Win32/VB.NSP | ESET Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Short description

Win32/VB.NSP is a worm that spreads via removable media. The file is run-time compressed using UPX .

Installation

When executed the worm copies itself in the following locations:

In order to be executed on every system start, the worm sets the following Registry entries:

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
Run]
"pikachu" = "%windir%pikachu.exe"
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NT
CurrentVersionWinlogon]
"Userinit" = "%windir%userinit.exe"

The following Registry entries are set:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
CurrentVersionExplorerAdvancedFolderHiddenSHOWALL]
"CheckedValue" = 0
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
CurrentVersionExplorerAdvancedFolderHideFileExt]
"UncheckedValue" = 1
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
CurrentVersionExplorerAdvancedFolderSuperHidden]
"UncheckedValue" = 0

The following Registry entries are created:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
CurrentVersionpoliciesExplorer]
"NoFolderOptions" = 0
"NoRun" = 0
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
PoliciesSystem]

The following Registry entries are removed:

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBoot
Minimal{4D36E967-E325-11CE-BFC1-08002BE10318}]
"(Default)" = "DiskDrive"
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBoot
Network{4D36E967-E325-11CE-BFC1-08002BE10318}]
"(Default)" = "DiskDrive"

Spreading on removable media

The worm copies itself into the root folders of removable drives using the following name:

The worm may create copies of itself in the folder:

The name of the file may be based on the name of an existing file or folder. An additional ".exe" extension is appended.

Other information

The following file is modified:

The worm writes the following entries to the file, effectively disabling access to the specific Internet sites: