Short description
VBS/Butsur.A is a worm that spreads by copying itself into certain folders.
Installation
When executed, the worm copies itself into the following location:
In order to be executed on every system start, the worm sets the following Registry entry:
- [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
Run]
"MS32DLL" = "%windir%MS32DLL.dll.vbs"
The following Registry entries are created:
- [HKEY_CURRENT_USERSoftwareMicrosoftInternet Explorer
Main]
"Window Title" = "Hacked by Godzilla"
Spreading
The worm copies itself into the root folders of fixed and/or removable drives using the following filename:
The following file is dropped in the same folder:
Thus, the worm ensures it is started each time infected media is inserted into the computer.
Other information
The worm launches the following processes:
