Daily Virus Report (Oct 31, 2008) - Worm.Win32.DownLoader.ji
-
RISING
Oct 31, 2008 one virus needs your attention. It is JI (Worm.Win32.DownLoader.ji). The virus can release a driver file to replace system file, and the virus downloads decades of Trojans from hackers appointed websites. Also, virus shuts down some security software, to prevent from antivirus software’s scan and check, this make the virus difficult to be deleted.
Name: JI (Worm.Win32.DownLoader.ji)
Warning level: Dangerous
Category: Worm
Affected System: Windows NT/2000/XP/2003
Description:
The virus release a driver named as beep.sys after startup, this driver file will replace a system file with same name, and this will recover SSDT list. The virus can shut down some security software service and process to escape from security software’s scan and check. Then, the virus replace dllcache and wuauclt.exe file of system32 directory, and copies itself down to system32 with name of wuauclt.exe. The virus creates AUTORUN.INF and YS.PIF file at each local disk and through this measure, the virus can startup and spread for a second time. The virus modifies registry key value to startup with system. Finally, the virus accesses to appointed websites to download and run lots of viruses to local computer, the infected computer are easily repeated infected by this virus. It is difficult to be deleted.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Use Rising Vulnerability Check, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open auto-protect and auto-monitor function when accessing to the internet.
6. Put your account information of networks bank, networks game, MSN, QQ, Yahoo Messenger etc, into Rising Application Protection, Rising Application Protection can protect specified applications from attack by malicious programs. A user can apply rules to game software, instant messenger, etc. to customize protection.
Daily Virus Report (Feb 07, 2012)- Rootkit.Win32.Undef.cvu ()
