Spam Laws HOME

The Latest virus to attack PCs is W32/Tufik. W32/Tufik is a virus that infects PCs and manages to go from one PC to another by means of a removable drive or network sharing device. It is considered a low risk but can be a nuisance. It was discovered on 12/6/2007 and this virus seems to attack .exe files. [br][br]When the virus executes, it will copy itself to %WinDir%\alg.exe, then kills itself. After it kills itself the alg.exe file is recreated but with the new code the virus created. After it has formed, it will immediately connect to a remote URL so it can download an updated version of itself. The fownload file will have a file name as %winDir%\svchost.exe. In this case the %WinDir% is the default Windows directory (C:\WINNT, C:\WINDOWS etc.)[br][br]When the virus runs it automatically creates the following registry keys: [br][br][ul][li]HKEY_LOCAL_MACHINE\SOFTWARE\
Microsoft\Windows\CurrentVersion\policies\Ex
plorer\Run\lsass="%WinDir%\alg.exe"[/li][li]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window
s\CurrentVersion\policies\Explorer\Run\svcho
st="%WinDir%\svchost.exe"[br][/li][/ul][br]A
fter
the virus attacks one .exe file, it will attach itself to other .exe files and infect them as well, repeating the duplication process again and again until eventually all .exe files are infected. [br][br]

Reply

The Latest virus to attack PCs is W32/Tufik. W32/Tufik is a virus[br]that infects PCs and manages to go from one PC to another by[br]means of a removable drive or network sharing device. It is[br]considered a low risk but can be a nuisance. It was discovered on[br]12/6/2007 and this virus seems to attack .exe files. [br][br]When the virus executes, it will copy itself to %WinDir%\alg.exe,[br]then kills itself. After it kills itself the alg.exe file is recreated but with[br]the new code the virus created. After it has formed, it will[br]immediately connect to a remote URL so it can download an[br]updated version of itself. The fownload file will have a file name as[br]%winDir%\svchost.exe. In this case the %WinDir% is the default[br]Windows directory (C:\WINNT, C:\WINDOWS etc.)[br][br]When the virus runs it automatically creates the following registry[br]keys: [br][br]HKEY_LOCAL_MACHINE\SOFTWARE\Micros
oft\Windows\[br]CurrentVersion\policies\Ex
plorer\Run\lsass="%WinDir%\alg.exe"[br][br
]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Win
dows\[br]CurrentVersion\policies\Explorer\
Run\svchost="%WinDir%\svchost.exe"[br][br]
After
the virus attacks one .exe file, it will attach itself to other .exe[br]files and infect them as well, repeating the duplication process again[br]and again until eventually all .exe files are infected. [br][br]

Reply