English 
W32/Xanib A W32/Xanib-A
By
Domesticus in 
Loading ...
W32/Xanib-A Description
W32/Xanib-A is a virus for the Windows platform that infects executable and multimedia files on a compromised computer.
Type: Viruses
Automatic Detection of W32/Xanib-A
W32/Xanib-A has typically the following processes in memory:
- %System%\[SECOND SET OF RANDOM CHARACTERS].exe
- %System%\[FIRST SET OF RANDOM CHARACTERS].exe
W32/Xanib-A creates the following registry entries:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[SECOND SET OF RANDOM CHARACTERS]” = “Error”
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”[FIRST SET OF RANDOM CHARACTERS]” = “Error”
- HKEY_LOCAL_MACHINE\SOFTWARE\[SECOND SET OF RANDOM CHARACTERS]\”[SECOND SET OF RANDOM CHARACTERS]” = “%System%\[SECOND SET OF RANDOM CHARACTERS].exe”
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\Win32.Xanib\Command\”(default)” = “Explorer.exe”
- HKEY_LOCAL_MACHINE\SOFTWARE\[FIRST SET OF RANDOM CHARACTERS]\”[FIRST SET OF RANDOM CHARACTERS]” = “%System%\[FIRST SET OF RANDOM CHARACTERS].exe”
Important Article Disclaimer
This entry was posted
on 09/8/09 and is filed under Viruses.
You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
