Sophos

W32/Glupzy-B

Aliases
  • Trojan.Win32.Disabler.i
  • BackDoor-DIY
  • trojan
  • WORM_FLASHY.B
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from March 2008 (4.27)
Protection available since 30 January 2008 18:04:00 (GMT)
Detected by All Sophos products

Action

More Information

W32/Glupzy-B is a worm for the Windows platform.

When first run W32/Glupzy-B copies itself to:

<Startup>\systemID.pif
<System>\Flashy.exe

The following registry entry is created to run Flashy.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Flashy Bot
<System>\Flashy.exe

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
2

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer