Virus.Win32.HLLP.Alcaul.g, Win32.HLLP.Alcaul.g, W32/Alcop.ao, W32.Sand.6144, Win32.HLLP.Alcopaul.16384
PE_SANICH.A, W32/HLLP.Alcaul.G1, W32/Alcaul.G, Win32:Alcaul-G12, Win32/Alcopaul
Category: Computer Virus
Active & Spreading
Asia, North and South America, and some parts of Europe and Australia
02 Oct 2002
W32/Sand.6144 is a virus that propagates to executable files residing in the same folder as the virus. One variant also deletes the infected file if it doesn't find files to infect. The virus affects Windows OS such as Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, and Windows XP.
W32.Sand.6144 Removal Tool
If you have Malware on your computer it will cause annoyances and will damage your system. You should either:
A. Manually remove the infected files from your computer, or
B. Automatically scan your system using trusted software
We recommend that you scan your system for malware. Our partner has a computer virus removal tool to automatically clean W32.Sand.6144 from your computer.
More details about W32.Sand.6144
W32.Sand.6144 belongs to a family of viruses. The known variants do the process of infecting your system. The first one is the Variant A. When variant A runs an infected file, it creates and runs Kam.exe, which is the original, clean file. It finds executable files in the current folder until it finds a file that is not infected and prepends itself to that file and appends the infection marker. If it does not find a file to infect, it creates and runs Kamikaze.vbs, which attempts to delete the infected file. Second is the Variant B. When this variant runs an infected file, it creates and runs Yang.exe, which is the original, clean file and displays a message “yinyang”. It searches for .exe files in the current folder until it finds a file that is not infected; it then prepends and appends itself to that file.
The W32.Sand.6144 application distributes copies of itself on the user’s computer and network shares. The application spreads its replicates on computers connected to the local network. It searches for executable files on accessible drives and shared folders on the network. The application has polymorphic functions. The W32.Sand.6144 program searches for executable files stored on the computer. It replaces these executable files with a copy of itself. To remove W32.Sand.6144, update your virus definition and run a full system scan. When the scan application is done, delete the files detected as W32.Sand.6144. Replace the deleted files from a backup copy if you have or reinstall them.