W32/SillyFDC-BX

Please follow the instructions for removing worms.

W32/SillyFDC-BX is a worm for the Windows platform.

When run W32/SillyFDC-BX copies itself to:

<Program Files>\Common Files\Microsoft Shared\nqyltsy.exe
<Program Files>\Common Files\System\yedkreq.exe
<Program Files>\meek.exe

W32/SillyFDC-BX also creates the files:

<Program Files>\Common Files\Microsoft Shared\ulcdqsp.inf - detected as W32/SillyFDC-BX
<Program Files>\Common Files\System\ulcdqsp.inf - detected as W32/SillyFDC-BX

W32/SillyFDC-BX sets the following registry entries to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iluqcwr
<Program Files>\Common Files\Microsoft Shared\nqyltsy.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ulcdqsp
<Program Files>\Common Files\System\yedkreq.exe

W32/SillyFDC-BX includes functionality to download code from the internet.

W32/SillyFDC-BX spreads via removable shared drives by copying itself to the shared drive as <Root>\iluqcwr.exe.

W32/SillyFDC-BX also creates the file <Root>\Autorun.inf (also detected as W32/SillyFDC-BX) which is designed to run the worm when the removable drive is connected to an uninfected computer.

W32/SillyFDC-BX sets the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\SuperHidden
Type
checkbox2

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\helpsvc
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

W32/SillyFDC-BX also changes registry entries under:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\