Worm.Win32.Nuf

0

1. Terminate the process called

   This worm infects computers running under Windows. It spreads via poorly protected network resources.

   The worm itself is a PE EXE file. It is written in Microsof Visual C . The file is approximately 37KB in size. It is not packed in any way.

   Installation

   Once launched, the worm copies itself to the Windows system directory as "MSSHVC.exe":

   %System%\MSSHVC.exe

   The worm then registers itself in the system registry:

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "MSSHVC" = "%System%\MSSHVC.exe"

   This ensures that the worm will be launched each time Windows is booted on the victim machine.

   Propagation

   The worm uses a separate thread to search for accessible network resources in an unending cycle. It attempts to connect to computers on which the network resources are located.

   The worm uses the following user names and passwords:

   User name: admin
   system
   guest
   guestguest Password: 12345
   11111

   The worm then copies itself to accessible resources as "fun.exe” and terminates the connection.

   Removal instructions