Saturday, June 19, 2010

What is the brontok computer virus?

which antivirus software can eliminate it?



What is the brontok computer virus?virus protection software



Other names for this worm include: W32/Rontokbro.gen@MM, W32.Rontokbro@mm, BackDoor.Generic.1138, W32/Korbo-B, Worm/Brontok.a, Win32.Brontok.A@mm, Worm.Mytob.GH, W32/Brontok.C.worm, and Win32/Brontok.E, W32.Rontokbro.D@mm.



[edit] Description



Brontok Virus came from Indonesia. It arrives as an attachment of e-mail named kangen.exe ("kangen" word itself means "I miss you so much"). When Brontok is first run, it copies itself to the user's application data directory. It then sets itself to start up with Windows, by creating a registry entry in the HKLM\Software\Microsoft\Windows\CurrentV... registry key. It disables the Windows Registry Editor (regedit.exe)and modifies Windows Explorer settings. It removes the option of "Folder Options" in the Tools menu so that the hidden files, where it is concealed, are not easily accessible to the user. It also turns off Windows firewall. In some variants, when a window is found containing certain strings in the window title, the computer reboots. Using its own mailing engine, it sends itself to email addresses it finds on the computer, even faking the own user's email address as the sender. The computer also restarts when trying to open DOS window (Command Prompt) in Windows and prevents user from downloading files. It also pop ups the default Internet browser (usually Microsoft Windows Internet Explorer, Mozilla Firefox, Opera or Netscape) and loaded a web page (html) which is located in the My Pictures (or Pictures folder on Windows Vista) folder.

No comments:

Post a Comment