Win32/Tifau

Win32/Tifau is a worm which searches for all drives on the infected computer system and then copies itself to their root folders. This allows Win32/Tifau to spread from one computer to the other by copying itself to removable drives, such as USB memory sticks or SD cards. Once installed on the victim's computer, Win32/Tifau creates a backdoor which allows a criminal to access the victim's computer from a remote location. Because of this ability to create a backdoor, Win32/Tifau is usually the first step in a dangerous malware attack, leaving an open backdoor through which a criminal can then install other malware that can be used to control the computer remotely. Win32/Tifau itself can receive instructions and updates from a remote location, as well as relaying information to the criminals by uploading to a remote server. If you suspect that Win32/Tifau has infected your computer system, ESG security researchers strongly recommend the use of a strong anti-malware application to safeguard your computer system.

How Win32/Tifau Attacks Your Computer System

Win32/Tifau drops various executable files into the system folder, as well as an autorun file which allows Win32/Tifau to start up automatically as soon as the contaminated drive is attached to a computer system. Win32/Tifau also makes various registry entries that allow Win32/Tifau to start up automatically when the victim launches Microsoft Windows. There are several versions of Win32/Tifau, each identified with a letter added to the worm's name (for example, Win32/Tifau.A or Win32/Tifau.B). The names of the dropped files vary from one version of Win32/Tifau to another. Win32/Tifau also adds an exception to the Windows Firewall, which allows Win32/Tifau send and receive data to/from a remote server. Once installed, Win32/Tifau will make copies of itself and add it to the root folders of all drives detected on the infected computer system, as well as creating an autorun.inf file which allows Win32/Tifau to start up automatically. Win32/Tifau can receive data over the Internet, using HTTP protocol to send and receive data from four different URLs. Win32/Tifau also has rudimentary self-defense mechanisms that allow Win32/Tifau to terminate the file processes associated with common anti-malware and anti-virus scanners. The backdoor Win32/Tifau Worm creates will often be used to install a dangerous rootkit on the victim's computer system which can then entirely disable any security software that is installed.