Daily Virus Report (Mar 5, 2009) - Worm.Win32.DownLoader.em
-
RISING
Mar 5, 2009 one virus needs your attention. It is EM (Worm.Win32.DownLoader.em). This malicious virus shuts down much popular antivirus software to escape from scanning and checking. And the virus infects “exe” properties file, carries malicious attack in LAN with Microsoft operating system vulnerability. This virus links to malicious websites to download varieties Trojan to the infected device; it is difficult to be cleaned.
Name: EM (Worm.Win32.DownLoader.em)
Warning level: Dangerous
Category: Worm
Affected System: Windows NT/2000/XP/2003
Description:
After being executed, the virus shuts down much popular antivirus software to escape from scanning and checking. This virus releases “C:\Windowsupdate.dll” file to infect and destroy the “exe” properties file in non-system disk; then, carries malicious attack in LAN with Microsoft system vulnerability, modifies host files to shielding some viruses and/or hacker’s website, creates “autorun.inf” and “1.exe” file in each disk to achieve being launched by double click operation. Also, the virus accesses to hackers’ appointed website to download varieties of Trojans and viruses, and run these viruses at the infected local device. This makes the virus is difficult to be cleaned.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Internet Security or Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Install Rising PC Doctor, and choose “Leaks” function to check the leaks or vulnerabilities exist in your computer operation system, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open RISING Active Defense and Auto-Protect function when accessing to the internet.
Daily Virus Report (Feb 07, 2012)- Rootkit.Win32.Undef.cvu ()
