W32/VB.Hc Worm

 Information about the W32/VB.Hc Worm:

W32/VB.Hc is a worm. The worm will infect Windows systems.

Upon execution, the worm copies itself as:

scvhost.exe in the Windows and Windows System folder,
SCVHOST.EXE-27510296.pf in the WINDOWS\Prefetch folder,
astry.exe in the WINDOWS folder
netwin.exe in the WINDOWS\Network-IPv6 and Documents and Settings\%Current User% folder
explorer.exe in the Windows Temp folder.

It modifies the registry at the following location to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_USERS\S-1-5-21-1935655697-1417001333-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\NetworkDriver
HKEY_USERS\S-1-5-21-1935655697-1417001333-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\Network IPv6

The worm also modifies the registry to disable RegistryTools, Regedit, Taskmanager and change default folder options.

The worm also changes the Windows Explorer Tips to Indonesia text or "Iloveu astry and never forget you".

This worm first appeared on December 28, 2007.

 Other names of W32/VB.Hc Worm:

This Worm is also known as Worm.Win32.Vb.hc.