Home Malware Programs Worms WORM_PALEVO.KK

WORM_PALEVO.KK

Posted: May 12, 2010

WORM_PALEVO.KK is a computer worm that may be downloaded from corrupt websites and other malware. WORM_PALEVO.KK can be downloaded unknowingly by a user when visiting these malicious sites. WORM_PALEVO.KK may also arrive via removable drives. WORM_PALEVO.KK creates folders and drops copies of itself. WORM_PALEVO.KK also displays images and creates registry entries to enable its automatic execution at every system startup. WORM_PALEVO.KK is difficult to detect and requires a reliable anti-spyware program for its removal.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System Root%\RECYCLER
    2 %System Root%\RECYCLER\{SID}
    3 %System Root%\RECYCLER\{SID}\Desktop.ini
    4 %System Root%\RECYCLER\{SID}\recycle.exe
    5 %User Temp%\setup32temp.exe
    6 {drive letter}:\U3ROM\Desktop.ini

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Microsoft\HKEY..\..\..\..{RegistryKeys}Windows NT\CurrentVersion\Winlogon = "Taskman = "%System Root%\RECYCLER\{SID}\recycle.exe""
Loading...