Home / malware

PDF

Worm:JS/Proslikefan.gen!lnk

First posted on 28 June 2013.
Source: Microsoft

Aliases :

Worm:JS/Proslikefan.gen!lnk is also known as Trojan.WinLNK.Generic (Kaspersky), LNK/Agent.R (ESET), Mal/DorkLnk-A (Sophos), Worm.JS.Proslikefan (Ikarus).

Explanation :

Worm:JS/Proslikefan.gen!lnk is a detection for the shortcut files (.LNK) modified by a variant of the Proslikefan family of worms, such as Worm:JS/Proslikefan.gen!E. These worms can change your system settings and disable antivirus and security products.

The worm modifies all shortcut files that are located on your Desktop so that when you open the shortcut a copy of the worm will run, as well as the original program. The modification may be hard to notice since the shortcut will still perform its original function.

For example, if the shortcut is supposed to start Notepad, it will first run a copy of the worm and then run Notepad.



Analysis by Stefan Sellmer

Last update 28 June 2013

 

TOP