W32/Sillyban.A Worm

 Information about the W32/Sillyban.A Worm:

W32/Sillyban.A is a worm. The worm will infect Windows systems and spreads by copying itself to mapped drives.

Upon execution the worm creates the following files in the C:\heap41 folder

2.mp3
autorun.inf
drivelist.txt
Icon.ico
reproduce.txt
script1.txt
std.txt
svchost.exe
offspring\autorun.inf

It also creates the following files in the Windows temp\MicrosoftPowerPoint folder.

2.mp3
drivelist.txt
Icon.ico
Install.txt
pathlist.txt
svchost.exe

The worm modifies registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"status"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"winlogon"

It also modifies the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\"CheckedValue"

The worm copies itself as reproduce.txt in the root of all removable drives.

It also copies autorun.inf in the root of all removable drive so that it executes whenever the drive is accessed.

The worm monitors the title of the active window for the strings "orkut" and "youtube".

It displays the following message, if the above strings are found:

Message: (String) is BANNED you fool, The adminstrators didn't write this program guess who did??

The worm monitors the title of the active window for the string "Mozilla Firefox"

It displays the following message, if the above string is found:

Message: "USE INTERNET EXPLORER YOU DOPE, I DNT HATE MOZILLA BUT USE IE OR ELSE..."

The worm also closes the active window and then plays the c:\heap41\2.mp3 audio file.

This worm first appeared on October 22, 2007.

 Other names of W32/Sillyban.A Worm:

This Worm is also known as W32.Sillyban.A.