W32/Linkfars is a worm. The worm will infect Windows systems and spreads through removable drives, shared folders and file-sharing application folder.

The worm will arrive as a dropped file from the network or removable drive.

Upon execution, the worm copies itself as SexGame.exe, SexScreenSaver.scr, MSshare.exe, Soundmax.exe and SexGameList.pif in the ProgramFiles folder and OfficeUpdate in the Windows folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

It also copies autoply.exe and autorun.inf in the removable drives.

This worm first appeared on November 05, 2007.

 Other names of W32/Linkfars Worm:

This Worm is also known as W32.Linkfars.