Computer Crime Research Center


MS Excel virus

Date: July 22, 2007

It is very easy to know when Pahooka.A has infected a computer. Once run, it replaces the computer’s desktop wallpaper with a multicolored star on a blue background and copies itself to all mapped drives. Finally, it changes the caption of all the windows opened by the user, showing the text “^_^Anti AntiVirus^_^”.

The worm drops a file that contains code to eliminate the content of folders belonging to certain antivirus programs.

Also, Pahooka.A changes the registry so that it hides the Search and Run options in the start menu, the Folder options, the Control Panel options, and the Network Connections and Printers and Faxes options. It also prevents users from enabling, disabling or modifying the system restore settings. Plus, it disables the registry editor and the task manager.
Original article

Add comment  Email to a Friend

Copyright © 2001-2013 Computer Crime Research Center
CCRC logo