Malas.F is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Malas.F is compressed using the executable packer and its file size is 176,128 bytes. Malas.F drops the following files on the hard drive: - C:\TEMP\systray.exe (176128 bytes)
- C:\DOCUME~1\Administrator\Application Data\usrinit.exe (176128 bytes)
- C:\DOCUME~1\Administrator\Local Settings\startup.exe (176128 bytes)
- C:\Progra~1\Common Files\AdobeUpdate.exe (176128 bytes)
It also changes Windows registry: - Creates value "SoundMax"="C:\DOCUME~1\Administrator\Local Settings\startup.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: nl45as23. It also is executed every time Windows starts.
|
