Worm:Win32/Mevon.A

System Changes

• The presence of the following files:
  %windir%\svchost.exe
  c:\recycler\ntdetect.exe
  <system folder>\taskmgr.exe
  <system folder>\drivers\etc\proceso inactivo del sistema.com
  c:\documents and settings\administrator\application data\services.exe
  c:\documents and settings\administrator\application data\winlogon.exe
• The presence of the following registry modifications:
  
Sets value "CTFMON.EXE"
With data: "%windir%\svchost.exe"
To subkey: HKLM\Software\Microsoft\windows\CurrentVersion\Run

Sets value: "Shell"
With data: "explorer.exe c:\recycler\ntdetect.exe"
To subkey: HKLM\SOFTWARE\Microsoft\windows NT\CurrentVersion\winlogon
 
Sets value: "DisableRegistryTools"
With data: "1"
To subkey: HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\System

Sets value: "NoFolderOptions"
With data: "1"
To subkey:
HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer
 
Sets value: "NoFind"
With data: "1"
To subkey: HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer

Sets value: "DisableTaskMgr"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\System

Sets value: "DisableRegistryTools"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\System

Sets value: "NoFolderOptions"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer

Sets value: "NoFind"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer

Sets value: "Hidden"
With data: "2"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Explorer\Advanced

Sets value: "ShowSuperHidden"
With data: "0"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Explorer\Advanced

Sets value: "HideFileExt"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Explorer\Advanced

Sets value: "NoRecycleFiles"
With data: "1"
To subkey: HKCU\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer