W32/Voterai-A is a worm for the Windows platform.
W32/Voterai-A spreads to other network computers.
When first run W32/Voterai-A copies itself to:
<Startup>\defaults.pif
<Windows>\Debug\explorer.exe
<Windows>\Installer\winlogon.exe
<System>\dllcache\lsass.exe
<System>\dllcache\userinit.exe
and creates the following files:
<Root>\kib.htm
<Windows>\SoftWareProtector\avu14_out.pr
<Windows>\sys.inf
The following registry entry is changed to run W32/Voterai-A on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<Windows>\installer\winlogon.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
00
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
00
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
000
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
00
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
<System>\dllcache\userinit.exe