high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | October 2007 (4.22) |
| Protection available since | 19 August 2007 15:18:47 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/VBLame-C is a worm for the Windows platform.
Troj/VBLame-C will copy itself to the root folder of various drives using the name "Tunggul.vbs".
When first run W32/VBLame-C copies itself to:
<Windows>\system23\aniee.exe
<System>\hanny.exe
and creates the file <Root>\Tunggul.vbs.
Troj/VBLame-C will copy itself to the root folder of various drives using the name "Tunggul.vbs".
Troj/VBLame-C will create the following registry entries in order to autostart itself:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinSistem
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
It will prevent the following list of software from running and instead, attempt to autostart itself:
cmd.exe
msconfig.exe
regedit.exe
PCMAV.exe
PCMAV-CLN.exe
PCMAV-RTP.exe
PCMAV-SE.exe
VB6.exe
autorun.exe
ansav.exe
ansavgd.exe
viremoval.exe
avscan.exe
avgnt.exe
iexplore.exe
firefox.exe
It will also attempt to disable various explorer verion by setting the following entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
HKCU\Software\Microsoft\Windows\CurrentVersionPolicies\System\DisableRegistryTools
HKCU\Software\Microsoft\Windows\CurrentVersionPolicies\System\DisableTaskMgr
|
