W32/Tiotua-P

Please follow the instructions for removing worms.

W32/Tiotua-P attempts to spread via network shares and peer-to-peer file-sharing applications.

When first run W32/Tiotua-P copies itself to:

<User>\My Documents\Sÿstem.exe
<Root>\New Folder.exe
<Program Files>\Sÿstem.exe
<Root>\WinSys.sys
<Windows>\Sÿstem.exe
<Windows>\Winnt.sys
<System>\Sÿstem.exe
<System>\Winnt.sys

The following registry entry is created to run Sÿstem.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Init
<System>\Sÿstem.exe

The following registry entries are changed to run Sÿstem.exe on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe Sÿstem.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe Sÿstem.exe

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DisallowRun
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
1
Wincmd.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
2
zlclient.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
3
nvprotect.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
4
Regworkshop.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
5
Mcshield.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
6
avp.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
7
ccprovsp.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
8
Attrib.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
1
Wincmd.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
2
zlclient.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
3
nvprotect.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
4
Regworkshop.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
5
Mcshield.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
6
avp.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
7
ccprovsp.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
8
Attrib.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
DisallowRun
1

HKCR\Folder\shell\Explorer\command
(default)
Sÿstem.exe

HKCR\Folder\shell\Open With\command
(default)
Sÿstem.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0