high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | May 2008 (4.29) |
| Protection available since | 30 January 2008 17:58:13 (GMT) |
| Last updated | 2 April 2008 18:20:52 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Glupzy-B is a worm for the Windows platform.
When first run W32/Glupzy-B copies itself to:
<Startup>\systemID.pif
<System>\Flashy.exe
The following registry entry is created to run Flashy.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Flashy Bot
<System>\Flashy.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
2
W32/Glupzy-B copies itself to available removable drives and ramdisks, using the names of existing files with the extension changed to EXE.
|
