<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<title><![CDATA[Norman Virus Descriptions]]></title><link>http://www.norman.com/feeds/norman_virus_descriptions.rss/dk</link>
<description><![CDATA[Syntax used in the names of malicious programsThe letters/numbers before a slash represent the platform/application which the malicious program infects. The text after a slash represents the general name. Variants are represented by a dot and one or several letters at the end of the name.WM=Word 6.x/7.x W97M=Word 97 XF=Excel 4.0 formulas XM=Excel 5.0 X97M=Excel 6.0 P98M=Project 98 PP97M=PowerPoint 97 A97M=Access 97 CVS=Corel ScriptWP2kM=WordPerfect 2000 VBS=Visual Basic Script mIrc=IRC script W32=Win32 (WinNT/2000 and Win95/98/Me)W95=Win95]]></description>
<pubDate>Mon, 13 Feb 2012 01:17:29 +0100</pubDate>
<generator>Lime CMS 3.6</generator>
<atom:link href="http://www.norman.com/feeds/norman_virus_descriptions.rss/dk/index_html" rel="self" type="application/rss+xml" /><item>
  <title><![CDATA[W32/SpyEye]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/w32_spyeye/dk</link>
  <description><![CDATA[Fig 1 The SpyEye 1.2.6 configuration screen.  This is what the trojan distributor uses before making a new trojan copy.SpyEye is a large and complex banking trojan, which is by many predicted to become the next big thing after the Zeus trojan family. Indeed, rumor has it that the author of Zeus (Monstr) is retiring and has sold the entire Zeus codebase to the SpyEye author (gribodemon/harderman). There are indications that a merge is underway. Newer SpyEye trojans do contain some Zeus-like code.The trojan communicates with one or more command-and-control servers where it gets instructions from and where it also uploads information to.  SpyEye is sold as a kit from its author, and contains not only the trojan itself and configuration tools, but also code to run back end services, control panels, and statistics.InstallationThe trojan itself can be delivered to the user in several ways –typically  through web exploits while surfing or downloaded from spammed download trojans.ConfigurationJust like the Zeus trojan, all targeting and info collecting data is contained in configuration files. In the case of SpyEye, the configuration file is called config.bin and is either downloaded or contained in the executable.config.bin is an encrypted and password-protected ZIP file. It can contain several components depending on configuration and how much the distributor has been willing to pay the author. Some of the components can be:     screenshot configuration  file for screen grabs    files to control the upload of status information    keylogger    credit card grabber    proxy components & config    remote desktop components & config    web injection configuration fileChanges to the filesystemAs can be seen above, the name of the main executable is configurable, but cleansweep.exe is the default, and is the most commonly seen name.  SpyEye will typically copy itself to the folder c:\cleansweep.exe\cleansweep.exe, and also install its configuration file config.bin there.Changes to registry"HKCU\Software\Microsoft\Windows\CurrentVersion\Run “cleansweep.exe"="C:\cleansweep.exe\cleansweep.exe""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings “EnableHttp1_1"="""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings   "ProxyHttp1.1"="""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings  “WarnOnPost"="""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" "WarnOnPostRedirect"="""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" "WarnOnIntranet"="""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0” 1409"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0” 1609"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0” 1406"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1”  1406Memory and process modificationsCreates mutex “ __SPYNET__” to avoid running multiple instances.Enables privilege SeDebugPrivilege.When SpyEye runs, it will inject threads into other running processes. The most aggressively targeted process is explorer.exe, but also other running processes may be injected . The processes "System", "smss.exe", "csrss.exe", "services.exe" and "cleansweep.exe" are avoided.In addition, the trojan will hook several Windows and browser API’s in order to hide itself and in order to monitor activity:CryptEncryptLdrLoadDllNtEnumerateValueKeyNtQueryDirectoryFileNtResumeThreadNtVdmControlTranslateMessageHttpSendRequestAHttpSendRequestWHttpOpenRequestAHttpAddRequestHeadersAHttpQueryInfoAInternetQueryDataAvailableInternetCloseHandleInternetReadFileInternetReadFileExAInternetWriteFilesendPR_ReadPR_WritePR_ClosePR_OpenTCPSocketPFXImportCertStoreWeb injectionBecause the trojan hooks traffic in the browser, it is capable of seeing the data after it comes from SSL encryption but before it is presented to the user.  Thus it can monitor HTTPS traffic, and alter the web content as it wishes. In the configuration file config.bin there will often be a file called webinjects.txt. This file contains rules for how web traffic should be filtered.  Rules look something like this:set_url http://my_bank.com/portal/login G (G means on GET)data_before<data_enddata_injecthtml>custom replacement page for my_bank.com logindata_enddata_afterdata_endThe net result is usually that the user attempts to log into the bank using credentials demanded by the web page – i.e. the trojan. Then the trojan typically either tells the user to wait or shows some error message prompting the user to try to log in again (with new one-time codes) – all the while in the background, the access credentials are posted to an intruder somewhere else, who can now use legitimate access credentials to log into the bank and make transfers.If you notice any unusual behaviour when accessing your online bank, particularly if you notice long delays or strange error messages as you send your login credentials, it is advised that you contact your bank for more information.Rootkit functionalitySpyEye attemps to hide from view by intercepting several Windows APIs connected with listing files and registry settings. This has the effect that you normally will not see the trojan’s installation folder, but it can be detected indirectly – f. ex by attempting to create a new folder by the name “cleansweep.exe”. If you get the error”A file with the name you specified already exists”, you likely have SpyEye running.Norman’s antivirus products detect and remove all variants known to us at this time, but new SpyEye variations are released continuosuly, so it is important to keep the antivirus product updated.Write-up by Snorre Fagerland]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/w32_spyeye/dk</guid>
