WORM_BRONTOK.SM

This worm arrives by accessing affected shared networks.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

Arrival Details

This worm arrives by accessing affected shared networks.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\AUTOEXEC.exe
• %System%\New Folder.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following component file(s):

• %System Root%\n.txt
• %System Root%\yahoopath.txt

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
New Folder = New Folder.exe

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = userinit.exe,New Folder.exe

(Note: The default value data of the said registry entry is %system%\userinit.exe,.)

Other System Modifications

This worm adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1