WM97/Killboot-A

Discussion in 'malware problems & news' started by Technodrome, Jan 6, 2003.

Thread Status:
Not open for further replies.
  1. Technodrome

    Technodrome Security Expert

    Joined:
    Feb 13, 2002
    Posts:
    2,140
    Location:
    New York
    WM97/Killboot-A disables the Macro warning dialog box and removes the "Security" option from the Tools|Macro menu.

    WM97/Killboot-A drops setver.exe and an autoexec.bat file to C:\ (both files are detected as Troj/Killboot-A). The autoexec.bat file runs setver.exe on the next startup.

    WM97/Killboot-A sets the trigger date for Troj/Killboot-A. The trigger date is usually 29th,30th or 31st of the month after the initial infection.

    http://www.sophos.com



    Technodrome
     
Thread Status:
Not open for further replies.