VIRUS NAME: W32/Cervivec@MM
Internet
Worm Characteristics
This worm arrives as a zip file attached to an email, named WORMS.ZIP.
Inside the ZIP files is an executable named WORMS.EXE. The EXE is written
in the Delphi programming language and packed with the UPX packer. When
run, the worm adds a new value "Kernel Loader" to the registry
key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run which
ensures that the virus runs after every reboot.
Symptoms
1. presence of the NTKRNL.EXE file in \WINDOWS\SYSTEM32 or \WINDOWS\SYSTEM
2. presence of the Registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run\Kernel Loader="C:\WINDOWS\system32\ntkrnl.exe -LOADDRIVERS=TRUE"
|
