W32/VBForm-A

Category: Viruses and Spyware Protection available since:09 Feb 2010 08:24:05 (GMT)
Type: Win32 worm Last Updated:09 Feb 2010 08:24:05 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/VBForm-A includes functionality to run automatically as well as spread to USB keys.

When W32/VBForm-A is installed it creates the file <User>\<random name>.exe.

The following registry entry is created to run rdgeb.exe on startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
<random name>
 <User>\<random name>.exe

The following registry entry is set: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowSuperHidden 0x00000000

download Try Sophos products for free
Download now