worm for the Windows platform.
When executed the worm copies itself to:
<Windows>\SYSTEMIL.EXE
<Documents and Settings>\user\Start Menu\Programs\Startup\SYSTEMIL1.EXE
<Documents and Settings>\All Users\Start Menu\Programs\Startup\SYSTEMIL2.EXE
<Windows>\Start Menu\Programs\Startup\SYSTEMIL1.EXE
<Windows\All Users\Start Menu\Programs\Startup\SYSTEMIL2.EXE
<Root>\Documents.exe
<Root>\Pictures.exe
<Root>\Photos.exe
<Root>\Games.exe
<Root>\SYSTEMIL.EXE
The following registry entries are set:
HKLM\Sofware\Microsoft\Windows\CurrentVersion\Run\SystemIL
<Windows>\SYSTEMIL.EXE
HKCU\Sofware\Microsoft\Windows\CurrentVersion\Run\SystemIL
<Windows>\SYSTEMIL.EXE
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1