high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | August 2006 (4.08) |
| Protection available since | 12 July 2006 05:22:05 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Dozic-A is a worm for the Windows platform. W32/Dozic-A attempts to spread via AOL Instant Messenger. W32/Dozic-A is a worm for the Windows platform. W32/Dozic-A attempts to spread via AOL Instant Messenger.
When first run W32/Dozic-A copies itself to <Startup>\WinZod32.exe, <System>\zod32.exe and may create the following files:
<Program Files>\aol\info.htm
<Windows>\wininit.ini
These files are harmless and may be deleted.
The following registry entry is created to run code exported by zod32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
winup
<System>\zod32.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Winupd
<System>\zod32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
winndata
<System>\zod32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
windatea
<System>\zod32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
winnet
<System>\zod32.exe
Registry entries are created under:
HKCU\Control Panel\Desktop\
HKCR\JSEFile\Shell\Open\Command\
HKCR\JSFile\Shell\Open\Command\
HKCR\VBEFile\Shell\Open\Command\
HKCR\VBSFile\Shell\Open\Command\
HKCR\WSFFile\Shell\Open\Command\
HKCR\WSHFile\Shell\Open\Command\
HKCR\batfile\shell\open\command\
HKCR\comfile\shell\open\command\
HKCR\exefile\shell\open\command\
HKCR\piffile\shell\open\command\
HKCR\scrfile\shell\open\command\
HKLM\SYSTEM\Control\WOW\cmdline\
HKLM\SYSTEM\Control\WOW\wowcmdline\
|
