Overview
Characteristics
W32/Tufik is virus which infects .exe files.
Upon execution, it copies itself to %WinDir%\alg.exe, then kills itself.
It creates the process alg.exe.
It connects a remote URL to download updated variants of itself and additional malware. The downloaded file is saved as %WinDir%\svchost.exe
(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)
It creates the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\lsass="%WinDir%\alg.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\svchost="%WinDir%\svchost.exe"
The virus infects.exe files by prepending itself.
It can proprogate via network shares or removable drives by infecting the .exe files in the shared folders or in the removable drives.
Symptoms
-registry keys added by the virus as described above
-processes created by the virus as described above
Method of Infection
W32/Tufik is a virus that infects PE and spreads over floppy drive and other removable devices and network shares. It can also be downloaded through another malware or variant.
Removal
Variants