W32/Otakbokep-A

Please follow the instructions for removing worms.

W32/Otakbokep-A is a worm for the Windows platform.

W32/Otakbokep-A spreads via removable drives.

W32/Otakbokep-A is a worm for the Windows platform.

W32/Otakbokep-A spreads via removable drives.

When first run W32/Otakbokep-A copies itself to:

<Windows>\msvbvm60.exe
<System>\Command.com
<System>\rascal32.exe
<Profile>\Templates\userinit.exe
<My Documents>\JapanPorn.exe
<My Documents>\Miyabi-New Episode(NO SENSOR).exe

and places copies of itself into removable drives with the following filenames:

Ayam-kampus.exe
Miyabi-New Episode(NO SENSOR).exe

and in addition, creates the following files:

Ayam-kampus - text file, can be safely deleted.
Miyabi-New Episode(NO SENSOR) - text file, can be safely deleted.

W32/Otakbokep-A attempts to avoid removal by preventing new applications from running.

W32/Otakbokep-A may also move certain applications to <Root>\pUkcaB_LACSAR renaming the original file extensions to .RASCAL.

W32/Otakbokep-A creates the following registry entries to start itself:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
NET-SERVICES
<System>\rascal32.exe /register

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows
<Windows>\msvbvm60.exe /register

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\rascal32.exe


HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe <System>\rascal32.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System
<Windows>\msvbvm60.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
userinit.exe,<Profile>\Templates\userinit.exe,

The following registry entries are set to make removal of W32/Otakbokep-A difficult:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemFileProtection
ShowPopups
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoClose
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoLogOff
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoFind
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoControlPanel
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoViewContextMenu
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ReportBootOk
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
-99

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

The following registry entries modify the Windows registration, OEM and computer information in System Properties:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId

along with these additional files:

<System>\oeminfo.ini - can be safely deleted.
<System>\oemlogo.bmp - image file, can be safely deleted.