high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 14 February 2008 14:58:41 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Dref-B is a worm for the Windows platform.
W32/Dref-B includes functionality to access the internet and communicate with a remote server via HTTP.
When first run W32/Dref-B copies itself to <System>\wind32.exe and creates the file <System>\dllgh8jkd1q8.exe.
The following registry entry is created to run wind32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System
<System>\wind32.exe
The following registry entry is set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
|
