Windows worm rears ugly head
Thursday, July 11, 2002 by mcs2k1 | Discussion: WinCustomize News
Datom.A virus poses as Microsoft update
Windows users are being warned to be on the lookout for a virus disguised as 'copyrighted Microsoft code' and claiming to be a Windows update.
One expert has even warned that the Windows worm, Datom.A, "could mark an evolution for viruses' modus operandi".
The worm may arrive as an email purporting to be a Microsoft update, but it can also spread through open network shares. The actual worm itself consists of three components: MSVXD.exe, MSVXD16.dll and MSVXD32.dll, created using Borland C++.
"Taken separately, these files cannot be considered as malware, but together they form a pretty malicious code," said Costin Ionescu, virus researcher at BitDefender.
Aside from dropping copies of itself in all subfolders and network folders, experts have said that the worm may mark a significant evolution in virus coding because of the unusual tricks it uses to hide itself. Relevant strings of characters are stored in an encrypted format in the virus files in order to avoid disassembly and analysis, and the virus also uses a few anti-debugger tricks.
The worm uses another trick to make itself 'invisible' in the registry and kills personal firewall Zone Alarm if it is found running, before attempting to connect to the Microsoft website. It is also thought that the worm tweaks the registry and modifies the default application that opens .html files - presumably a web browser. But it is unclear exactly why it does this or why it tries to connect to Microsoft's website.
Source: http://www.neowin.net
Windows users are being warned to be on the lookout for a virus disguised as 'copyrighted Microsoft code' and claiming to be a Windows update.
One expert has even warned that the Windows worm, Datom.A, "could mark an evolution for viruses' modus operandi".
The worm may arrive as an email purporting to be a Microsoft update, but it can also spread through open network shares. The actual worm itself consists of three components: MSVXD.exe, MSVXD16.dll and MSVXD32.dll, created using Borland C++.
"Taken separately, these files cannot be considered as malware, but together they form a pretty malicious code," said Costin Ionescu, virus researcher at BitDefender.
Aside from dropping copies of itself in all subfolders and network folders, experts have said that the worm may mark a significant evolution in virus coding because of the unusual tricks it uses to hide itself. Relevant strings of characters are stored in an encrypted format in the virus files in order to avoid disassembly and analysis, and the virus also uses a few anti-debugger tricks.
The worm uses another trick to make itself 'invisible' in the registry and kills personal firewall Zone Alarm if it is found running, before attempting to connect to the Microsoft website. It is also thought that the worm tweaks the registry and modifies the default application that opens .html files - presumably a web browser. But it is unclear exactly why it does this or why it tries to connect to Microsoft's website.
Source: http://www.neowin.net
rob halford
Reply #2 Sunday, July 14, 2002 12:16 AM
Reply #2 Sunday, July 14, 2002 12:16 AM
sounds like its goin after the man, ole billy boy himself. it will probably work its way right into his computer. (hopefully erasing his warcraft III savegames) and you were thinking his minesweeper! 
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Friday, July 12, 2002 11:04 AM