Safook is a worm that spreads through unprotected network shares by infecting executable files in them. Once such a file is executed, the parasite gets secretly installed to the system. Then it runs a spreading routine and a payload. Safook downloads and installs another threat. It automatically runs on every Windows startup.