Aliases: W32.Torun.dr, Worm.W32.Torun
Variants: PE_TORUN.A

Classification: Malware
Category: Computer Virus

Status: Active & Spreading
Spreading: Slow
Geographical info: Asia, North and South America, and some parts of Europe and Australia
Removal: Easy
Platform: W32
Discovered: 28 Dec 2003
Damage: Low

Characteristics: The W32.Torun application infects files of .exe. The systems that are affected include Windows 95, Windows 2000, Windows Me, Windows 98, Windows XP and Windows NT.

More details about W32.Torun

Once the W32.Torun was executed it creates the %System%Rsv file having .dll extension that was detected as the W32.Torun having a .dr extension. The %System%Rsv is a variable used. The W32.Torun seeks the folder of the System and then replicates itself to that found location. This is the C:WindowsSystem32 (only Windows XP), C:WindowsSystem (Windows Me, Windows 98, and Windows 95), or even C:WinntSystem32 (Windows NT and Windows 2000). On the Windows Me, Windows 98 or Windows 95, the virus infects the %System%Wmiexe and %Windir%Notepad files having .exe extension. Then the virus will execute a Wmiexe having .exe extension. The virus seeks for the folder of the Windows installation and then replicates itself to the found location. This is the C:Winnt or the C:Windows by default.

On the Windows XP, Windows 2000, and Windows NT, the virus generates a file %Temp%Svchost having .exe extension and then an execution will be done. The Trojan will then seeks the temporary folder of the Windows and then replicates the files to the found location. If the LockDLL.dll file is not existing on your computer, there will be particular messages that will appear depending on what window you have for instances are the Windows Me or 98 or 95, and Windows XP or 2000 or NT. The virus also looks fro files that are executable and then replicates itself to these found files.