Refine Search
Threat Encyclopedia
W32/Qaz.A
Analysis
- Virus is 32bit with a size of 120,320 bytes
- Virus makes use of the NetBIOS transport protocol,
thus if this protocol is not installed, it is not
a threat for spreading within networks
- Virus seeks systems which offer a full share of
their drive, across NetBIOS networks looking for writable
shares, particularly the Windows folder
- The virus first renames existing NOTEPAD.EXE
to NOTE.COM
- The virus then writes itself to the Windows
folder as NOTEPAD.EXE
- When NOTEPAD is next executed, it will make
a call to NOTE.COM to initiate the real Notepad
application and then it will modify the registry
to run at Windows startup -
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run\
StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
- The virus first renames existing NOTEPAD.EXE
to NOTE.COM
- Virus opens a connection on the Internet in TCP
port 7597, awaiting commands from a hacker
