Win32.Worm.DownadupJob.A - Downadup worm

This is a generic detection of .job files created by Downadup worm. One of the methods used by this worm to load its library file every day is by creating many Scheduled Tasks in %WINDOWS%\Tasks. The name of the application which will be executed is rundll32.exe and the parameter has the following format: ., - this is the worm's .dll file.

More details about Downadup can be found at the following URL: Win32.Worm.Downadup.Gen

Blaster Worm - Worm type

Blaster (also known as Lovsan or Lovesan) took advantage of a flaw in Microsoft software. The worm along with 'SoBig' worm which also spread at the same time prompted Microsoft to offer cash rewards to people who helped authorities capture and prosecute the virus writers.

The worm started circulating in August 2003. Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.

On August 29, 2003, Jeffrey Lee Parson, an 18-year-old from Hopkins, Minnesota was arrested for creating the B variant of the Blaster worm; he admitted responsibility and was sentenced to an 18-month prison term in January 2005.

Virus Sasser - Worm

The first version of worm struck on April 30, 2004. The worm’s three modified versions have followed it since then, known as Sasser.B, Sasser.C and Sasser.D. The companies affected by the worm included the Agence France-Presse (AFP), Delta Air Lines, Nordic insurance company If and their Finnish owners Sampo Bank.

Another worm to exploit a Windows flaw, 'Sasser' led to several computers crashing and rebooting themselves.

Conficker.C - Worm Conficker

Conficker.C is the most recent variant of the Conficker worm. Exposure to Conficker.C is limited to systems that are still infected with the earlier variants, Conficker.A and Conficker.B, which operate by exploiting the MS08-067 vulnerability in Microsoft Windows Server Service. If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Conficker combats efforts at eradication by creating scheduled tasks and/or using autorun.inf files to reactivate itself.

McAfee has identified thousands of binaries that carry the Conficker payload. Depending on the specific variant, the worm may spread via LAN, WAN, web, or removable drives, and by exploiting weak passwords. Conficker disables several important system services and security products, and downloads arbitrary files.

Storm worm - Botnet Worm

Another big Trojan attack was Storm worm that hit computers worldwide in January 2007. The Storm worm originally posed as breaking news of bad weather hitting Europe. Over time, the worm was also seen in emails with the following subjects: personal greetings, reports that Saddam Hussein is still alive, reports that Fidel Castro is dead, sexy women, YouTube, and even blogs.

Users who fell for it unknowingly became a part of a botnet. A botnet serves as an army of commandeered computers, which are later used by attackers without their owners' knowledge.

W32/Autorun.worm.gen - Virus Generic Worm

This detection is for a worm that attempts to copy itself to the root of any accessible disk volumes.
Additionally it attempts to place an Autorun.inf file on the root of the volume so that it is executed the next time the volume is mounted.

Aliases
Worm.Win32.AutoRun.dve (Kaspersky)
Worm/Autorun.dve (AntiVir)

Characteristics


This detection is for a worm.
It attempts to spread to removable drives by creating an autorun.inf file, which will run the worm automatically, if a systems which use the removable drive are set to Autorun.

Win32/Conficker.AA - Worm

Win32/Conficker.AA is a worm that spreads via shared folders and on removable media. It connects to remote machines in attempt to exploit the Server Service vulnerability.
Installation
When executed, the worm copies itself in some of the the following locations:
- %system%\%variable%.dll
- %program files%\Internet Explorer\%variable%.dll
- %program files%\Movie Maker\%variable%.dll
- %appdata%\%variable%.dll
- %temp%\%variable%.dll
A string with variable content is used instead of %variable% .

The worm loads and injects the %variable%.dll library into the following processes:
- explorer.exe
- services.exe
- svchost.exe

WORMS

Worms are similar to viruses in that they re self replicating. They reproduce themselves across networks without human assistance, such as e-mail sending. A worm, though, doesn't need another executable program to be distributed.

Worms usually affect networks more than individual computers on the network. Their selfreplicating behavior can overload network resources, causing slowdowns in data
transmission by consuming massive bandwidth normally used to forward normal traffic.
Network systems that route Internet traffic are just specialized computer hardware and software. They, too, can be affected by malware.