live casino online

This worm arrives by connecting affected removable drives to a system.

It adds registry entries to enable its automatic execution at every system startup.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may arrive via network shares.

Installation

This worm drops the following files:

• %System Root%\Documents and Settings\All Users\Start Menu\Internet Explorer.lnk - autostart component detected as EXPL_CPLNK.SM
• %Common Startup%\Microsoft Update.lnk - autostart component detected as EXPL_CPLNK.SM
• %Favorites%\Microsoft Update.lnk - autostart component detected as EXPL_CPLNK.SM

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Common Startup% is the system's shared Startup folder, which is usually C:\Windows\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\All Users\Programs\Startup on Windows NT, and C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003.. %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Recycler = "%System Root%\RECYCLER.lnk"

Propagation

This worm drops the following copies of itself in all physical and removable drives:

• mso.sys

NOTES:

As part of its propagation routine, it also drops a copy of itself as MSO.SYS in all shared folders. In addition, it drops the file RECYCLER.LNK file to automatically execute copies of itself when a user accesses the drives of an affected system.

It then drops the following shortcut files, all of which are detected as EXPL_CPLNK.SM, in removable drives and shared folders:

• Documents and Settings.lnk
• Program Files.lnk
• System Volume Information.lnk
• WINDOWS.lnk

The said shortcut files are used to enable automatic execution of dropped copies in removable drives and shared folders.