high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | August 2007 (4.20) |
| Protection available since | 11 July 2007 05:22:04 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Yodo-C is a worm for the Windows platform.
When first run W32/Yodo-C copies itself to:
<Program Files>\KaZaA Lite\My Shared Folder\Keygen.exe
<Program Files>\KaZaA Lite\My Shared Folder\Windows XP.exe
<Program Files>\KaZaA Lite\My Shared Folder\halflife.exe
<Program Files>\KaZaA Lite\My Shared Folder\hentai game.exe
<Program Files>\KaZaA\My Shared Folder\Keygen.exe
<Program Files>\KaZaA\My Shared Folder\Windows XP.exe
<Program Files>\KaZaA\My Shared Folder\halflife.exe
<Program Files>\KaZaA\My Shared Folder\hentai game.exe
<System>\updater.exe
and may display such messages as:
"Greetings from the underground to those in the normal world "
"Hello Again Dolly! This time we are back for Round 2. Hope your Ready ^_^"
The following registry entry is created to run updater.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windowz Update V2.0
updater.exe
|
