Home Malware Programs Worms Svich

Svich

Posted: June 11, 2010

Svich is a computer worm that may be delivered through Yahoo instant messenger. Svich has been known to hijack the instant messenger application and then spams a users' contacts with links that if clicked on will redirect them to a malicious site.

Svich can also download and install other malware without notification to the computer user. Svich loads at start of Windows and is able to block Task Manager making it very difficult to remove. Svich may spread through removable media. It is very important that a spyware removal tool be used to completely remove the Svich worm.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\autorun.ini
    2 %Windir%\system3_.exe
    3 %Windir%\Tasks\At1.job

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MainHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MainHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Related Posts

Loading...