 |
W32/VB.CK Worm
| Name |
W32/VB.CK Worm |
| Aliases |
Worm/VB.CK.8, Worm/VB.ARW, Worm.Win32.VB.ck, W32.Imaut.AA, Worm.VB.ZAR |
| Discovered on |
August 04, 2008 |
 Virus Information - W32/VB.CK Worm:
W32/VB.CK is a worm. The worm will infect Windows systems.
Upon execution the worm drops the following files:
 lsass.exe in the Windows System folder,
lsass.exe in the Windows folder,
MSconfig.exe in %All Users%\Startup folder.
It also creates an exe file with the same name as that of the current folder name with the folder icon, so the worm gets executed when the user clicks on it assuming it to be a folder.
The worm modifies registry at the following locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig
HKEY_USERS\S-1-5-21-(SID)\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
It also modifies registry to disable Registry Tools, FolderOptions, Run and Task Manager.
The worm also changes the Internet Explorer home page to http://quicknews.info.
|
