Virus alerts for April 2005 By the time you receive the e-mail 'virus alert' it can be too late! Contact Us for a one month free antivirus trial.
Apr 30 2005 More AHKER - WORM_AHKER.G WORM_NOPIR.B is a non-destructive, memory-resident worm that propagates via peer-to-peer networks. It searches for availabe peer-to-peer applications and then sends copies of itself to all available or online users. This worm is spreading in-the-wild and infecting computers running Windows 95, 98, ME, NT, 2000, and XP. Upon execution, this memory-resident worm creates the folder %Program Files%\Restore. It then drops a copy of itself in this folder as VXST.EXE. It also drops a copy of itself as This worm also creates several registry entries that perform the following: * Ensure its automoatic execution at every Windows startup This worm does not check for memory-residency, so multiple instances of it may run on a computer system. Contact Us for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. HTML_NETSKY.P Apr 23 2005 All About AHKER - WORM_AHKER.G WORM_AHKER.G is a non-destructive, memory-resident worm that propagates via email. It arrives as an email attachment that, upon execution, drops a file in the Windows folder. It also has the ability to spread copies of itself via peer-to-peer (P2P) file-sharing applications by dropping copies of itself into certain P2P application shared folders, making the dropped copies available for download to other users within the network. It uses file names that are mostly related to Hollywood stars, to entice users to unknowingly download copies of it. In addition, this worm is capable of terminating running applications on a system. WORM_AHKER.G runs on Windows 95, 98, ME, NT, 2000, and XP. Upon execution, it creates the following registry entries to ensure that it automatically executes during every Windows startup. This worm sends copies of itself via emai by using Message Application Protocol Interface (MAPI) functions. The email message that it sends contains the following details: From: (any of the following) Subject: (varying subjects) Message body: (any of the following) Attachments: (varying attachment file names) This worm is also capable of propagating via P2P file sharing networks by dropping copies of itself into certain P2P application shared folders, as follows: \BearShare\Shared It uses interesting file names to entice other users in the P2P networks, where a copy of itself can be downloaded as the following: Britney Spears Naked.exe This worm terminates several system processes and also disables applications on an affected system. In addition, the worm adds several entries in the system's HOSTS file, preventing the user from accessing certain Web sites, mostly related to antivirus and security companies. Contact Us for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1.TROJ_BAGLE.BH Apr 17 2005 Keeping Kelvir - WORM_KELVIR.N WORM_KELVIR.N is a non-destructive worm that propagates via MSN Messenger. It send a message to all contacts listed in the affected user's MSN Messenger Contacts, with a link. When clicked, this link downloads a file. This worm is currently spreading in-the-wild and infecting computers running Windows 95, 98, ME, NT, 2000, and XP. Upon arrival, this worm drops, extracts, and executes the following files: * UNCANNY.EXE – a copy of the worm This worm sends a message to all contacts in MSN Messenger with the following details: Never give out your password or credit card number in an instant message conversation. its you! <link which downloads the file detected as WORM_SDBOT.BLL> Once the recipient clicks the link, the file ADVBOT.EXE is downloaded. Contact Us for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. TROJ_SMALL.AFG Apr 09 2005 Crowded House - WORM_CROWT.D WORM_CROWT.D is a non-destructive, memory-resident worm that spreads via email using its own Simple Mail Transfer Protocol (SMTP) engine to send email to those addresses found in the Windows Address Book. This worm has backdoor capabilities that could allow a remote user to perform malicious activities. It also modifies the Windows HOSTS File to prevent affected users from accessing specific Websites, including Trend Micro, McAfee, Kaspersky, F-Secure, Symantec, and Sophos. This worm is currently spreading in-the-wild, and infecting systems running Windows 95, 98, ME, NT, 2000, and XP. Upon execution, the worm opens the URL http://news.google.com, and drops the files SERVICES.EXE and SERVICES.DLL. The file SERVICES.EXE is a copy of the worm, which is executed at every system startup. The worm's DLL component, SERVICES.DLL, contains a routine that attempts to send copies of itself via email using its own Simple Mail Transfer Protocol (SMTP) engine to email addresses found in the Windows Address Book (WAB). The email message body may contain information gathered from the Google Web page. This worm also has backdoor capabilities, which may allow a remote user to execute the following malicious commands: * Copy files The worm also performs a HOSTS file modification routine that results in a user being blocked from accessing specific Web sites, and instead being redirected to a specific IP address. NOTE: Our web site is NOT on this list! The following sites are inaccessible to affected users due to this modification routine: * uk.trendmicro-europe.com If you would like to scan your computer for WORM_KRYNOS.B or thousands of other worms Contact Us for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. TROJ_SMALL.AFG Apr 07 2005 Like Kryptonite? - WORM_KRYNOS.B WORM_KRYNOS.B is a destructive, memory-resident worm that propagates via peer-to-peer applications by dropping a .ZIP copy of itself in a certain folder. It may also spread via email by sending itself as an attachment. This worm has backdoor capabilities, allowing remote users to access and perform malicious tasks on affected machines. It can also prevent affected users from accessing certain antivirus and security Web sites by modifying the HOSTS file. WORM_KRYNOS.B is currently spreading in-the-wild, and infecting computers running Windows NT, 2000, and XP. Upon execution, this memory-resident worm drops the following files in the Windows folder: * %Windows%\Help\svchost.dat It then displays the following message: It creates a registry entry that allows it to automatically execute the dropped file svchost.exe at every system startup. This worm propagates via P2P applications by making a .ZIP copy of itself in a specific folder -- the file name depends on the names of the currently saved files in that folder. The worm may also propagate by sending itself as an attachment to an email message. It searches files with the extensions HTM and TXT for target email addresses. However, it first queries www.google.com to check for an Internet connection, before it sends the email. The email it sends contains the following details: From: security@microsoft.com To: (recipient email address harvested from affected system) Subject: Microsoft Security Update Message body: Attachment: The worm avoids worm avoids sending email to addresses containing certain strings.. The following backdoor capabilities are enabled by the worm: Get, upload, download, or delete a file This worm also modifies the system's HOSTS, which contains the host name to IP address mappings. This modification prevents affected users from accessing specific sites related to antivirus companies. If you would like to scan your computer for WORM_KRYNOS.B or thousands of other worms, viruses, Trojans and malicious code, trial our antivirus for free. Contact Us for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P Contact Us for a one month free antivirus trial. 12website has a maintenance program for our clients to ensure their will not be 'let down' by an inefficient computer. Computer maintenance is necessary to keep your machine running smoothly without down time. |
