Note:Win95/98/me default %windir% is C:\windows
WinNT/2000/XP/2003 default %windir% is C:\Winnt
1.Close the Windows firewall
2.Download malicious files
3.Makes the speed of the computer slow down.
●After executing virus, it will create following files to %Windir% folder:
\twex.exe
●Add following value to the registry. The virus will run while Windows starting.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Winlogon\Userinit="C:\WINDOWS\system32\userinit.exe,"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Winlogon\Userinit="C:\WINDOWS\system32\userinit.exe,
C:\WINDOWS\system32\twex.exe,"
|