Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'App.EXEName' = '<Full path to virus>'
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- NAVAPW32.EXE
- mpftray.exe
- outpost.exe
- ZONEALARM.EXE
- zapro.exe
- AVP.EXE
- AVGCTRL.EXE
- AVP32.EXE
- AVPM.EXE
- AVPCC.EXE
Modifies file system :
Creates the following files:
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'Windows Task Manager'
- ClassName: '(null)' WindowName: 'System Configuration Utility'
- ClassName: '(null)' WindowName: 'Registry Editor'
- ClassName: '(null)' WindowName: 'MS-DOS Prompt'
- ClassName: '(null)' WindowName: 'Norton Antivirus'
