Summary
Summary
Action- More Information
| Included in our products from | August 2002 (3.60) |
|---|---|
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please read the instructions for removing worms.
You will also need to edit the following registry entry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the following HKEY_CLASSES_ROOT entry:
HKCR\jpegfile\Shell\Open\Command
Delete the Data within the entry. Delete only the Data, do not delete anything else.
Close the registry editor.
After editing the registry you should restore file associations for .JPG files.
More Information
W32/Perrun-A is a Win 32 executable normally with the name proof.exe. When proof.exe is run it drops another executable, extrk.exe. It also modifies the registry such that when a user double clicks on an .JPG file it runs the extrk.exe instead of the originally associated picture viewer.
The registry entry modified is:
HKLM\Software\CLASSES\jpegfile\shell\open\command
When the user double clicks on a .JPG file, extrk.exe is run and attempts to download the following files:
sasearch/balloon.xs1
sasearch/lclsrh.xml
sasearch/lclAdv.xml
sasearch/lclprog.xml
sasearch/lclrfine.xml
from the following sites.
ie.search.msn.com
sa.windows.com
se.windows.com
It then launches the Windows Picture and Fax Viewer to display the picture. This is the default viewer under Windows XP.
|
