SecurityRisk.First4DRM

Updated: February 13, 2007 11:47:04 AM

Type: Other

Publisher: First 4 Internet Ltd.

Risk Impact: High

File Names: aries.sys

Systems Affected: Windows 2000, Windows NT, Windows Server 2003, Windows XP

When SecurityRisk.First4DRM is executed, it performs the following actions:

Copies itself as the following file:

%System%\$sys$filesystem\aries.sys.

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the following registry subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\$sys$aries

which loads the risk as a device driver when the compromised computer is started.
Hides any processes, files, folders, or registry subkeys that begin with the following string:

$sys$
Checks the name of all processes attempting to access these processes, files, folders, or registry subkeys. If the name of the process begins with the following string, it allows access:

$sys$

Otherwise, the risk prevents access to the process, file, folder, or registry subkey.

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}