June 4, 2008 one virus needs your attention. It is HA（Worm.Win32.DownLoader. ha）. The virus will download decades Trojan from the website which hackers appointed, and make the McAfee and other similar software can not startup normally. The virus will copy down to each local disk by own, spread to flash disk and other mobile devices. The virus will add autorun.inf to each disk, when user open a local disk, the virus will startup. In this method, virus escape from the monitor of anti-virus software, it is difficult to check.

Name: HA（Worm.Win32.DownLoader. ha）

Warning level: Dangerous

Category: Worm

Affected System: NT/2000/XP/2003

This virus will copy itself to System32 directory, and named as thundet.exe and dllhos.exe which are similar with Xunlei Download software and system files. Then, the virus will add it to registry to startup with system. The virus will visit the website which hackers appointed and download decades Trojan. At the same time, virus can infect script files, add Internet link at the end of script files, when user browse a website, it will download virus script at the same time. To protect against anti-virus software’s scan, the virus also add it to registry, and make the anti-virus software cannot in a normal process, such as 360 Anti-virus and McAfee. At last, the virus will copy itself to each local disk and add autorun.inf, when user open a disk, the virus will startup. The virus can infect flash disk and other mobile devices, it is difficult to check. 

Anti-virus experts suggest that computer users take the following measures to protect against this virus:

1. Install Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.

2. Use Rising Vulnerability Check, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.

3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.

4. Do not receive the suspicious file from QQ, MSN, Email, etc.

5. Open auto-protect and auto-monitor function when accessing to the internet.

6. Put your account information of networks bank, networks game, QQ etc, into Rising Application Protection, Rising Application Protection can protect specified applications from attack by malicious programs. A user can apply rules to game software, instant messenger, etc. to customize protection.

*If you have any questions about RISING products, please visit Rising support centre  for help.