Worm/VB.fi.3 - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/VB.fi.3
Date discovered:	14/05/2007
Type:	Worm
In the wild:	Yes
Reported Infections:	Medium
Distribution Potential:	Medium
Damage Potential:	Low
Static file:	Yes
File size:	40.960 Bytes
IVDF version:	6.38.01.141 - Mon, 14 May 2007 17:51 (GMT+1)

General Aliases:
   • Symantec: W32.SillyFDC
   • Mcafee: W32/USBAgent
   • Kaspersky: Worm.Win32.VB.fi
   • Sophos: Mal/SillyFDC-A
   • Panda: W32/Bags.A.worm
   • Grisoft: Worm/VB.AQI
   • VirusBuster: Worm.VB.ZUO
   • Eset: Win32/AutoRun.M
   • Bitdefender: Trojan.Agent.ALQ

Platforms / OS:
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Registry modification

Files It copies itself to the following locations:
   • %SYSDIR%\rundll.exe
   • %drive%\rundll.exe

The following file is created:

– %drive%\Autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "Rundll"="%SYSDIR%\rundll.exe"

File details Programming language:
The malware program was written in Visual Basic.

See a brief description here.

Description inserted by Petre Galan on Thu, 02 Jul 2009 08:52 (GMT+1)
Description updated by Petre Galan on Fri, 03 Jul 2009 07:40 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back