Trojan Brisv Infection.

Trojan Brisv is a Trojan horse that infects multimedia files. This trojan search for multimedia files with extension .asf, .mp2, .mp3, .wma, .wmv and injects additional functionality into the multimedia files it finds. While playing these infected multimedia files Windows Media Player will access a malicious link on the internet.

Read More

Removal Of WORM_STRATION.FA

As this comes in the form of an attachment it is easy to identify. All we have to do is to scan the attachment with a good anti-virus product. However the manual removal involves the following things when PC is already infected.

Read More

WORM_SOHANAD.MY

This is a worm that spreads Propagates via network shares, instant messaging applications,  via removable drives and copies itself in all available physical drives. This worm may be downloaded from remote sites by other malware and It drops copies of itself and sets the attributes of its dropped files to hidden and read-only.  It may be downloaded unknowingly by a user when visiting malicious Websites and that also spreads via removable drives.

Read More

WORM_CORONEX.A

This is a worm that comes as an email with an attachment with a names sars.exe, Virus.exe, Corona.exe, death.exe, CV.exe from the emails sars2@hotmail.com, corona@hotmail.com.It is a very dangerous and spreads very fast when executed and slows down the PC.

Effects:
It does the following things when executed:

• Changes the home page to http://www.who.int/csr/don/2003_04_19/en/ 
• Drops its file CORONA.exe in windows folder 
• Adds itself to the registry key HKLM\Software\Microsoft\Windows\Current Version\Run "PC-Config32" = "C:\corona.exe -A" 
• Drops a file in C:\My Download or in the current directory where it is executed.
• The corrupted file is filled with useless data that occupies unwanted space on the hard disk which goes up to Certain GB's.

It drops itself as any of the following

• Age Of Mythology.exe
• Battlefield 1942 (full).exe
• Black Hawk Down (full).exe
• Doom 3.exe
• Grand Theft Auto 3 (full).exe
• Medel Of Honor: Allied Assault.exe
• Quake 3 Full Version.exe
• Rainbow 6 Full.exe
• Return to Castle Wolfenstien (Full).exe
• Starcraft full.exe
• The Lord of the Rings.exe
• The Sims: Unleashed.exe
• Unreal 2: The Awakening (full).exe
• Warcraft III Full.exe 

•  It checks this registry key to obtain list of addresses HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name 
• Initiates its own SMTP engine to send emails with any of the names Corona.exe, hongkong.exe, Virus.exe, Sars.exe, Deaths.exe from senders virus2@china.com
• It also modifies the home page as http://www.who.int/csr/don/2003_04_19/en/ which is a site on SARS 

Read More