JS/Uragon-A

Category: Viruses and Spyware Protection available since:07 Jun 2008 00:29:02 (GMT)
Type: JavaScript worm Last Updated:12 May 2011 16:33:29 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

JS/Uragon-A copies itself to:

<Windows>\service.exe.js
<System>\winx86.dll.js

JS/Uragon-A creates the registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
updater23
<Windows>\service.exe.js

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
1
<System>\winx86.dll.js

JS/Uragon-A causes Windows Explorer to hide file extensions and disables Windows Task Manager.

JS/Uragon-A continually searches for removable and fixed drives to infect and copies itself as "uragon.txt.js" and creates an autorun.inf file. The autorun.inf is also detected as JS/Uragon-A.

JS/Uragon-A changes all Internet Explorer zone settings to allow unsafe ActiveX controls to run.

download Try Sophos products for free
Download now