Win32.Worm.DownadupJob.A - Downadup worm

This is a generic detection of .job files created by Downadup worm. One of the methods used by this worm to load its library file every day is by creating many Scheduled Tasks in %WINDOWS%\Tasks. The name of the application which will be executed is rundll32.exe and the parameter has the following format: ., - this is the worm's .dll file.

More details about Downadup can be found at the following URL: Win32.Worm.Downadup.Gen

Blaster Worm - Worm type

Blaster (also known as Lovsan or Lovesan) took advantage of a flaw in Microsoft software. The worm along with 'SoBig' worm which also spread at the same time prompted Microsoft to offer cash rewards to people who helped authorities capture and prosecute the virus writers.

The worm started circulating in August 2003. Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.

On August 29, 2003, Jeffrey Lee Parson, an 18-year-old from Hopkins, Minnesota was arrested for creating the B variant of the Blaster worm; he admitted responsibility and was sentenced to an 18-month prison term in January 2005.

Conficker.C - Worm Conficker

Conficker.C is the most recent variant of the Conficker worm. Exposure to Conficker.C is limited to systems that are still infected with the earlier variants, Conficker.A and Conficker.B, which operate by exploiting the MS08-067 vulnerability in Microsoft Windows Server Service. If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Conficker combats efforts at eradication by creating scheduled tasks and/or using autorun.inf files to reactivate itself.

McAfee has identified thousands of binaries that carry the Conficker payload. Depending on the specific variant, the worm may spread via LAN, WAN, web, or removable drives, and by exploiting weak passwords. Conficker disables several important system services and security products, and downloads arbitrary files.

W32/Autorun.worm.gen - Virus Generic Worm

This detection is for a worm that attempts to copy itself to the root of any accessible disk volumes.
Additionally it attempts to place an Autorun.inf file on the root of the volume so that it is executed the next time the volume is mounted.

Aliases
Worm.Win32.AutoRun.dve (Kaspersky)
Worm/Autorun.dve (AntiVir)

Characteristics


This detection is for a worm.
It attempts to spread to removable drives by creating an autorun.inf file, which will run the worm automatically, if a systems which use the removable drive are set to Autorun.

Win32/Conficker.A - Worm Conficker

Win32/Conficker.A is a worm that spreads by exploiting a vulnerability in Server Service . The file is run-time compressed using UPX .

Installation
When executed, the worm copies itself in the %system% folder using the following name:
%variable%.dll
A string with variable content is used instead of %variable% .

The library %variable%.dll is loaded and injected into the following process:
services.exe

The worm registers itself as a system service using the following filename:
netsvcs

Win32/Zafi.B - Email Worm

Win32/Zafi.B (Other names: W32.Erkez.B) is a worm spreading via e-mail and P2P networks. It runs on Windows 95 and higher versions. Its size is 12800 bytes compressed by the FSG utility. After its decompression its size is 49 kB.

Note: In following text a symbolic inscription %windir% is used instead of the name of directory in which Windows operating system is installed. Of course, this may differ from installation to installation. The subdirectory System or System32 placed in %windir% has a name %system%.

The worm arrives in an e-mail message with randomly selected subject line and body from the pre-defined subject lines and bodies specified in the worm code. The text in the subject line might be for example:

eIngyen SMS!

And the message body:

Win32.Worm.Downadup.Gen - Worm

Win32.Worm.Downadup is a worm that relies on the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (MS08-67) in order to spread on other computers in the local network. The authors took various approaches to make this malware especially fast spreading and hard to remove.

SYMPTOMS
Connection times out while trying to access various antivirus-related websites.
Windows Update has been disabled.
Presence of autorun.inf files in the root of mapped drives pointing to a .dll file inside the RECYCLER folder of the drive.