Free Malware Virus Spyware Help http://www.splatware.com Fix your PC with free virus spyware removal tools Fri, 30 Sep 2011 04:33:36 +0000 en hourly 1 http://wordpress.org/?v=3.3 Generic Dropper!1FE3FA763FAB Trojan and how to clean http://www.splatware.com/generic-dropper1fe3fa763fab-trojan-and-how-to-clean.html http://www.splatware.com/generic-dropper1fe3fa763fab-trojan-and-how-to-clean.html#comments Fri, 30 Sep 2011 04:33:36 +0000 admin http://www.splatware.com/?p=53 Dropper/Malware.743370 AVG (GriSoft) Generic10.AQTP (Trojan horse) avira TR/Dropper.Gen2 Kaspersky Trojan-Dropper.Win32.Flystud.aaw BitDefender Gen:Variant.EvilEPL.5 clamav Trojan.Agent-148768 Dr.Web Trojan.Siggen2.1469 eSafe (Alladin) Suspicious file F-Prot W32/Trojan2.NJZO FortiNet W32/Autorun!worm Microsoft Backdoor:Win32/FlyAgent.E Eset Win32/FlyStudio.OHD trojan (variant) norman W32/Hupigon.DIEY rising Backdoor.Win32.ECode.se Sophos Troj/PWS-BRB Trend Micro TROJ_UNDEF.EQ vba32 Trojan.Win32.Pasta.ipb V-Buster Trojan.Shutdowner!UaIp5WA/Iv0 (trojan)

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

 

The following files were analyzed:

21f45caf86b3fef0da76ebc889c56144616b79bd

The following files have been added to the system:
  • %TEMP%\BClib\krnln.fne
  • %PROGRAMFILES%\Ycesezors\srvany.exe
  • %TEMP%\BClib\Exmlrpc.fne
  • C:\???????2.0????.rar
  • %TEMP%\E_4\Exmlrpc.fne
  • %TEMP%\BClib\dp1.fne
  • %TEMP%\BClib\krnln.fnr
  • %TEMP%\_eviip.tmp
  • %WINDIR%\SYSTEM32\Pzriccnss.exe
  • %TEMP%\E_4\krnln.fnr
  • %WINDIR%\SYSTEM32\Pzriccnss.dll
  • %TEMP%\E_4\dp1.fne
  • %WINDIR%\Fonts\7c1d5cd6872f50006a77be9d6d56769f.dat
The following files were temporarily written to disk then later removed:
  • C:\BRC_Setup.exe
  • %TEMP%\nsf1.tmp
  • C:\BRC_Setup.exe_And DeleteMe.bat
The following registry elements have been created:
  • HKEY_CURRENT_USER\SOFTWARE\FLYSKY\
  • HKEY_CURRENT_USER\SOFTWARE\FLYSKY\E\
  • HKEY_CURRENT_USER\SOFTWARE\FLYSKY\E\INSTALL\
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\
  • HKEY_LOCAL_MACHINE\SOFTWARE\RISING\
  • HKEY_LOCAL_MACHINE\SOFTWARE\RISING\KAKA\
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\SERVICES\YCESEZORS\PARAMETERS\
The following registry elements have been changed:
  • HKEY_CURRENT_USER\SOFTWARE\FLYSKY\E\INSTALL\PATH = %TEMP%\BClib\
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\CHECK_ASSOCIATIONS = NO
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOW_PLACEMENT = [binary data]
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\AUTORECOVER = 2
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\LOCKED = 1
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\ARCHISTORY\0 = [binary data]
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\ARCHISTORY\1 = C:\Raiden\Goat_1.5.235.1931.zip
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\ARCHISTORY\2 = C:\sample\Sample.zip
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\ARCHISTORY\3 = C:\sample\bc_amp.zip
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\FILELIST\FILECOLUMNWIDTHS\MTIME = 100
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\FILELIST\FILECOLUMNWIDTHS\NAME = 120
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\FILELIST\FILECOLUMNWIDTHS\SIZE = 80
  • HKEY_CURRENT_USER\SOFTWARE\WINRAR\FILELIST\FILECOLUMNWIDTHS\TYPE = 120
  • HKEY_LOCAL_MACHINE\SOFTWARE\RISING\KAKA\PROCRUN = 0
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\SERVICES\YCESEZORS\PARAMETERS\APPLICATION = %WINDIR%\SYSTEM32\Pzriccnss.exe -s

To remove this infection,

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

You should be good to go.

