Home Malware Programs Worms Worm:Win32/Rotrumas.A

Worm:Win32/Rotrumas.A

Posted: December 5, 2012

Threat Metric

Threat Level: 2/10
Infected PCs: 92
First Seen: December 5, 2012
OS(es) Affected: Windows

Worm:Win32/Rotrumas.A is a worm that circulates via removable drives. Worm:Win32/Rotrumas.A may also replace detected picture files (JPG and JPEG) with its own picture and may remove contents of document files (DOC and XLS). Once installed on the affected PC, Worm:Win32/Rotrumas.A adds potentially malicious files and makes registry modifications. Worm:Win32/Rotrumas.A creates the certain registry entries so that its copy can load automatically every time you start Windows Worm:Win32/Rotrumas.A searches the affected PC for removable drives and, if found, adds a copy of itself in the root folder of the drive. Worm:Win32/Rotrumas.A also creates a malicious file to automatically launch its copy when the drive is accessed and if 'Autorun' is enabled. Worm:Win32/Rotrumas.A changes file and folder display settings. Worm:Win32/Rotrumas.A also changes certain settings in the way that files and folders are displayed in Windows Explorer. Worm:Win32/Rotrumas.A removes the Folder Options menu item from the Tools menu and displays hidden files and folders. Worm:Win32/Rotrumas.A steals information including email addresses from the corrupted PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



Autorun.inf File name: Autorun.inf
Mime Type: unknown/inf
Group: Malware file
CDROM.exe File name: CDROM.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
psador18.dll File name: psador18.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
[system folder]\deter177\sv[1 RANDOM CHARACTER]h[1 RANDOM CHARACTER]st.exe File name: [system folder]\deter177\sv[1 RANDOM CHARACTER]h[1 RANDOM CHARACTER]st.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
[system folder]\deter177\ctfmon.exe File name: [system folder]\deter177\ctfmon.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
[system folder]\deter177\[1 RANDOM CHARACTER]ht[1 RANDOM CHARACTER]msys19.exe File name: [system folder]\deter177\[1 RANDOM CHARACTER]ht[1 RANDOM CHARACTER]msys19.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
[system folder]\deter177\smss.exe File name: [system folder]\deter177\smss.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
[system folder]\deter177\lsass.exe File name: [system folder]\deter177\lsass.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "?ht?msys19.exe" = "[system folder]\ctfmon.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "lsass" = "[system folder]\deter177\lsass.exe"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "HideFileExt" "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "explorer.exe [system folder]\?ht?msys19.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "lsass" = "[system folder]\deter177\lsass.exe"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer "NoFolderOptions" "1"
Loading...