Virus alerts for April 2006
By the time you receive the e-mail 'virus alert' it can be too late!
We stock the most efficient anti virus program which checks for updates hourly.
Contact Us for a free antivirus trial to the end of this month.
Netsky is still infecting computers after being first discovered in April 2004. To remove some viruses it is advisable to turn off System Restore. April 21 2006 W32.Banleed.A Discovered on: April 20, 2006 W32.Banleed.A is a network worm that spreads on shared drive and folders. It steals confidential information and accounts when users contact a bank Web site. The worm may download and execute remote files and send gathered information to a remote host. Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP When W32.Banleed.A is executed, it performs the following actions: 1. Copies itself as the following file: C:\Windows\system.exe 2. Checks for the presence of the following file and stops the execution if that file exists: C:\halt.txt 3. Adds the value: "[FILENAME]" = "[PATH TO WORM]" to the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 4. Creates and executes the following batch file to enumerate all the hosts in network shares of the infected machine: C:\Windows\system.bat 5. Creates the following files: * C:\Windows\view.txt - output of system.bat 6. Attempts to spread across local network shares by copying itself on the startup folder of remote machines found. The worm tries to copy its executable in the following remote folder: \[NETWORK_HOST]\C$\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar NOTE: The worm uses a hardcoded path during its replication so that it will work only Brazilian/Spanish Windows machines. 7. Updates its code by downloading a configuration file from the following URL: [http://]www.rulandocash.net/upd/upd[REMOVED] The downloaded file contains the following configuration information: * version = [VERSION NUMBER] 8. Uses the configuration file to download the following remote file that at the time of writing was not available from the remote location: [http://]www.sinmadam.net/.%20/upd/lsas[REMOVED] 9. Saves the downloaded file as the following file and then executes it: c:\windows\system\NVSVC32.EXE 10. Monitors the browser windows of Internet Explorer and Firefox looking for any of the following bank URLs: * [https://]www2.bancobrasil.com.br/aapf/aai/logi[REMOVED] Depending on the URL entered into the browser, the worm hijacks the current browser window and displays its fraudulent Web page of the bank site. 11. Gathers this information and send it to a remote mail address, once the user enters his authentication information into the malicious Web page. 12. May contact the following remote site to retrieve the interenet IP address of the infected machine: [http://]checkip.dyndns.org Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NYXBM.E April 14 2006 Trojan.Lisentkey Trojan.Lisentkey is a Trojan horse that tries to log all keystrokes and send the information to an?FTP site. Trojan.Lisentkey is generated by Hacktool.Lisentkey. When Trojan.Lisentkey is executed, it performs the following actions. 1. Copies itself as the following file: %System%\[PREDETERMINED FILE NAME] Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP). 2. Creates the following temporary file: %System%\tempinfo.txt 3. Adds the value: "[PREDETERMINED VALUE]" = "%System%\[PREDETERMINED FILE NAME]" to the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ so that the Trojan runs every time Windows starts. 4. Logs all keystrokes and saves them into %System%\ 5. Sends the logged keystrokes and the following information to its creator via FTP: * OS version Contact Us for a free antivirus trial to the end of this month. NOTE: * Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates. Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NYXBM.E April 01 2006 Vulnerability Exploit - EXPL_TXTRANGE.A EXPL_TXTRANGE.A is a zero-day exploit that takes advantage of a vulnerability in the createTextRange Method call process in Internet Explorer. Exploiting this vulnerability enables a user to create a text range within an object. This exploit affects Internet Explorer 6.0 and Internet Explorer 7.0 Beta 2 (January Edition) running on Windows 98, ME, NT, 2000, XP, and Server 2003. This exploit causes an error in the mentioned text range, which is applied to a an affected system's memory and to execute arbitrary codes on the system. It can also download and execute malicious codes on the system. Zero-day exploits are termed as such because the unpatched vulnerability and its corresponding exploit code are released within the same day. This poses a threat whereby many computers may be affected due to the availability of exploit code, and the fact that vendors do not have much time to patch it. One malicious JavaScript that uses this exploit is detected as JS_DLOADER.BXR. Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NYXBM.E March 25 2006 If someone breaks into your house or car, they are a criminal!. If someone breaks into your computer are they a criminal? We say yes! Broadly defined, spyware is any software program that surreptitiously monitors and gathers user information. What was once written and installed only by malicious authors seeking to steal users' personal information, adware has emerged as a new and more prominent form of spyware. A slightly less malicious form of spyware, adware can display pop-up advertisements produced by so-called legitimate adware companies. Adware companies are well funded, to the extent that some have even discussed launching multi-million dollar IPOs. A narrow definition of spyware includes programs on a user's computer that report user behavior, such as keystrokes or Web browsing history. According to this definition, some types of spyware may be used for marketing purposes, while other types are used for the purpose of criminal fraud leading to profit making. We use both broad and narrow definitions of spyware. "A broad definition of spyware would include adware and Trojan spyware. Anything that interferes with the privacy, productivity, or security of your PC can be called spyware - with the caveat that it is non-propagating. Spyware stays on a system as long as it can without being noticed. Also, while viruses and worms are essentially about vandalism, broad-definition spyware is about monetary gain." The story of how the money flows in the spyware cycle involves four contributors or sources. First are the advertisers themselves, and second are the agents they hire to market their products. Third in the spyware food chain is the publishers, the writers of the program 'payload', the crimeware or grayware that actually gets delivered to the user's computer. Fourth are the distributors, who often distribute multiple payloads for a variety of publishers, since they earn their money on a "per install" basis. The trend is likely to continue in 2006 and beyond. Adware-driven campaigns can generate significant amounts of money, and many adware companies are eager to have their products installed in as many PCs as possible. As the threat of spyware and adware continues to grow, it becomes even more critical for computer users to scan any program downloaded through the Internet - including any downloads from P2P networks (peer to peer), via the Web, or any FTP server, regardless of the source - with updated anti-virus and anti-spyware software. Contact Us for a free antivirus trial to the end of this month. 1. WORM_NYXEM.E |
