Win32/Lanc [Threat Name] go to Threat

Win32/Lanc.A [Threat Variant Name]

Win32/Lanc.A is a prepending virus .

When executed, the virus copies itself into the following location:

The following Registry entry is set:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
- "HideFileExt" = 1

Win32/Lanc.A is a prepending virus .

The virus searches local drives for files with the following file extensions:

When the virus finds a file matching the search criteria, it creates a new copy of itself.

The name of the new file is based on the name of the file found in the search.

The filename has the following extension:

The original .doc file is appended to the newly created .exe file.

The virus deletes the .doc file.

When the infected file is executed, the original file is dropped to %temp%\%original_filename% .

The file is then executed.

The virus creates the following files:

A string with variable content is used instead of %random1-2% .