]]> http://www.splatware.com/generic-dropper1fe3fa763fab-trojan-and-how-to-clean.html/feed 0 PWS-LegMir!i!BC616000​59A7 malware trojan http://www.splatware.com/pws-legmiribc616000%e2%80%8b59a7-malware-trojan.html http://www.splatware.com/pws-legmiribc616000%e2%80%8b59a7-malware-trojan.html#comments Thu, 25 Aug 2011 21:53:57 +0000 admin http://www.splatware.com/?p=50 This is a high risk malware, that might show up as a trojan, this trojan will attempts to load and execute remote code in explorer process, and once this task is complete by the trojan bot, your system will not start, will effect mostly windows xp and windows 7.
The applications attempted the following network connections. hxxp://www.baidu1s4.com/1mg/***** and hxxp://www.baiduscs.com/1mg/*****

EMSI Software Trojan-GameThief.Win32.Magania!IK
ahnlab Win-Trojan/MalPackedD.suspicious
avast Win32:OnLineGames-FVL [Cryp]
AVG (GriSoft) Dropper.Generic2.CBHP
avira Worm/Taterf.B.258
Kaspersky Packed.Win32.Klone.bq
BitDefender Gen:Variant.Taterf.20
clamav PUA.Packed.ASPack
Dr.Web Trojan.PWS.Wsgame.24181
F-Prot W32/Onlinegames.FV.gen!Eldorado
Microsoft worm:win32/taterf.b
Eset Win32/PSW.OnLineGames.OUM
norman W32/Suspicious_Gen2.PCTYT
panda W32/Lineage.LOH
rising Trojan.Win32.Fednu.cus
Sophos W32/Taterf-AR
Trend Micro Mal_OLGM-41
vba32 Trojan.Agent.01152
V-Buster Trojan.Vaklik!nvEuP1vpjFk
Vet (Computer Associates) Win32/Frethog.IHX
]]> http://www.splatware.com/pws-legmiribc616000%e2%80%8b59a7-malware-trojan.html/feed 0 W32/YahLover.worm!j!7​9B810C26755 Virus http://www.splatware.com/w32yahlover-wormj7%e2%80%8b9b810c26755-virus.html http://www.splatware.com/w32yahlover-wormj7%e2%80%8b9b810c26755-virus.html#comments Thu, 21 Jul 2011 01:26:59 +0000 admin http://www.splatware.com/?p=47 The following files have been added to the system:

  • %WINDIR%\web\connection.dat
  • %WINDIR%\SYSTEM32\logoneui.exe

This W32 YahLover worm is a low threat virus but never the less it will harm your PC. If infected, the virus will infect system files and directories.
Removing this virus should be pretty easy, simply run your PC’s virus scanner if you have one and that should clean it. If your anti virus app is out of date, make sure you update the definition file before you scan and clean.

other known names Detection Names
AVG (GriSoft) Autoit.DI
avira Worm/AutoIt.sl.4
Kaspersky Worm.Win32.AutoIt.sl
BitDefender Win32.Worm.Sohanat.Y
clamav Trojan.Autoit.gen
FortiNet W32/AutoIt.SL!worm
Eset Win32/AutoRun.Autoit.AA worm
norman Sohanad.BRU (trojan)
panda Trj/CI.A
Sophos Mal/Generic-L
vba32 Worm.Autoit.SL
V-Buster Worm.Autoit.Gen.3 (mutant)
]]> http://www.splatware.com/w32yahlover-wormj7%e2%80%8b9b810c26755-virus.html/feed 0 Vundo!jc!682EAD5420CC Trojan http://www.splatware.com/vundojc682ead5420cc-trojan.html http://www.splatware.com/vundojc682ead5420cc-trojan.html#comments Thu, 07 Jul 2011 05:03:11 +0000 admin http://www.splatware.com/?p=44 Microsoft Trojan:Win32/Vundo Symantec Trojan.Gen Trend Micro TROJ_GEN.R47C2FN