  <enclosure url="http://www.norman.com/security_center/virus_description_archive/w32_spyeye/spyeye3.jpg/dk?size=preview" length="6845" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Belmoo.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/129146/dk</link>
  <description><![CDATA[Belmoo is a Windows executable, 48640 bytes long. It is written in C, and is not compressed or encrypted in any way. The executable is apparently created Sun Oct 24 16:26:29 2010.InstallationUpon execution it will copy itself to the <%WINDOWS%> \temp folder and create registry keys so that it is started from bootup:* Creates file [WINDIR]\temp\symantec.exe.* Creates value "Microsoft Windows Update"="[WINDIR]\temp\symantec.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".* Creates value "Microsoft Windows Update"="[WINDIR]\temp\symantec.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".Note that it uses the command line option REG in order to do the registry modification; it does not manipulate registry directly from the program.FunctionalityThe malware will attempt to resolve two internet addresses:nobel.usagov.mooo.comupdate.microsoft.comApparently the first of these addresses is not used for anything in particular. The last one is used for a single connect on TCP port 80 (HTTP). The result of this connect is not checked.After this it will attempt to connect to two other internet addresses alternatelyl-3com.dyndns-work.coml-3com.dyndns.tvIf none of these addresses resolve, the malware will exit.If the first address resolves, the malware will attempt to connect to it on port 443/tcp. If this connect fails, the malware will instead attempt to connect to the second address on port 80/tcp, presumably to avoid firewalls. If either of the connects succeed, the malware attaches a command shell to the opened socket, giving an attacker access on the local computer with the same rights as the logged on user.After the shell has been closed, the malware will wait a semi-random amount of time before retrying; minimum one minute.Analysis by Snorre Fagerland]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/129146/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Visal.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/92068/dk</link>
  <description><![CDATA[W32/Visal.A is a windows worm coded in Visual Basic and comes with the icon of a PDF file to trick users into opening it. Capable of sending various spammed messages containing fake PDF documents and/or CVs targeting human resource or administration email addresses in various companies and the military.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/92068/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Dulkis.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/85144/dk</link>
  <description><![CDATA[W32/Dulkis.A is a Windows worm, written in obfuscated Visual Basic.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/85144/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Stuxnet.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/85143/dk</link>
  <description><![CDATA[W32/Stuxnet.A belongs to a worm family that spreads through removable drives. It does this malicious activity by taking advantage of the recently discovered vulnerability in Microsoft Windows Shell (Dropping shortcut files (.LNK) that automatically run when the removable drive is accessed).
Microsoft has released a security&nbsp;update 2 August 2010 that fixes the vulnerability.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/85143/dk</guid>
  </item>
<item>
  <title><![CDATA[Fake Antivirus]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/80133/dk</link>
  <description><![CDATA[Fake antivirus or more precise - fake antimalware, or rogue security programs - is a generic description for all types of malware that pretend to be protection software against virus, spyware, trojans and other types of malware. In reality however, fake antimalware is malicious software.Although this type of malicious software has been around a long time, its growth has been particularly huge recent years.The most used spreading mechanism is drive-by infections from visiting web sites. One popular technique is to manipulate search engines.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/80133/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/antivirus_2010_screenshot_threat_found.jpg/dk?size=preview" length="9257" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Aureate]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79439/dk</link>
  <description><![CDATA[W32/Aureate is an advertising application which displays advertisements when the browser is active and sends user valuable information to the malicious server.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79439/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Goldun]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79268/dk</link>
  <description><![CDATA[Goldun is a trojan that steals account information and gold from victims who use the Online e-Gold service. Some variants of this trojan have been known to install BHOs (Browser Helper Object) to monitor the victim&rsquo;s online activities, waiting for URLs pertaining to e-Gold to be entered into the hijacked browser so relevant data can be stolen. In some cases, gold can be transferred automatically to another account.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79268/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Frethog]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79267/dk</link>
  <description><![CDATA[W32/Frethog is an information stealing trojan, which specifically steals information related to online games and sends it to the remote server]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79267/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FraudPack]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79266/dk</link>
  <description><![CDATA[The FraudPack family of malware misleads users to pay for fake software, which does not live up to its promises. It is common for all fake AVs to download and execute binary files. Executing the downloaded files will install Rouge Anti-Malware or fake software. Nowadays we can also witness FraudPack getting downloaded from hot news, which is redirected to another web site. This is a new technique which uses SEO (Search Engine Optimization). The malware presents itself as legitimate software in the following manner:

    A browser plug-in or extension (typically toolbar).
