Threat Descriptions

Fujack.K

Classification

Category :

Malware

Type :

Worm

Platform :

W32

Aliases :

Fujack.K

Summary

Fujack.K is a virus and a network worm. It infects executable files with certain extensions by prepending its body to these files. It also infects webpages by appending an IFrame tag and a malicious URL to them. The worm actively spreads to external media, for example to USB drives or network drives. It attempts to perform a dictionary attack in order to break weak network share passwords. In addition, the worm kills processes belonging to anti-virus and security software as well as processes of the Task Manager and Registry Editor. The worm can download and run malicious files from a website. Fujack.K was possibly created by the author of the Viking virus-worm.

Removal

Disinfection of the Fujack.K virus-worm should be performed as follows:

  • Disconnect a computer or local network from the Internet.
  • Disable network sharing or set strong passwords for all shares.
  • Select the "Disinfect Automatically" action for F-Secure Anti-Virus real-time scanners on all computers. With "Disinfect Automatically" selected, F-Secure Anti-Virus will disinfect files that a virus tries to infect over a network (if sharing was not disabled).
  • Scan all files on all drives on all computers and MANUALLY select the "Disinfect" action to disinfect all infected files and to rename the virus droppers. DO NOT select automatic disinfection option after the scan!
  • Restart all disinfected computers.
  • Scan all hard drives on disinfected computers again to make sure that no more infected files are left. If needed, repeat disinfection procedure.
  • Disinfect all infected computers connected on the network.
  • Enable network sharing, keep strong share passwords.
  • Reconnect the disinfected computer or local network to the Internet.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

N/A