Daily Virus Report (July 22, 2008) - Backdoor.Win32.IRCbot.dry
-
RISING
July 22, 2008 one virus needs your attention. It is DRY（Backdoor.Win32.IRCbot. dry）. The virus is a backdoor process via IRC, and hackers can control the infected computer via IRC, and infect other computers.
Name: DRY（Backdoor.Win32.IRCbot. dry）
Warning level: Dangerous
Category: Backdoor
Affected System: Windows NT/2000/XP/2003
Description:
The virus spreads through Internet. When the virus start-up, it can be copied down to drivers application directory by own, and named as “wmiadapi.exe”. At the same time, the virus adds “AutoDiscovery/AutoPurge (ADAP) Service” to registration, to achieve start-up with system. In addition, the virus will set a backdoor at local computer, and automatically connect cftp.dawn****.info for remote instruction. Hackers can control the infected computer via IRC, and take some malicious action through Internet. It is a big threat to computer security safe. Also, the virus can modify registry key, disrupt some normal web function.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Use Rising Vulnerability Check, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open auto-protect and auto-monitor function when accessing to the internet.
6. Put your account information of networks bank, networks game, MSN, QQ, Yahoo Messenger etc, into Rising Application Protection, Rising Application Protection can protect specified applications from attack by malicious programs. A user can apply rules to game software, instant messenger, etc. to customize protection.
Daily Virus Report (Sep 8th, 2010) - Trojan.DL.Win32.NoSorFo.ix ()