System Changes

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

 

The following files were analyzed:

f7c55aabda688cf0cf8ee05ac81fd1a09e6729a0

The following files have been added to the system:
  • %APPDATA%\netprotocol.exe
  • %APPDATA%\System.log
  • %APPDATA%\netprotdrvss.exe
The following registry elements have been created:
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/X-JAVASCRIPT\
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\TEXT/JAVASCRIPT\
The following registry elements have been changed:
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\NETPROTOCOL = %APPDATA%\netprotocol.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/X-JAVASCRIPT\CLSID = {25336920-03F9-11cf-8FD0-00AA00686F13}
  • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\TEXT/JAVASCRIPT\CLSID = {25336920-03F9-11cf-8FD0-00AA00686F13}
The applications attempted the following network connection(s):
  • 31.171.129.***:80
  • hxxp://blenulin.in/*****
  • hxxp://excipie.in/*****
  • hxxp://excipie.in/cle/*****

To remove this Trojan, please follow directions below:

download Malwarebytes’ Anti-Malware from here  and  save it to your computer.

  • Double click mbam-setup.exe and follow the directions to install.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes
    • Launch Malwarebytes
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • A log will be saved automatically which you can access by clicking on the Logs tab within Malwarebytes’ Anti-Malware
]]> http://www.splatware.com/vundojc682ead5420cc-trojan.html/feed 0 Virus Profile Fake Alert SpyPro.gen.bb http://www.splatware.com/virus-profile-fake-alert-spypro-gen-bb.html http://www.splatware.com/virus-profile-fake-alert-spypro-gen-bb.html#comments Mon, 20 Jun 2011 19:20:35 +0000 admin http://www.splatware.com/?p=41 This is a Trojan Horse virus which creates a fake alert Adding or modifies Shell Open registry value which Could be used to launch a program on startup.

File Properties Property Values
McAfee Detection FakeAlert-SpyPro.gen.bb
Length 427520 bytes
MD5 1e867aad6269344862040d697efa6edc
SHA1 f265d862cbadd8ae275792721cec0b5d06af75e8

Other Common Detection Aliases

Company Names Detection Names
Symantec Trojan.Gen.2

System Changes

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

The following registry elements have been changed:

