Virus:Win32/Nakuru.A

Virus:Win32/Nakuru.A is a prepending virus that infect files with .DOC and .XLS extensions.

Virus:Win32/Nakuru.A drops the following files, which are detected as this virus, in the system:

 

It then installs itself as a service so that it runs every time Windows starts:

 

Adds value: "Type"
With data: "dword:00000110"
Adds value: "Start"
With data: "dword:00000002"
Adds value: "ErrorControl"
With data: "dword:00000001"
Adds value: "ImagePath"
With data: "%sysdir%\kspoold.exe"
Adds value: "DisplayName"
With data: "K Print Spooler"
Adds value: "ObjectName"
With data: "LocalSystem"
To subkey: HKLM\SYSTEM\CurrentControlSet\Services\kspooldaemon

 

The file avmeter32.dll is injected into the explorer.exe process.

Virus:Win32/Nakuru.A infects files with .DOC and .XLS extensions. It prepends its code to host files and changes the extension from .DOc or .XLS to .EXE.

 

Upon execution of a file infected with this virus, the virus drops the two files indicated above (in the Installation section) to repeat the infection process. It then deletes its currently running copy and drops and runs the original clean file in the current folder.

Virus:Win32/Nakuru.A keeps a log of its activities in the file %windir%\Temp\KSPOOLD.TXT.

 

Here is an example of what the log file may contain:

 

10/16/2008 3:29:06 AM - K Print Spooler Service starting...
10/16/2008 3:29:06 AM - Scanner for drive C has been created and started
10/16/2008 3:29:06 AM - Scanner for drive D has been created and started
10/16/2008 3:29:06 AM - Scanner for drive E has been created and started
10/16/2008 3:29:06 AM - Scanner for drive F has been created and started
10/16/2008 3:29:06 AM - Scanner for drive G has been created and started
10/16/2008 3:29:06 AM - Scanner for drive H has been created and started
10/16/2008 3:29:06 AM - Scanner for drive I has been created and started
10/16/2008 3:29:06 AM - Scanner for drive J has been created and started
10/16/2008 3:29:06 AM - K Print Spooler Service started
10/16/2008 3:29:06 AM - Guardian process not exists, try create it
10/16/2008 3:29:06 AM - Explorer found (HWND: 65664) injecting it
10/16/2008 3:29:06 AM - Mencari di folder C:\
10/16/2008 3:29:06 AM - Guardian process created
10/16/2008 3:29:07 AM - Mencari di folder C:\Documents and Settings