| Virus alerts for October 2004 Current virus alerts here. |
Previous |
| By the time you receive the e-mail 'virus alert' it can be too late! |
 |
Get in touch for a one month free antivirus trial. Info on the JPEG JPG Hack Tool here Info on the Music Download Virus here October 31 2004 Hot BAGLE - WORM_BAGLE.AT NOTE: This information is an archive. Current virus information on bagle may be accessed here. WORM_BAGLE.AT has triggered a Medium Risk virus alert, as of October 29, 2004 at 2:07am (GMT -07:00; Daylight Saving Time). This worm runs on Windows 95, 98, ME, NT, 2000, and XP, and is currently spreading in-the-wild. It is a memory-resident worm that spreads via email and through network shares. It arrives in an email with the following details: From: <spoofed> Subject: <any of the following> Message body: <any of the following> Attachment: <any of the following> with the following extension names: This worm scans infected systems for files with certain extension names to acquire its target recipients. It then uses its own SMTP engine and the domain servers of the acquired email addresses for its mailing routine. Unsuspecting users may then receive email messages from trusted acquaintances and readily execute the attachment, thereby launching this worm. Upon execution, it proceeds to drop copies of itself in folders with names containing the text string "shar", or in shared folders. It also uses file names that appear legitimate. This worm compromises system security by terminating several antivirus and security-related applications if found on an infected system. It also connects to a list of Web sites where it may download components. It also opens port 81 possibly for its backdoor activities. Continuing the notable BAGLE characteristics, it attacks the NETSKY family of worms. It deletes several registry entries and file names associated with NETSKY, and also creates several mutexes that prevent the execution of NETSKY variants on the infected machine. Get in touch for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P October 22 2004 WORM_WOOT.BJ WORM_WOOTBOT.BJ is a non-destructive worm that takes advantage of the Windows LSASS vulnerability in order to propagate. It drops a copy of itself into default shared folders of unpatched machines. It steals the CD keys of popular game applications, Microsoft Windows Product IDs, and Yahoo Messenger IDs. It updates itself by creating the file 1.BAT and executing it afterwards. This batch file downloads a copy of the worm from the Internet and then executes it on the compromised system. This worm is currently spreading in-the-wild and infecting systems that are running on Windows 95, 98, ME, NT, 2000, and XP. Upon execution, this worm drops a copy of itself as SERVICED.EXE in the Windows system folder. It executes its dropped copy and then deletes itself afterwards. It then adds several registry entries, that allow it to run automatically at every system startup. This worm exploits the Windows LSASS vulnerability to propagate. This vulnerability is a buffer overrun that allows remote code execution and allows an attacker to gain full control of infected systems. This worm copies and executes itself on vulnerable systems and searches for the following default network shares: * ADMIN$ It steals Microsoft Windows Product IDs and Yahoo Messenger IDs, as well as the CD keys of the following popular games: * Battlefield 1942 This worm appears to possess backdoor capabilities. It updates itself by creating and executing the file 1.BAT. which downloads a copy of the worm from the Internet and then executes it on the compromised system. Get in touch for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P October 14 2004 Microsoft Vulnerabilities (High Risk) The following set of ten Microsoft vulnerabilities were published by Microsoft in October 2004: MS04-029_RPC_RUNTIME_LIBRARY 12website.com advises users to patch their system against these vulnerabilities, and to refrain from using their system until it has been completely patched against these vulnerabilities. In Internet Explorer click once on the Tools menus and click on Windows Update. Download and install Critical Updates. **** Get in touch for a one month free antivirus trial. Frantic FILI - WORM_FILI.A - Music Download Virus WORM_FILI.A is a non-destructive worm that propagates via peer-to-peer applications by dropping copies of itself in default shared folders. It also propagates via email and Internet Relay Chat (IRC). It can disable the Windows Task Manager, thereby preventing an infected user from terminating its process. It also displays the Windows Shut Down menu (the window that pops out when CTRL+ALT+DEL keys are pressed) every few seconds to annoy the user. This worm is currently spreading in-the-wild, and infecting systems running Windows 95, 98, ME, NT, 2000, and XP. **** Get in touch for a one month free antivirus trial. Upon execution, this worm drops a copy of itself in the Windows system folder as the file PILIF.EXE. It creates a registry