W32/Sankezu.A Worm

 Information about the W32/Sankezu.A Worm:

W32/Sankezu.A is a worm. The worm will infect Windows systems and spreads via physical and removable drives.

Upon execution, the worm copies itself as:

Isass.exe in the Windows System\3076 folder,
system.exe in the Windows System\dllcache folder,
EjaMyVE.exe in the Windows folder.

The worm uses the standard Windows folder icon to trick users that it is a normal folder and then sets its attribute to Hidden.

The worm modifies registry at the following locations to load itself during each startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It creates the following registry keys to disable Registry Editor:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DisableRegedit
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DisableRegistryTools

The worm also attempts to delete the following registry tools:

regedit.exe from %Windows% folder,
msconfig.exe from %Windows%\pchealth\helpctr\binaries folder.

The worm modifies the following registry entries to hide files with both System and Read-only attributes:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden = "0"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL DefaultValue = "1"

It also creates the following registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\ CurrentVersion\Policies\Explorer\NoFolderOptions

The worm propagates by dropping copies of itself in all physical and removable drives as NEW FOLDER.EXE

This worm first appeared on June 25, 2008.

 Other names of W32/Sankezu.A Worm:

This Worm is also known as WORM_SANKEZU.A.