Virus: Worm/Palevo.zlt Date discovered: 01/04/2010 Type: Worm In the wild: Yes Reported Infections: Low to medium Distribution Potential: Medium Damage Potential: Low to medium Static file: Yes File size: 109.056 Bytes MD5 checksum: 8a2fc1c7c7bda12e344e4f652cc7d091 IVDF version: 7.10.06.11 - Thursday, April 1, 2010
General Methods of propagation: Aliases: Platforms / OS: Side effects: Files %drive% \CAROBNJAK\jellena.exe%drive% :\RECYCLER\%CLSID% \Desktop.ini %drive% \autorun.inf This is a non malicious text file with the following content:%code that runs malware% %temporary internet files% \kristijan[1].exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Palevo.104960 %TEMPDIR% \890.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Palevo.104960 %TEMPDIR% \127.exe %temporary internet files% \24[1].exe %temporary internet files% \icq600[1].exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Palevo.auvi %drive% :\RECYCLER\%CLSID% \yv8g67.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Palevo.auvi %TEMPDIR% \8975119.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Palevo.auvi %TEMPDIR% \127.exe%TEMPDIR% \890.exe%TEMPDIR% \8975119.exe Registry %recycle bin% \%CLSID% \yv8g67.exe,%HOME%\Application Data\ozzfhv.exe,explorer.exe,%HOME%\Application Data\lbisov.exe" P2P Messenger Backdoor Injection File details Runtime packer:
Description inserted by Petre Galan on Monday, September 6, 2010
Back
.
.
.
.
