| Virus alerts for June 2005 Current virus alerts here.  |
We stock the most efficient anti virus program which checks for updates hourly
Contact Us for a one month free antivirus trial.
June 25 2005 - VBScript Worm - VBS_IPNUKER.A VBS_IPNUKER.A is a non-destructive, non-memory resident worm that propagates only during the months of January, June, and December. It can propagate through email messages and Internet Relay Chat (IRC). This worm is currently spreading in-the-wild and infecting systems that run Windows 98, ME, NT, 2000, XP. Upon execution, this VBscript switches the functions of the affected machine's mouse buttons and changes the icons for such file types as MPEG, MP3, JPEG, and TXT. It also deletes the application, Norton Antivirus, from the Program files folder. It uses MAPI commands to propagate itself and to gather email addresses stored in the affected system. It then sends out an email to the gathered addresses. Upon arrival, this Visual Basic script (VBscript) drops the following files: %Windows%\favorites\ipnuker.url (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.) It also creates a registry entry to enable its execution at every system startup and deletes these types of files: .BAT, .TXT, and .VBS. Contact Us for a free antivirus trial to the end of this month. VBS_IPNUKER.A is detected and cleaned by Eset NOD32 antivirus. Top 10 Most Prevalent Global Malware 1. JAVA_BYTEVER.A June 18 2005 - MSN Messenger Worm - WORM_HARWIG.B WORM_HARWIG.B is a non-destructive, memory-resident worm that propagates via MSN Messenger. It sends a message to all available online contacts, with a message containing a link that points to a copy of the worm. This worm is currently spreading in-the-wild and infecting systems that run Windows 95, 98, ME, 2000, and XP. Upon execution, this worm drops a temporary copy of itself in the root folder, checks for the existence of MSN Messenger. If found, it executes the application and attempts to log on as the default user or current user. Upon successful login, it sends a message containing a link that points to a copy of the worm. If MSN Messenger is not present on a system, the worm copies itself in the Windows folder with the file name ABCDEFG.EXE. It adds a registry entry that allows it to automatically execute at every Windows system startup, and drops an Internet Relay Chat (IRC) BOT file named PROXY.EXE in the Windows system folder. Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P June 11 2005 - Bobbing for BOBAX - WORM_BOBAX.P On June 3 Antivirus Agency declared a medium risk alert in order to control the spread of WORM_BOBAX.P. Antivirus Agency has received several infection reports indicating that this malware is currently spreading in-the-wild in the United States, Singapore, Ireland, Peru, Japan, Australia, and India. This memory-resident worm infects Windows 98, ME, NT, 2000, and XP. This is a blended threat, using a Trojan/Worm combination. The worm spreads by attaching TROJ_SMALL.AHE to an email message that it sends using its own SMTP engine. When the trojan is executed on a user’s system it downloads WORM_BOBAX.P. Like many worms, this malware takes advantage of the LSASS vulnerability in the Windows Operating System. Similar to the TROJAN/WORM_BAGLE combination WORM_BOBAX.P propogates in the following manner: * TROJ_SMALL.AHE is mass-mailed TROJ_SMALL.AHE, which is the seeding portion of the malware, utilizes a common social engineering technique that promises breaking news regarding current world events. This malware promises a story – and pictures – on hoaxes such as the capture of Osama bin Laden and the shooting death of Saddam Hussein, to lure the recipient into clicking on the file. Clicking on the attachment causes the trojan to run in memory and eventually download the worm component from the predefined Web site. The worm then spreads to all contacts in the recipient’s address book. Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P June 04 2005 - Two MYTOBS - Antivirus Agency raised two MYTOB variants to yellow alert status this week – WORM_MYTOB.AR and WORM_MYTOB.BI. It has only been 90 days since antivirus experts detected the first variant of the MYTOB family of worms. Yet, since its detection on February 27, 2005, WORM_MYTOB has managed to register nearly 120 new variants and is responsible for more than 65,000 worldwide infections. These worms are nearly identical to previous MYTOB variants, which use the classic social engineering technique of posing as an e-mail administrator to entice users to execute the attachment in the mail. The malware attempts to fool the user into thinking that the email is about the suspension of his/her email account. And, as with all other variants, these memory-resident worms propagate by sending a copy of themselves as an attachment within an email message, which they send to target recipients using their own Simple Mail Transfer Protocol (SMTP) engine. The only difference between the “.AR” variant and the “.BI” variant is the name of the dropped file. But, there are three notable differences of “.AR” and “.BI”, versus their 115 MYTOB predecessors. These differences are: * They drop a copy of themselves as LIEN VAN DE KELDER.EXE or LIEN VAN DE KELDERRR.EXE (note, the only difference between the dropped file in the “.AR” It is believed that these variants are actually intended as a testing ground for future variants that will likely take advantage of the monetary offer of the adware (the site referred to in this variant is not believed to be one of those sites – it was likely just written by a fan of Ms. Van De Kelder). Contact Us for a free antivirus trial to the end of this month. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P June 03 2005 - WORM_BOBAX.P. This memory-resident worm usually arrives on a system as a downloaded file of TROJ_SMALL.AHE. It spreads by sending a copy of TROJ_SMALL.AHE as an attachment to an email message that it sends using its own Simple Mail Transfer Protocol (SMTP) engine. The message it sends out contains the following details: Subject: {blank} Message body: (any of the following) • Attached some pics that i found (followed by any of the following strings) • +++ Attachment: No Virus found Attachment: (any of the following names followed by a .ZIP extension) • bush.1 When an unsuspecting user executes the Trojan attachment, TROJ_SMALL.AHE downloads WORM_BOBAX.P, and the vicious worm-Trojan cycle continues. It also propagates by taking advantage of the Windows LSASS vulnerability. Furthermore, it is capable of modifying the system's HOSTS file in order to prevent users from accessing certain Web sites. Contact Us for a free antivirus trial to the end of this month. 12website has a maintenance program for our clients to ensure their will not be 'let down' by an inefficient computer. Computer maintenance is necessary to keep your machine running smoothly without down time. |