  • HKEY_CURRENT_USER\SOFTWARE\EXQONCZCTRUCEG\ID = 1.0
  • HKEY_CURRENT_USER\SOFTWARE\EXQONCZCTRUCEG\KNKD = 1
  • HKEY_CURRENT_USER\SOFTWARE\EXQONCZCTRUCEG\READY = 1
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOWNLOAD\CHECKEXESIGNATURES = no
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOWNLOAD\RUNINVALIDSIGNATURES = 1
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\CMDMAPPING\{92780B25-18CC-41C8-B9BE-3C9C571A8263} = 8193
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\CMDMAPPING\NEXTID = 8194
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PHISHINGFILTER\ENABLED = 0
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PHISHINGFILTER\ENABLEDV8 = 0
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PHISHINGFILTER\ENABLEDV9 = 0
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\PROXYOVERRIDE
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\PROXYSERVER = http=127.0.0.1:47392
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ASSOCIATIONS\LOWRISKFILETYPES = .exe
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ATTACHMENTS\SAVEZONEINFORMATION = 1
  • HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WDANDYYP = %TEMP%\fmljgiqxa\remoynoxsik.exe
]]> http://www.splatware.com/virus-profile-fake-alert-spypro-gen-bb.html/feed 0 Microsoft Internet Explorer ‘DC:TITLE’ PDF Information Disclosure Vulnerability http://www.splatware.com/microsoft-internet-explorer-%e2%80%98dctitle%e2%80%99-pdf-information-disclosure-vulnerability.html http://www.splatware.com/microsoft-internet-explorer-%e2%80%98dctitle%e2%80%99-pdf-information-disclosure-vulnerability.html#comments Mon, 04 Apr 2011 21:53:26 +0000 admin http://www.splatware.com/?p=38
Type
Logic error
Impact of exploitation
Information disclosure
User Interaction
user interaction is needed
Attack Vector
Information disclosure
Rating
Medium
CVE reference
CVE-2009-4073,
Vendor Status
Unacknowledged
Vulnerable systems
Internet Explorer  6 SP1 Windows 2000 SP4,
Internet Explorer  6 SP1,
Internet Explorer  6 Microsoft Windows Server 2003 SP1,
Internet Explorer  6 Windows Server 2003 SP1,
Internet Explorer  6 Windows Server 2003 SP1 Itanium,
Internet Explorer  6 Windows Server 2003 SP2,
Internet Explorer  6 Windows XP Professional X64 Edition SP2,
Internet Explorer  6 Windows XP SP2,
Internet Explorer  7,
Internet Explorer  7 Windows Server 2003 SP2 Itanium,
Internet Explorer  7 Windows 2000 SP4,
Internet Explorer  7 Windows Vista SP1,
Internet Explorer  7 Windows Vista X64 Edition SP1,
Internet Explorer  7 Windows Server 2008 X64 Edition,
Internet Explorer  7 Windows Server 2008 X32 Edition,
Internet Explorer  7 Windows Server 2008 Itanium Edition,
Internet Explorer  7 Windows XP SP2,
Internet Explorer  7 Windows XP Professional X64 Edition SP2,
Internet Explorer  8,
Summary
A vulnerability in Microsoft Internet Explorer may allow for the disclosure of sensitive information.
]]> http://www.splatware.com/microsoft-internet-explorer-%e2%80%98dctitle%e2%80%99-pdf-information-disclosure-vulnerability.html/feed 0 Excel Document Parsing Memory Corruption Vulnerability http://www.splatware.com/excel-document-parsing-memory-corruption-vulnerability.html http://www.splatware.com/excel-document-parsing-memory-corruption-vulnerability.html#comments Mon, 04 Apr 2011 21:52:35 +0000 admin http://www.splatware.com/?p=36 Description -

A remote code execution vulnerability exists in Microsoft Office Excel as a result of memory corruption when loading Excel records. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. ? The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message. ? An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

McAfee Product Mitigation & Recommendations

Recommendations -

The vendor has released a patch to address this issue: http://www.microsoft.com/technet/security/bulletin/ms09-067.mspx

McAfee Product Mitigation

McAfee Foundstone
Signature:
(MS09-067) Excel Document Parsing Memory Corruption Vulnerability (972652)
Signature identifier:
7325
Release date:
11/10/2009
]]> http://www.splatware.com/excel-document-parsing-memory-corruption-vulnerability.html/feed 0 Excel Featheader Record Memory Corruption Vulnerability http://www.splatware.com/excel-featheader-record-memory-corruption-vulnerability.html http://www.splatware.com/excel-featheader-record-memory-corruption-vulnerability.html#comments Mon, 04 Apr 2011 21:52:07 +0000 admin http://www.splatware.com/?p=34 Description -

A remote code execution vulnerability exists in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. ? The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message. ? An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

McAfee Product Mitigation & Recommendations

Recommendations -

Vendor has released patches to address this issue. http://www.microsoft.com/technet/security/bulletin/ms09-067.mspx

McAfee Product Mitigation

McAfee Foundstone
Signature:
(MS09-067) Excel Featheader Record Memory Corruption Vulnerability (972652)
Signature identifier:
7321
Release date:
11/10/2009
]]> http://www.splatware.com/excel-featheader-record-memory-corruption-vulnerability.html/feed 0 ATL COM Initialization Vulnerability http://www.splatware.com/atl-com-initialization-vulnerability.html http://www.splatware.com/atl-com-initialization-vulnerability.html#comments Mon, 04 Apr 2011 21:51:43 +0000 admin http://www.splatware.com/?p=32 Description -

A vulnerability in Microsoft Active Template Library (ATL) ActiveX Controls may allow remote code execution. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka “ATL COM Initialization Vulnerability.” An attacker could exploit this vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker exploiting this vulnerability could gain the same user rights as the logged on user.

