Threat Database Worms Worm:Win32/Brontok.S@mm

Worm:Win32/Brontok.S@mm

By Domesticus in Worms

Worm:Win32/Brontok.S@mm is a mass-mailing email worm that modifies certain computer settings, such as how hidden files are shown, and disables editing of the Windows Registry. Worm:Win32/Brontok.S@mm circulates by copying itself, as an email attachment, to contacts stored on the corrupted PC. Worm:Win32/Brontok.S@mm can also replicate itself to USB and removable drives. Worm:Win32/Brontok.S@mm makes system changes on the targeted computer by downloading infected files and making modifying the Windows Registry. While being run, Worm:Win32/Brontok.S@mm opens a Windows Explorer window to the 'My Documents' folder. For its copies, Worm:Win32/Brontok.S@mm uses the Windows 'new folder' icon. This may make the file to seem to be as if it were a new folder rather than an .exe file, attracting a computer user into accidentally executing Worm:Win32/Brontok.S@mm.

File System Details

Worm:Win32/Brontok.S@mm may create the following file(s):
# File Name Detections
1. %APPDATA%\winlogon.exe
2. %APPDATA%\lsass.exe
3. %windir%\eksplorasi.exe
4. %APPDATA%\csrss.exe
5. %APPDATA%\services.exe
6. %windir%\shellnew\sempalong.exe
7. %APPDATA%\bronnetdomlist.bat
8. %APPDATA%\inetinfo.exe
9. %APPDATA%\smss.exe
10. %USERPROFILE%\Templates\Brengkolang.com
11. %windir%\system32\drivers\etc\hosts-denied by-%UserName%.com
12. %APPDATA%\Kosong.Bron.Tok.txt
13. %windir%\system32\%UserName%'s Setting.scr
14. %USERPROFILE%\My Documents\My Pictures\about.Brontok.A.html
15. %USERPROFILE%\Start Menu\Programs\Startup\empty.pif
16. %APPDATA%\bronfoldnetdomlist.txt
17. %APPDATA%\bronnpath0.txt

Registry Details

Worm:Win32/Brontok.S@mm may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run "Bron-Spizaetus" = "%windir%\shellnew\sempalong.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "explorer.exe "%windir%\eksplorasi.exe""
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run "Tok-Cirrhatus" = "%APPDATA%\smss.exe"

Trending

Most Viewed

Loading...