SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  Padobot.M
Padobot.M is a Virus. A Virus is a software program capable of reproducing itself spreading to other programs on the same computer or on other computers via the network. Padobot.M is compressed using the executable packer and its file size is 19,081 bytes. Padobot.M drops the following files on the hard drive:
  • C:\WINDOWS\SYSTEM32\kmuwy.exe (19081 bytes)
It also changes Windows registry:
  • Creates key "HKLM\Software\Microsoft\Wireless".
  • Sets value "ID"="zbjjlrqvllorvb" in key "HKLM\Software\Microsoft\Wireless".
  • Sets value "Client"="1" in key "HKLM\Software\Microsoft\Wireless".
  • Creates value "Cryptographic Service"="C:\WINDOWS\SYSTEM32\kmuwy.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: uterm19. It also attempts to acquire the "SeDebugPrivilege" privileges, is executed every time Windows starts.


Relevant Information