Home Malware Programs Worms Popo

Popo

Posted: March 28, 2006

Popo is a worm that spreads by copying itself to all fixed, removable and remote drives, CDs and ramdisks.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 rundll.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHideFileExt=1HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMicrosoftService=rundll.exe

Related Posts

Loading...