WORM_RUSSOTURI.H

This worm may be dropped by other malware. It may also be downloaded unknowingly by a user when visiting malicious Web sites.

This worm creates a registry entry to enable its automatic execution at every system startup.

Once this worm is executed, it copies itself to all folders it locates in the system. It uses the name of the folder as its file name. It then proceeds to delete all files when the system date is either December 13, or any Friday that falls on the 13th day of any month.

This worm drops copies of itself in all physical and removable drives.

Related Items