Virus: Worm/Autorun.zvm Date discovered: 11/02/2009 Type: Worm In the wild: Yes Reported Infections: Low Distribution Potential: Low Damage Potential: Low to medium Static file: Yes File size: 24.660 Bytes MD5 checksum: 2b52021892bbcf14e2f672787eab388f IVDF version: 7.01.02.09 - Wednesday, February 11, 2009
General Method of propagation: Aliases: Platforms / OS: Side effects: Files %drive% \recycle.{%CLSID% }\ini.exe%WINDIR% \ini\ini.exe%SYSDIR% \drivers\etc\hosts %WINDIR% \ini\desktop.ini %drive% \autorun.inf This is a non malicious text file with the following content:%code that runs malware% %PROGRAM FILES% \Common Files\Microsoft Shared\MSInfo\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\Web Folders\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %WINDIR% \Tasks\ Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.zvm %WINDIR% \ini\shit.vbs Further investigation pointed out that this file is malware, too. Detected as: TR/Script.11167 %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\admcgi\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\TextConv\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\VGX\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\bin\1033\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\bots\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\DAO\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\servsupp\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\admcgi\scripts\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\admisapi\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\Stationery\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\isapi\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\bin\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\bots\vinavbar\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\_vti_bin\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\Triedit\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %WINDIR% \ini\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\Speech\1033\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\Speech\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc %PROGRAM FILES% \Common Files\Microsoft Shared\web server extensions\40\admisapi\scripts\wsock32.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Autorun.nvc Registry Hosts File details Runtime packer:
Description inserted by Petre Galan on Thursday, February 25, 2010
Back
.
.
.
.
