U disk, such as HIV through removable storage devices such as the characteristics of the spread, but also have a stronger self-protection features such as new features. Variants running, will be infected computer’s operating system under the system directory and run the two generating the virus executable file (for svchost.exe and winlogon.exe), the two documents were the same processes and systems.
At the same time, the variant of the use of multi-process protection, that is, if a process which has been terminated, then the other one or more of the process will be the immediate implementation of a mandatory shut down the operating system’s instructions, to avoid the system of killing anti-virus software to The purpose of self-protection.
In addition, the variants will continue with the infected system to all the root directory of the disk partition to write an executable file (svchost.exe) and a configuration file (autorun.inf). Once computer users to click on any letter, we will start to run the variants. The variant also by modifying the system registry startup items, making variants with the computer system and automatically start running.