Effect
Upon infection, the worm saves a copy of its DLL form to a random filename in the Windows system folder, then arranges to load itself thereafter at boot as a system service with a randomly generated name.[4]
Variant C of the worm resets System Restore points and disables a number of system services such as Windows Automatic Update, Windows Security Center, Windows DefenderWindows Error Reporting.[16] Processes matching a predefined list of antiviral, diagnostic or system patching tools are watched for and terminated.[17] An in-memory patch is also applied to the system resolver DLL to block lookups of hostnames related to antivirus software vendors and the Windows Update service.[13] and
Symptoms
- Account lockout policies being reset automatically.
- Certain Microsoft Windows services such as Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender and Error Reporting Services disabled.
- Domain controllers responding slowly to client requests.
- Congestion on local area networks.
- Web sites related to antivirus software or the Windows Update service becoming inaccessible.[18]
