W32/VB-CTQ

Please follow the instructions for removing infected executable files.

W32/VB-CTQ is a companion virus for the Windows platform.

W32/VB-CTQ will replace files with the extension .DOC, appending the original file to the copy of itself.

When W32/VB-CTQ is installed the following files are created:

<Temp>\Flu Burung.txt
<current folder>\%ORIGFILENAME%
<current folder>\%ORIGFILENAME%!
<Program Files>\Microsoft Office\Office\docicon.exe
\Recycled\ctfmon.exe
\Recycled\smss.exe
\Recycled\spoolsv.exe
\Recycled\svchost.exe
<Windows>\Fonts\aExplorer.exe

The following registry entries are changed to run W32/VB-CTQ on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "C:\recycled\SVCHOST.exe"

(the default value for this registry entry is "Explorer.exe" which causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "<Windows>\Fonts\aExplorer.exe"

(the default value for this registry entry is "Explorer.exe" which causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\HideFileExt
UncheckedValue
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden
UncheckedValue
0

HKCR\Word.Document.8\DefaultIcon
(default)
<Program Files>\Microsoft Office\Office\docicon.exe