Need help? Ask the community or hire an expert.
Go to Avira Answers
Date discovered:18/04/2008
In the wild:No
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low
Static file:No
VDF version:
IVDF version:

 General Method of propagation:
   • No own spreading routine

   •  Kaspersky: HEUR:Worm.Script.Generic
   •  TrendMicro: VBS_DUNIHI.DC
   •  Sophos: VBS/Agent-AEHE
   •  Eset: VBS/Agent.NDH

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7

 Registry One of the following values is added in order to run the process after reboot:

–  【HKCU\software\microsoft\windows\currentversion\run】
   • "sample"="wscript.exe //B "%appdata%\sample.vbs""

– HKLM\software\sample
   • "@"="false - 11/21/2013"

 Miscellaneous  Checks for an internet connection by contacting the following web site:
   • hxxp://bas**********

 File details Programming language:
The malware program was written in Visual Basic.

Description inserted by Soe-liang Tan on Friday, November 22, 2013
Description updated by Soe-liang Tan on Friday, November 22, 2013

Back . . . .