Trojan.WeakAdam
(TR/Dropper.Gen, Possible_Otorun8, New Malware.bw, Worm:Win32/Autorun.LD
, Worm:Win32/Autorun.LD, Parser error, TR/Crypt.CFI.Gen, IM-Worm.Win32.Sohanad.gt, Cryp_Xed-6, W32/Autorun.worm.h)
Added to the Dr.Web virus database:
2007-05-21
Virus description added:
2007-05-30
Virus Type: Trojan program
Affected OS: Win95/98/Me/NT/2000/XP
Size: 28 876 bytes
Packed by: NSPACK
Technical Information
Written by Visual Basic
When virus start it creates its copies in Windows system folder. These copies have the following filenames TEMP1.exe, TEMP2.exe, AdamEva.exe.
Besides, it creates files Adam.Eva, XFlys.url in the such folders:
C:\Documents and Settings\All Users\Desktop\,
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\,
\%WINDIR%\Fonts\
\%WINDIR%\system32\
Moreover, creates the copy of TEMP1.exe in root folder of disk С:\
In order to ensure int startup virus creates in root folder file autorun.inf with attribute “Archive”, “Hidden” and “System”. These attributes also are assigned to files TEMP1.exe and TEMP2.exe.
Modifies system registry branch:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit:
"C:\WINDOWS\system32\AdamEva.exe"
Blocks both Task Manager’s call and registering.
Turns off image of hidden files.
Changes display format of system date. As a result, the user will see the following message: "LOVE hh:mm:ss tt"
" EVA LOVE ADAM? - http://www.microsoft.com" is displayed in Windows Media Player main window head.
Changes start page of Internet Explorer
Changes Internet Explorer heading, replacing it on "http://www.microsoft.com"
Sets registry branch values:
HKCU\Control Panel\International\s1159
"Adam"
HKCU\Control Panel\International\s2359
"Eva"
Completes performance of utility which displays active processes - Process Explorer
System Recovery information
1. Download free cure utility Dr.Web CureIt! from uninfected computer, which has an acces to Internet. This utility should be recorded onto external medium.
2. Turn off System Recovery Service.
3. Reboot infected computer in Safe Mode (F8 at Windows start)
4. Scan infected computer with Dr.Web CureIt!. Apply “Cure” for all detected objects.
5. Recover registry form the backup copy.