McAfee Product Mitigation & Recommendations

Recommendations -

The vendor has released a patch to address this issue: http://www.microsoft.com/technet/security/bulletin/ms09-060.mspx

McAfee Product Mitigation

McAfee Foundstone
Signature:
(MS09-060) ATL COM Initialization Vulnerability (973965)
Signature identifier:
7206
Release date:
10/13/2009
McAfee Intrushield
Signature:
HTTP: Microsoft Visual Studio ATL Uninitialized Object Vulnerability
Signature identifier:
0×40264900
Release date:
7/6/2009
First released in:
UDS and 4.1.55.4, 5.1.25.4
McAfee Host IPS
Signature:
Generic Buffer Overflow Protection
Signature identifier:
428
Release date:
8/24/2000
First released in:
2.0
Signature:
(MS09-060) ATL COM Initialization Vulnerability (973965)
Signature identifier:
7206
Release date:
10/14/2009
McAfee VirusScan Enterprise 8.0i (VSE8.0i) / Managed Virus Scan (MVS) Buffer Overflow Protection
Signature:
Generic Buffer Overflow Protection

The V-Flash of October 14th will contain remedies for this issue.

Signature:
Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)
Signature identifier:
98961
Release date:
10/14/2009
Release date:
10/14/2009
]]> http://www.splatware.com/atl-com-initialization-vulnerability.html/feed 0 Backdoor.Tidserv.I!inf http://www.splatware.com/backdoor-tidserv-iinf.html http://www.splatware.com/backdoor-tidserv-iinf.html#comments Mon, 04 Apr 2011 21:51:20 +0000 admin http://www.splatware.com/?p=30
Discovered: December 3, 2009
Updated: December 3, 2009 4:38:36 PM
Type: Trojan
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Backdoor.Tidserv.I!inf is a detection for legitimate system driver files that have been modified by Backdoor.Tidserv to load other malicious components.

Protection

  • Initial Rapid Release version December 3, 2009 revision 019
  • Latest Rapid Release version December 3, 2009 revision 019
  • Initial Daily Certified version December 3, 2009 revision 021
  • Latest Daily Certified version December 3, 2009 revision 021
  • Initial Weekly Certified release date December 9, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 – 49
  • Number of Sites: 0 – 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low
  • Modifies Files: Modifies legitimate system files.

Distribution

  • Distribution Level: Low
]]> http://www.splatware.com/backdoor-tidserv-iinf.html/feed 0 W32.SillyFDC.BBX http://www.splatware.com/w32-sillyfdc-bbx.html http://www.splatware.com/w32-sillyfdc-bbx.html#comments Mon, 04 Apr 2011 21:50:01 +0000 admin http://www.splatware.com/?p=27 Discovered: December 2, 2009
Updated: December 3, 2009 5:45:23 AM
Type: Worm
Infection Length: 705,283 bytes
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

W32.SillyFDC.BBX is a worm that spreads by copying itself to removable and mapped drives. It also drops more malware, attempts to download files, lowers security settings, disables certain system software and alters certain system settings.

Protection

  • Initial Rapid Release version December 2, 2009 revision 025
  • Latest Rapid Release version December 2, 2009 revision 025
  • Initial Daily Certified version December 2, 2009 revision 024
  • Latest Daily Certified version December 2, 2009 revision 024
  • Initial Weekly Certified release date December 2, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 – 49
  • Number of Sites: 0 – 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low
  • Modifies Files: Modifies certain files, replacing them with a copy of other malware.
  • Compromises Security Settings: Lowers security settings.

