New Virus Alert: W32 / Netsky-L, Troj / Domwis-A, Troj / Cidra-D and W32 / Agobot-DQ

Posted by 0 Comments

New Virus Alert: W32 / Netsky-L, Troj / Domwis-A, Troj / Cidra-D and W32 / Agobot-DQ

& nbsp;

Virus name	Summary	Describe
W32 / Netsky-L	W32 / Netsky-L is a worm that spreads via e-mail. There is no assessment of the danger level of this worm. & nbsp;	W32 / Netsky-L is a worm that spreads via e-mail, usually containing the following characteristics: Headline: Have one of the following headlines Re: Important Re: Your document Re: Your details Re: Approved Message Format: Bring one of the following messages Your file is attached. Hãy đọc tài liệu. Your document is attached. Hãy đọc tập tin kèm. Hãy xem tập tin kèm theo. The attached file name contains the following instructions .pif .pif where is one of: your_file_ details_ document_ On the first run, W32 / Netsky-L will clone to the Windows folder with the name AVprotect.exe And to be able to automatically run when the computer boots, W32 / Netsky-L will create the registry values at the following address: HKLMSoftwareMicrosoftWindows CurrentVersionRunHtProtect & nbsp;
Troj / Domwis-A	Troj / Domwis-A is a backdoor trojan that allows an attacker to remotely access an infected computer. In addition, the Trojan also has the task of stealing personal information and performing keyboard typing tasks.	- Troj / Domwis-A is a backdoor trojan that is spread over IRC and allows attackers to remotely access infected machines. - During the first run, Troj / Domwis-A will duplicate the Windows folder under the name: RUNDLL16.EXE & nbsp; and will create entries in the registry at the following address to ensure they can be activated when the system boots: & nbsp; HKLMSoftwareMicrosoftWindows CurrentVersionRunWindows DLL Loader = & lt; WINDOWS & gt; RUNDLL16.EXE - Troj / Domwis-A will steal system information and record keyboard actions. - Troj / Domwis-A can download and execute files remotely on an infected system. This type of Trojan can also be programmed to query file lists, delete files, and terminate processes. - Troj / Domwis-A will create a file temp.bat in the Windows folder, but the nature of the file is not dangerous & nbsp;
Troj / Cidra-D	Virus Troj / Cidra- has the ability to open the backdoor, allowing unauthorized access to the system. Also, there are signs of Troj / Cidra-D spreading spam by the addresses found on the infected computer.	- Troj / Cidra-D is a backdoor trojan, allowing remote intrusion to increase TCP traffic through infected systems. - Troj / Cidra-D executable file is usb_d.exe The And to be able to automatically run when the user logs on, this Trojan adds the following keys to the registry at the following address: HKLMSoftwareMicrosoftWindows CurrentVersionRunUsbd - Troj / Cidra-D open a random port to listen, and periodically it will try to connect remotely to a website & nbsp; to register. - Troj / Cidra-D also has the ability to download and execute a file from the network. - Troj / Cidra-D infected e-mails, usually with the following headlines: & nbsp; "This your photo?" + This your photo? This + your photo? This photo? This y_our photo? This your pho + to ^? This yo_ur -photo? Th_is your photo? This you-r _photo? Thi ^ s your photo? Thi-s + your photo? - The virus will have the message "Is this your photo?" - File attached: p_usb.zip & nbsp;
W32 / Agobot-DQ	Sophos has warned about the emergence of the W32 / Agobot-DQ virus, which is capable of infecting shared files on a Windows network, listening on a separate port and spreading when a connection is established. to this port. In order to provide you with the most up-to-date information on the types of viruses that appear on the Internet, the first "virus warning" (N 001), we will constantly update the list of the latest viruses.	- W32 / Agobot-DQ worm infects the network, allowing unauthorized access remotely through IRC channels. - W32 / Agobot-DQ will clone into the shares of the LAN. - W32 / Agobot-DQ will clone to the system folder (Windows) under the name FILENAME.EXE and create entries in the registry at the following addresses: (Note: When system startup, W32 / Agobot-DQ will be enabled as well) HKLMSoftwareMicrosoftWindows CurrentVersionRun Configuration Loader HKLMSoftwareMicrosoftWindows CurrentVersionRunServices Configuration Loader - Deep disables the default shares of the system such as C $, D $, ADMIN $ and IPC $. - W32 / Agobot-DP will attempt to terminate the following processes: tftpd.exe dllhost.exe winppr32.exe mspatch.exe penis32.exe msblast.exe ZONEALARM.EXE WFINDV32.EXE WEBSCANX.EXE VSSTAT.EXE VSHWIN32.EXE VSECOMR.EXE VSCAN40.EXE VETTRAY.EXE VET95.EXE TDS2-NT.EXE TDS2-98.EXE TCA.EXE TBSCAN.EXE SWEEP95.EXE SPHINX.EXE SMC.EXE SERV95.EXE SCRSCAN.EXE SCANPM.EXE SCAN95.EXE SCAN32.EXE SAFEWEB.EXE RESCUE.EXE RAV7WIN.EXE RAV7.EXE PERSFW.EXE PCFWALLICON.EXE PCCWIN98.EXE PAVW.EXE PAVSCHED.EXE PAVCL.EXE PADMIN.EXE OUTPOST.EXE NVC95.EXE NUPGRADE.EXE NORMIST.EXE NMAIN.EXE NISUM.EXE NAVWNT.EXE NAVW32.EXE NAVNT.EXE NAVLU32.EXE NAVAPW32.EXE N32SCANW.EXE MPFTRAY.EXE MOOLIVE.EXE LUALL.EXE LOOKOUT.EXE LOCKDOWN2000.EXE JEDI.EXE IOMON98.EXE IFACE.EXE ICSUPPNT.EXE ICSUPP95.EXE ICMON.EXE ICLOADNT.EXE ICLOAD95.EXE IBMAVSP.EXE IBMASN.EXE IAMSERV.EXE IAMAPP.EXE FRW.EXE FPROT.EXE FP-WIN.EXE FINDVIRU.EXE F-STOPW.EXE F-PROT95.EXE F-PROT.EXE F-AGNT95.EXE ESPWATCH.EXE ESAFE.EXE ECENGINE.EXE DVP95_0.EXE DVP95.EXE CLEANER3.EXE CLEANER.EXE CLAW95CF.EXE CLAW95.EXE CFINET32.EXE CFINET.EXE CFIAUDIT.EXE CFIADMIN.EXE BLACKICE.EXE BLACKD.EXE AVWUPD32.EXE AVWIN95.EXE AVSCHED32.EXE AVPUPD.EXE AVPTC32.EXE AVPM.EXE AVPDOS32.EXE AVPCC.EXE AVP32.EXE AVP.EXE AVNT.EXE AVEXERV.EXE AVGCTRL.EXE AVE32.EXE AVCONSOL.EXE AUTODOWN.EXE APVXDWIN.EXE ANTI-TROJAN.EXE ACKWIN32.EXE _AVPM.EXE _AVPCC.EXE _AVP32.EXE