Threat Database Worms Worm.Rorpian.E

Worm.Rorpian.E

By GoldSparrow in Worms

Worm.Rorpian.E is a malignant worm that replicates by exploiting the Domain Name System (DNS) Server Service vulnerability and via network shares. Worm.Rorpian.E can download and install other malware threats on the compromised PC. Worm.Rorpian.E contacts a certain IP address to download some system files, and modifies the registry to run each time you start your PC. Worm.Rorpian.E copies itself by enumerating all network shares; copying itself to the share, together with some other system files. Worm.Rorpian.E creates an 'autorun.inf' file that loads Worm.Rorpian.E executable when the share is accessed, and a shortcut .lnk file which exploits the particular vulnerability. Worm.Rorpian.E scans a network so that it can detect some exploitable computers, spreading itself to the PC if it is vulnerable. You should remove Worm.Rorpian.E instantly upon detection.

SpyHunter Detects & Remove Worm.Rorpian.E

File System Details

Worm.Rorpian.E may create the following file(s):
# File Name MD5 Detections
1. setup.fon
2. pornmovs.lnk
3. %TEMP%\srv8E0.ini
4. myporno.avi.lnk
5. %TEMP%\srv8E0.tmp
6. setup.lnk
7. autorun.inf
8. mexcore4.jpg b213998570638b78fded10f371d5b0fc 0
9. mexcore4.jpg f6dd892067970d117bc2b782a44ba439 0
10. mexcore4.jpg ca48e9f36ca1eecc9ba391e13eb70c4e 0
11. mexcore4.jpg 6930688a9bd13c2a5453fb47a37b7426 0
12. mexcore4.jpg 99621a5bfd631668152881504a7daf00 0

Registry Details

Worm.Rorpian.E may create the following registry entry or registry entries:
HKLM\software\microsoft\windows nt\currentversion\svchost\"netsvcs"= "srv"
HKLM\system\currentcontrolset\services\srv\parameters\"servicedll"="\\?\globalroot\device\harddiskvolume1\%TEMP%\srv.tmp"
HKLM\system\currentcontrolset\services\srv\"imagepath"="%systemroot%\system32\svchost.exe -k netsvcs"
HKLM\system\currentcontrolset\control\safeboot\minimal\srv\"(default)"="service"

Trending

Most Viewed

Loading...