WORM_STUXNET.A
WORM_STUXNET.A is a worm that targets Siemens SCADA WinCC systems, which are used for machines and plant operations. On infiltrating a system, WORM_STUXNET.A will drop malicious files and add new registry entries. WORM_STUXNET.A will drop copies of itself in all attached removable drives along with a .LNK file that references a copy of itself in removable drives. WORM_STUXNET.A will also attempt to send possibly malicious requests to the system database with SQL commands. WORM_STUXNET.A is a computer threat that can be removed with a good anti-spyware application.
File System Details
WORM_STUXNET.A may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %System%\drivers\mrxnet.sys - detected as RTKT_STUXNET.A | |
| 2. | %System%\drivers\mrxcls.sys - detected as RTKT_STUXNET.A |
Registry Details
WORM_STUXNET.A may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNetImagePath = "\??\%System%\Drivers\mrxnet.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxClsImagePath = "\??\%System%\Drivers\mrxcls.sys"
