WORM_FUJACKS.HM

This worm arrives as a file downloaded unknowingly by a user when visiting malicious Web sites.

It drops and executes files/components.

It appends its code to infect target host files. It also infects certain file types and avoids folders with certain strings.

It searches the network for certain shares and attempts to drop copies of itself in the said shares. It uses a list of user names and passwords to access password-protected shares.

It drops copies of itself in all physical drives and removable drives. It also drops a certain file to automatically execute its dropped copies when the said drives are accessed.

It terminates certain services and processes if found on the system or in memory. It then closes application windows that contain certain strings. Moreover, it deletes autostart registry entries associated with the processes it terminates. It does the said routine to completely disable applications.

It attempts to connect to Web sites.

Related Items