| Padobot.M is a Virus. A Virus is a software program capable of reproducing itself spreading to other programs on the same computer or on other computers via the network. Padobot.M is compressed using the executable packer and its file size is 19,081 bytes. Padobot.M drops the following files on the hard drive: |
It also changes Windows registry:
- C:\WINDOWS\SYSTEM32\kmuwy.exe (19081 bytes)
It creates the following mutex to ensure only one instance is running: uterm19. It also attempts to acquire the "SeDebugPrivilege" privileges, is executed every time Windows starts.
- Creates key "HKLM\Software\Microsoft\Wireless".
- Sets value "ID"="zbjjlrqvllorvb" in key "HKLM\Software\Microsoft\Wireless".
- Sets value "Client"="1" in key "HKLM\Software\Microsoft\Wireless".
- Creates value "Cryptographic Service"="C:\WINDOWS\SYSTEM32\kmuwy.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".