MS Excel virus

Date: July 22, 2007
Source: net-security.org


It is very easy to know when Pahooka.A has infected a computer. Once run, it replaces the computer’s desktop wallpaper with a multicolored star on a blue background and copies itself to all mapped drives. Finally, it changes the caption of all the windows opened by the user, showing the text “^_^Anti AntiVirus^_^”.

The worm drops a file that contains code to eliminate the content of folders belonging to certain antivirus programs.

Also, Pahooka.A changes the registry so that it hides the Search and Run options in the start menu, the Folder options, the Control Panel options, and the Network Connections and Printers and Faxes options. It also prevents users from enabling, disabling or modifying the system restore settings. Plus, it disables the registry editor and the task manager.
Original article

---

Add comment  Email to a Friend