Home Malware Programs Worms Franvir

Franvir

Posted: March 28, 2006

Franvir is an Internet worm that spreads through file sharing networks using the Kazaa peer-to-peer application. It comes in files with meaningful names that trick the user into downloading and opening them.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 microsoftscanreg.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareKazaaLocalContentDownloadDir=%Windir%scanregfilekazaaMySharedFolderHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMicrosoftScanreg=%Windir%microsoftscanreg.exe

Related Posts

Loading...