It passes itself off as a Word document in order to deceive users and make them think it is an inoffensive document. It carries out several modifications in the Windows Registry, which prevent the computer from working properly. It spreads through removable, shared and mapped drives.

Windows 2003/XP/2000/NT/ME/98/95

DisaCKT.B is a worm that carries out several modifications in the Windows Registry, which prevent the user from carrying out the following actions, among others:

• Doing searches in a fast and straight way, as it disables the option Search from the Start menu.
• Running files in a fast and straight way, as it disables the option Run from the Start menu.
• Viewing the processes that are being run through the Task Manager.
• Modifying the configuration of the features of the folders.

DisaCKT.B reaches the computer in a file that has the icon belonging to a Word document, in order to deceive users and make them think that it is an inoffensive document. It spreads through removable, shared and mapped drives, making copies of itself in them.

DisaCKT.B is easy to recognize once it has affected the computer, as it makes the following changes in the Start menu:

• It replaces the name of the Start button with NUM.
• It adds a copy of itself with the name Microsoft Office Word 2003.exe.

In the following image both modifications can be seen: