New Beagle is on the loose
Virus monitoring service of Doctor Web, Ltd. informs on an intensive spreading of a new modification of the mass-mailing worm from the Beagle family, which is labeled by our company as Win32.HLLM.Beagle.18688. Like all its predecessors the new worm poses threat to Windows 95/98/MMMe/NNNT/2000/XP operated systems only.
The worm arrives at computers in mail messages or in files downloaded from peer-to-peer (file-sharing) networks. In case of an email attack the worm comes attached to a messages and its extension can be .exe, .com, .scr, or .cpl. It generates its own messages for future propagation using its own SMTP engine.
Being executed by a user himself, the worm drops its copy named bawindo.exe to the Windows System folder and points to it in the registry entry
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
having attributed it a bawindo value, which automatically secures its launch at every system restart.
The worm also places its copy to the folders the names of which contain the «shar» sequence of symbols in their names — this is how it starts its destructive traveling across the file-sharing nets.
The worm opens port TCP/81 and starts «listening» to the Internet waiting for external instructions from its creator. The back-door procedure run by the worm contains one more malicious feature — the worm also deletes the values of antivirus programs and firewalls from the following registry entries
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Other news
|
 |
My five cents
|
 |
| |
What is the screen size of your monitor?
|
 |
|
 |
|
 |
|
