WORM_KATSLO.A

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\13.tmp.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following files:

• {Removable Drive}\$REChCLE.BIN
• {Removable Drive}\readme.tat
• {Removable Drive}\destopfini
• {Removable Drive}\vagefile.sys
• {Removable Drive}\thLmbs.db

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {random}.{random}

Other Details

This worm deletes itself after execution.