Home Malware Programs Worms W32.Nokpuda@mm

W32.Nokpuda@mm

Posted: May 11, 2011

W32.Nokpuda@mm is a self-replicating computer worm that can spread itself without any user interruption. W32.Nokpuda@mm can create an entry to launch itself automatically when you start up the computer system. W32.Nokpuda@mm propagates through network drives, removable drives, email, and file-sharing networks. W32.Minudazash can steal confidential data and enable a remote criminal get control of the computer using a backdoor port. Remove W32.Nokpuda@mm as quickly as possible to protect your computer.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Windir%\Help\Temp.exe
    2 %Windir%\wscntfy.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\"LowRiskFileTypes" = ".exe;.chm;.kno"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\"ModRiskFileTypes" = ".doc;.pdf;.xls;.exe;.kno"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"SystemRegistryRepair" = "%Windir%\Help\temp.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ActiveErrorLog\"StubPath" = "%Windir%\Help\temp.exe Restart"HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%CurrentFolder%\[ORIGINALLY EXECUTED FILE]" = "%CurrentFolder%\[ORIGINALLY EXECUTED FILE]:*:Enabled:Windows Time Sync"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\wscntfy.exe" = "%Windir%\wscntfy.exe:*:Enabled:Windows Time Sync"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"DesktopSecurityGuard" = "%Windir%\wscntfy.exe"
Loading...