W32/Jhad Worm

 Information about the W32/Jhad Worm:

W32/Jhad is a worm. The worm will infect Windows systems. The worm spreads through mapped network drives.

Upon execution, the worm copies itself as Administrator.exe and taliban.exe in the AllUser'sProfile\Application Data folder.

It also copies itself using any of the following names, in the current folder and all the folders accessed on drives A to Z;

[random]Perjanjian Setan.exe
[random]My Surat penolakan cinta.exe
[random]Perbedaan Wanita dan Pria.exe
[random]%apLembutnya Hati Wanita.exe
[random]wiTak ada perjanjian dalam cinta.exe

The worm modifies registry at the following locations;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN

It also creates oeminfo.ini and oemlogo.bmp in the Windows System folder.

The worm creates C:\Documents and Settings\Administrator\My Documents\As Slam Bey.txt and opens it with the default text file viewer, displaying the following message:

**************************************************************************
* Cinta telah menyatukan [REMOVED] nyatukan cinta kita berdua.

Pademangan Barat 26 September 2006 16:45 wib

[REMOVED]

This worm first appeared on December 26, 2006.

 Other names of W32/Jhad Worm:

This Worm is also known as W32.Jhad.