WORM_LEGMIR.CUJ

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It drops files/components detected by Trend Micro as the following

• TSPY_LEGMIR.CUJ
• RTKT_LEGMIR.CUJ

Note that the dropped copies are set with a Hidden attribute.

It creates registry entries to enable its automatic execution at every system startup.

It modifies registry entries to hide files with both System and Read-only attributes.

It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.

Related Items