Reply to thread

Message: <blockquote data-quote="chaminga_d" data-source="post: 326357" data-attributes="member: 8237">Oh.... This is a Virus (WORM_DELF.BRF)Details:Installation and AutostartUpon execution, this worm drops a copy of itself as WINCFGS.EXE in the Windows system folder. It also drops and executes the Chinese version of NOTEPAD.EXE, KB20060111.EXE, in the Windows folder.It modifies the following registry entry to ensure its automatic execution at every system startup:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\WindowsLoad = "%System%\WINCFGS.EXE"(Note: The default value data of the said entry is null.)(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)Propagation RoutineWhenever a USB device is plugged onto an affected machine, this worm drops a copy of itself in the following path:      {USB drive letter}\RECYCLER\RECYCLER\autorun.exeIf the path, {USB drive letter}\RECYCLER\RECYCLER does not exist, this worm creates it.This worm also creates the file {USB drive letter}\AUTORUN.INF, which contains the following lines in its body:[autorun]open=.\RECYCLER\RECYCLER\autorun.exeshell\1=Openshell\1\Command=.\RECYCLER\RECYCLER\autorun.exeshell\2\=Browsershell\2\Command=.\RECYCLER\RECYCLER\autorun.exeshellexecute=.\RECYCLER\RECYCLER\autorun.exeThe aforementioned file is responsible in automatically executing AUTORUN.EXE whenever a USB device is plugged on the affected machine.Other DetailsThis worm creates the following mutex to ensure that only one instance of itself is running in the memory:USBSpyRunMutexThis worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003.</blockquote>

Verification: Hath warak paha keeyada? (hatha wadikireema paha)

Top Bottom