Daily Virus Report (Feb 27, 2009) - Worm.Win32.Autorun.ffk
-
RISING
Feb 27, 2009 one virus needs your attention. It is FFK (Worm.Win32.Autorun.ffk). This malicious virus spreads through U Flash Disk and other mobile device; shuts down more than ten kinds of security software; and downloads varieties Trojans to local device. It is difficult to be cleaned.
Name: FFK (Worm.Win32.Autorun.ffk)
Warning level: Dangerous
Category: Worm
Affected System: Windows NT/2000/XP/2003
Description:
This malicious Worm program spreads through U disk, mobile devices and Internet. After being executed, the virus will check system process to make sure that only this malicious program existed in system. Then, the virus releases “C:\ Program Files\ aVj.pif”, and “dll?.tmp” file in temp folder; then replaces system files. The virus releases “%windir%\\fonts\\naks.sys”, and operates disk to replace “C:\WINDOWS\system32\aaaamon.dll”. The virus can shut down or break more than ten kinds of security software by methods as scanning process, ending service, deleting files, mirror hijack, closing window, etc; this can prevent the virus program from scan and check of security software. The virus writes “JC.PIF” and “AUTORUN.INF” to each disk to achieving being launched with startup of disk. Finally, the virus downloads Trojans according with the content of http://d.****.com/tt.txt, and renews itself according to http://d.****.com/x.gif. It is difficult to be cleaned.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Internet Security or Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Install Rising PC Doctor, and choose “Leaks” function to check the leaks or vulnerabilities exist in your computer operation system, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open RISING Active Defense and Auto-Protect function when accessing to the internet.
Daily Virus Report (Feb 07, 2012)- Rootkit.Win32.Undef.cvu ()
