Prozac Online Buy Antabuse Cipro Online Buy Cymbalta Toprol XL Online Buy Cipro Elimite Online Buy Neurontin Nexium Online Buy Seroquel

Worm.Brontok is an e-mail worm that spreads through the Internet as an attachment to a message that might read the following:

From: “angelina_ph@[recipient's domain]” or “jennifer_sh@[recipient's domain]”
Subject: “Fotoku yg Paling Cantik” or “My Best Photo”
Message text:
“Hi,
Aku lg iseng aja pengen kirim foto ke kamu.
Jangan lupain aku ya !.
Thanks”
or
“Hi,
I want to share my photo with you.
Wishing you all the best.
Regards,”
Attachment name: Photo.zip

As soon as the infected file is first launched, there will be a Windows Explorer window displayed with an open ‘My Pictures’ folder. Once installed, this parasite will modify registry entries and disable system registry tools and the command line to avoid being deleted manually. Worm.Brontok has also the ability to turn off anti-virus applications thus decreasing security system settings severely. Worm.Brontok can bring nothing but chaos to your machine and therefore it should be deleted from your computer as soon as possible.

Automated Detection for Worm.Brontok

Worm.Brontok Manual Removal Instructions

Stop Worm.Brontok system processes:

EKSPLORASI.EXE
BRONSTAB.EXE

Remove Worm.Brontok files:

\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\winlogon.exe.
\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\smss.exe,
\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\services.exe,
\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\lsass.exe,
\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\inetinfo.exe,
\\Documents and Settings\\{User Name}\\Local Settings\\Application Data\\csrss.exe,
\\Documents and Settings\\{User Name}\\Templates\\WowTumpeh.com f�jl,
\\Documents and Settings\\{User Name}\\Start Menu\\Programs\\Startup\\EMPTY.PIF,
EKSPLORASI.EXE
BRONSTAB.EXE
Tok-Cirrhatus
Tok-Cirrhatus-1761
Tok-Cirrhatus-1860

Remove Worm.Brontok registry values:

HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Tok-cirrhatus

Important Disclaimer

What is a Worm?

Worm.Brontok is a Worm.

A worm is a type of virus that replicates by resending itself as an e-mail attachment or as part of a network message. Unlike a regular computer virus, a worm is self-contained and does not need to be part of another program to duplicate itself. A worm hides in active memory and performs malicious acts, such as using parts of the computer’s system resources. Worms are usually invisible to the user and are designed to affect the computer’s performance. A worm take control of remote systems without any help from the users and can delete files, send documents via email, or encrypt files.

Worm.Brontok is related to:

  » No related posts

This entry was posted on Friday, February 1st, 2008 at 9:01 am and is filed under Worms. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.