high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please read the instructions for removing worms.
You will also need to edit the following registry entry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the following HKEY_CLASSES_ROOT entry:
HKCR\jpegfile\Shell\Open\Command
Delete the Data within the entry. Delete only the Data, do not delete anything else.
Close the registry editor.
After editing the registry you should restore file associations for .JPG files.
More Information
W32/Perrun-A is a Win 32 executable normally with the name proof.exe. When proof.exe is run it drops another executable, extrk.exe. It also modifies the registry such that when a user double clicks on an .JPG file it runs the extrk.exe instead of the originally associated picture viewer.
The registry entry modified is:
HKLM\Software\CLASSES\jpegfile\shell\open\command
When the user double clicks on a .JPG file, extrk.exe is run and attempts to download the following files:
sasearch/balloon.xs1
sasearch/lclsrh.xml
sasearch/lclAdv.xml
sasearch/lclprog.xml
sasearch/lclrfine.xml
from the following sites.
ie.search.msn.com
sa.windows.com
se.windows.com
It then launches the Windows Picture and Fax Viewer to display the picture. This is the default viewer under Windows XP.
|
