VBS/Roor-C Virus
Summary
Summary
Description- Advanced
| Name | VBS/Roor-C |
|---|---|
| Type | |
| How it spreads |
|
| Affected operating systems |
|
| Side effects |
|
| Aliases |
|
| Protection available since | 13 July 2005 13:12:17 (GMT) |
| Detected by | All versions of Sophos Anti-Virus |
| Included in our products from | September 2005 (3.97) |
Description
This section helps you to understand how it behaves
VBS/Roor-C is a virus that may infect HTML or text files.
VBS/Roor-C infects files with file extension HTM, HTML or HTT.
VBS/Roor-C drops the virus as FOLDER.HTT and an INI file DESKTOP.INI in various locations, including the root folder and the 'My Documents' folder. The virus may also spread to the root folder of other drives.
Advanced
- Summary
- Description
- Advanced
This section is for technical experts who want to know more.
VBS/Roor-C is a virus that may infect HTML or text files.
VBS/Roor-C infects files with file extension HTM, HTML or HTT.
VBS/Roor-C drops the virus as FOLDER.HTT and an INI file DESKTOP.INI in various locations, including the root folder and the 'My Documents' folder. The virus may also spread to the root folder of other drives.
VBS/Roor-C makes the following changes to the system registry:
HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
about:error
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs
error
http://<URL at geocities>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClassicShell
0
The virus deletes the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ExtShellViews
(5984FFE0-28D4-11CF-AE66-08002B2E1262)
|
