|
|
Worm.P2P.Hofo Viruses Information
| Name: |
Worm.P2P.Hofo |
| Category: |
Viruses |
| Description:
|
Details
Worm.P2P.Hofox
Hofox is a worm that spreads via P2P networks. Hofax is a Windows PE exe file; written in Visual Basic; about 49K in size.
During launch, the worm blocks the Norton Antivirus Auto Protect Service
Installation
Hofax registers itself as a launched application in the system registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunworm
It then copies itself into:
C:My shared folder under the following names:
Norton Anti-Virus 2004.exe
How To Hack.doc.exe
Win XP Pro .exe
Windows Longhorn full beta version.exe
Norton Anti-Virus keygen.exe
Hotmail H4x0r.exe
Halo - Combat Evolced.exe
DivX Pro .exe
Super Encrypt.exe
PornViewer.exe
Panda internet security.exe
Paint Shop Pro 8.exe
Paint Shop Pro 9 beta.exe
McAfee Anti-Virus.exe
C:WindowsSystem32 under the following names:
Norton Anti-Virus.exe
Halo.exe
Dunno.exe
Your Ad Here.exe
Girls Peeing.exe
Hacking is fun.exe
Program FilesAccessories/Your Gay.exe
Manifestations
Launches:
charmap.exe and notepad.exe
Internet Explorer and connects to: http://www.ratemypoo.com
Destructive behaviour
Deletes files with the following extensions:
*.jpg
*.gif
*.mov
*.mpg
*.mpeg
*.avi
*.doc
*.pdf
*.txt,/ul> |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Macro.Word97.Attentio
BWME.Gangi.113
BetaBoys Famil
DS.512.
Macro.Word97.FootPrin
Macro.Word97.Steroi
Mul.44
Teacher.200
Backdoor.Netbu
Mordor.53
|
|
