W32/VBLame-C is a worm for the Windows platform.
Troj/VBLame-C will copy itself to the root folder of various drives using the name "Tunggul.vbs".
W32/VBLame-C is a worm for the Windows platform.
When first run W32/VBLame-C copies itself to:
<Windows>\system23\aniee.exe
<System>\hanny.exe
and creates the file <Root>\Tunggul.vbs.
Troj/VBLame-C will copy itself to the root folder of various drives using the name "Tunggul.vbs".
Troj/VBLame-C will create the following registry entries in order to autostart itself:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinSistem
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
It will prevent the following list of software from running and instead, attempt to autostart itself:
cmd.exe
msconfig.exe
regedit.exe
PCMAV.exe
PCMAV-CLN.exe
PCMAV-RTP.exe
PCMAV-SE.exe
VB6.exe
autorun.exe
ansav.exe
ansavgd.exe
viremoval.exe
avscan.exe
avgnt.exe
iexplore.exe
firefox.exe
It will also attempt to disable various explorer verion by setting the following entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
HKCU\Software\Microsoft\Windows\CurrentVersionPolicies\System\DisableRegistryTools
HKCU\Software\Microsoft\Windows\CurrentVersionPolicies\System\DisableTaskMgr