high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Protection available since | 15 June 2005 13:17:34 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for disinfecting macro viruses.
More Information
VBS/Roor-B is a virus that may infect HTML or text files.
VBS/Roor-B infects files with file extension HTM, HTML or HTT in the folder in which it is run.
VBS/Roor-B drops the virus as FOLDER.HTT and an INI file DESKTOP.INI in various locations, including the root folder, the Windows folder, the Windows system folder, the Windows Desktop and the StartUp folder. The virus may also spread to the root folder of other drives.
VBS/Roor-B makes the following changes to the system registry:
HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
about:error
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs
error
http://<URL at geocities>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClassicShell
0
The virus deletes the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ExtShellViews
(5984FFE0-28D4-11CF-AE66-08002B2E1262)
|