Distribution

  • Distribution Level: Medium
  • Target of Infection: Removable drives
]]> http://www.splatware.com/w32-sillyfdc-bbx.html/feed 0 Adware.Zwunzi http://www.splatware.com/adware-zwunzi.html http://www.splatware.com/adware-zwunzi.html#comments Mon, 04 Apr 2011 21:49:16 +0000 admin http://www.splatware.com/?p=25
Updated: December 3, 2009 12:59:34 AM
Type: Adware
Name: Zwunzi
Version: 1.0 build 128
Publisher: zwunzi.com
Risk Impact: High
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Behavior

Adware.Zwunzi is an adware program that installs itself as a Browser Search Plugin for Internet Explorer and Mozilla Firefox.

Protection

  • Initial Rapid Release version December 2, 2009 revision 039
  • Latest Rapid Release version December 2, 2009 revision 039
  • Initial Daily Certified version December 2, 2009 revision 050
  • Latest Daily Certified version December 2, 2009 revision 050
  • Initial Weekly Certified release date December 9, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

]]> http://www.splatware.com/adware-zwunzi.html/feed 0 W32.Mabezat.B!dam http://www.splatware.com/w32-mabezat-bdam.html http://www.splatware.com/w32-mabezat-bdam.html#comments Mon, 04 Apr 2011 21:48:37 +0000 admin http://www.splatware.com/?p=23
Discovered: December 2, 2009
Updated: December 2, 2009 4:38:12 PM
Type: Virus
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

W32.Mabezat.B!dam is a detection for corrupted files that are infected with W32.Mabezat.B.

Protection

  • Initial Rapid Release version December 2, 2009 revision 022
  • Latest Rapid Release version December 2, 2009 revision 022
  • Initial Daily Certified version December 2, 2009 revision 024
  • Latest Daily Certified version December 2, 2009 revision 024
  • Initial Weekly Certified release date December 9, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 – 49
  • Number of Sites: 0 – 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: Low
]]> http://www.splatware.com/w32-mabezat-bdam.html/feed 0 Trojan.Vundo!gen2 http://www.splatware.com/trojan-vundogen2.html http://www.splatware.com/trojan-vundogen2.html#comments Mon, 04 Apr 2011 21:22:14 +0000 admin http://www.splatware.com/?p=18
Discovered: December 2, 2009
Updated: December 2, 2009 11:57:16 AM
Type: Trojan
Systems Affected: Windows XP, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Trojan.Vundo!gen2 is a heuristic detection used to detect threats associated with the following family:
Trojan.Vundo

Protection

  • Initial Rapid Release version December 2, 2009 revision 008
  • Latest Rapid Release version December 2, 2009 revision 008
  • Initial Daily Certified version December 2, 2009 revision 024
  • Latest Daily Certified version December 2, 2009 revision 024
  • Initial Weekly Certified release date December 2, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 – 49
  • Number of Sites: 0 – 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: Low
]]> http://www.splatware.com/trojan-vundogen2.html/feed 0 Trojan.Vundo!gen1 http://www.splatware.com/trojan-vundogen1.html http://www.splatware.com/trojan-vundogen1.html#comments Mon, 04 Apr 2011 21:21:03 +0000 admin http://www.splatware.com/?p=16 Posted on December 3rd, 2009 by admin
Discovered: December 1, 2009
Updated: December 2, 2009 6:13:59 AM
Type: Trojan
Systems Affected: Windows XP, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Trojan.Vundo!gen1 is a heuristic detection used to detect threats associated with the following family:
Trojan.Vundo

Protection

  • Initial Rapid Release version pending
  • Latest Rapid Release version pending
  • Initial Daily Certified version December 1, 2009 revision 025
  • Latest Daily Certified version December 1, 2009 revision 025
  • Initial Weekly Certified release date December 2, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 – 49
  • Number of Sites: 0 – 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: Low
]]> http://www.splatware.com/trojan-vundogen1.html/feed 0