entry that allows it automatically execute at every system startup. This worm drops copies of itself in the following folders found in the Program Files directory, which are default-shared folders of popular peer-to-peer (P2P) applications: \BearShare\Shared It uses any of the following file names for its dropped copy, followed by an .EXE, .SCR, .PIF, .BAT, or .CMD extension: Anti-hacker Utility This worm searches for email addresses on .HTM and .HTML files found on the affected system. It then sends email messages to these addresses using MAPI. It sends email with the following details: Message body: (any of the following) Important legal notice! Please help us to save the right of freedom of expression! You personal manifesto details are attached. Take good care of them! Help us gather online votes for our anti-censore manifesto Its curious, its scandalous... dont be so furious! Please help us be free! We need the basic right of expression. Music is beeing censored, journalists are afraid, law has not been Parazitii need your help for the anti-censore campaign! See all details Its just hip-hop. Nothing else. Enjoy! This is my manifesto. You can stop this individual, Attachment: (any one of the following, followed by an .EXE, .SCR, .PIF, .BAT, or .CMD extension) * attachement This worm drops a modified SCRIPT.INI file in the following folders: C:\mirc\ This modified IRC script sends a copy of the worm to every user who enters the same chatroom as the infected user. It displays the following message upon file transfer: DCA are fighting for free speech. Get their manifesto now! It then sends out the following file: Manifesto Anti Censore Pilif.txt.exe This worm disables the Windows Task Manager to prevent an infected user from terminating its process. It also displays the Windows Shut Down menu every few seconds to annoy the user. If you would like to scan your computer for WORM_FILI.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/ WORM_FILI.A is detected and cleaned by Trend Micro pattern file 2.193.14 and above. Get in touch for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P Date October 09 2004 Bag it Up - WORM_BAGZ.A WORM_BAGZ.A is a memory-resident, mass-mailing worm uses SMTP (Simple Mail Transfer Protocol) to propagate. It arrives as an attachment to an email with a spoofed From field and varying subjects, message bodies, and attachment file names. This non-destructive worm also drops multiple components in the Windows system folder upon execution. It runs on Windows 95, 98, ME, NT, 2000 and XP, and is currently spreading in-the-wild. Upon execution, this worm drops the following files in the Windows system folder: * DRIVERS\NDISRD.SYS It also adds a registry entry that allows it to automatically execute at every system startup, and uses Simple Mail Transfer Protocol (SMTP) to send multiple copies of itself. It arrives on a system as an attachment to an email with following details: From: <spoofed> Subject: (any of the following) Message body: (any of the following) ***URGENT: SERVICE SHUTDOWN NOTICE*** ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!*** ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM*** Hello, Hello, Hello, Hello, Hello, Thanks,User Hello, Attachment: (any of the following) Get in touch for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. WORM_NETSKY.P Date October 05 2004 JPEG JPG Hack Tool - HKTL_JPGDOWN.A HKTL_JPGDOWN.A is a non-destructive hacker tool that creates a JPEG file, which exploits a vulnerability in Windows XP. This buffer overrun vulnerability in the processing of JPEG image formats may allow a remote user to execute code on an affected system. If a user is logged in with administrator privileges, this vulnerability allows an attacker to take complete control of affected system, and perform actions such as installing programs, viewing, changing or deleting data, and creating new accounts with full privileges. This malware is currently spreading in–the-wild, infecting computer systems that are running Windows 95, 98, ME, NT, 2000, and XP. Upon execution, this hack tool displays a dialogue box titled is displayed, and the buttons “Make” and “About”. The Trojan dropped by this hack tool, attempts to download and execute files from any URL that a malicious user inputs in the dialogue box. This hack tool also drops the file MYPICTURE.JPG in the current folder. After execution of this hack tool, the following message is displayed: "The Jpeg Server, has been created with your settings in the current directory." The following strings can be found in the malware body: JPEG Downloader V1.0 Get in touch for a one month free antivirus trial. Top 10 Most Prevalent Global Malware 1. PE_ZAFI.B Get in touch for a one month free antivirus trial. 12website has a maintenance program for our clients to ensure their will not be 'let down' by an inefficient computer. Computer maintenance is necessary to keep your machine running smoothly without down time. Contact Us. Add "Virus Trial" to the Comments area. |