Virut.AV_7 is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Virut.AV_7 is compressed using the executable packer and its file size is 89,088 bytes. Virut.AV_7 drops the following files on the hard drive: - C:\WINDOWS\system32\Isass.exe (89088 bytes)
It also changes Windows registry: - Creates value "Local Security Authority Service"="C:\WINDOWS\system32\Isass.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: c112115b05994461a3b4427eb42cc38b87e2. It also is executed every time Windows starts.
|