    An image, screensaver or archive file attached to an email message.
    Multimedia codec required to play a certain video clip.
    Software shared on peer-to-peer networks.
    A free online malware scanning service.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79266/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FakeSpyPro]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79265/dk</link>
  <description><![CDATA[W32/FakeSpyPro is a rogue security program that falsely claims that the affected machine is infected with malware and encourages the user to buy a promoted product for cleaning the alleged malware from the computer.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79265/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/spywareprotect.jpg/dk?size=preview" length="7161" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/FakeAV]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79262/dk</link>
  <description><![CDATA[W32/FakeAV is a trojan that disguises itself as a legitimate antivirus program and displays various fake pop-up messages warning of infection. It may also download additional malware to the compromised system.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79262/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Daonol]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/79261/dk</link>
  <description><![CDATA[Daonol is a family of trojans capable of monitoring network traffic, stealing FTP credentials, preventing access to security web sites, disabling access to system programs, and redirecting web searches to sites hosting other malware. A few previous versions of the malware have a PHP script that checks the version of Adobe Reader and Adobe Flash in the vulnerable host. If it is found out of date, the trojan hijacks the PC using known vulnerabilities. If both of those programs are up to date, the script tests to see if the system is vulnerable to several bugs Microsoft has patched in the last few months. Hijacked machines will be installed with a backdoor that might give the hijackers complete control.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/79261/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Cossta]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/78776/dk</link>
  <description><![CDATA[Unlike viruses, trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of trojan horse is a program that claims to rid your computer of viruses, but introduces viruses onto your computer instead.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/78776/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Cerohar]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/78742/dk</link>
  <description><![CDATA[The Cerohar family of malware is mostly worms that can propagate from one host to another. This variant may be a multi-packed executable to protect its code from reverse engineering. Worms generally do not tamper the host files, but they may load into system memory and thereby slow down the computer&rsquo;s performance.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/78742/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bredolab]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/78550/dk</link>
  <description><![CDATA[W32/Bredolab is a trojan downloader that connects to the server hard-coded in to the executable and downloads the malware in order to compromise the system security, depending on the instruction available in the server.&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/78550/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bancos]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/78367/dk</link>
  <description><![CDATA[Bancos is a family of trojans which captures and steals the user’s online banking credentials such as account numbers and passwords. The information is relayed to the attacker's bait server or to the email address. The trojan primarily monitors accessed URLs and keystrokes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/78367/dk</guid>
  </item>
<item>
  <title><![CDATA[TDSS]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/77200/dk</link>
  <description><![CDATA[TDSS is a trojan that has a rootkit component and a bot component. The rootkit is responsible for hiding the trojan's files on disk, and for providing hidden and encrypted storage for the bot component. The bot component connects to remote computers and makes the infected computer part of a botnet. It may download and install additional malware.TDSS requires special software for removal.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/77200/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/VBTroj]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74352/dk</link>
  <description><![CDATA[W32/VBTroj is a malware family that drops any other type of malware like viruses, worms, keyloggers, backdoors, dialers and rootkits to a system.
It disguises itself as legitimate media player application (Windows Media player)]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74352/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Delf]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74351/dk</link>
  <description><![CDATA[The inject family contains a large number of trojan horses, which insert themselves in running processes and can thus take control of the respective process. This allows the attacker to maliciously manipulate the compromised processes at his will. This is a trojan which has the capabilities to drop and inject malware code into legitimate processes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74351/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Delfdrp]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74350/dk</link>
  <description><![CDATA[The Delf family of trojans are generally compiled with Borland Delphi and usually posses characteristics of a keystroke logger which is capable of recording keystrokes of transactions involving username and password and send the collected information to a remote server.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74350/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Pandex]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74349/dk</link>
  <description><![CDATA[Pandex is a family of trojans/bot with rootkit functionality that can send spam from a remote server after gathering email addresses from the compromised computer and is also capable of downloading and running arbitrary files on infected hosts. It can also drop a kernel-mode rootkit component to hide its presence and activity, gets loaded into kernel space as a driver and runs an SMTP server on the host PC to send spam mails to contacts of the logged on user.Size: 8,192 bytes to 36,864 bytes]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74349/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Inject]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74348/dk</link>
  <description><![CDATA[Inject is a protection mechanism used by malware in order to avoid detection. The injector stores the malware as an encrypted resource, which it decrypts and injects into a running process. The injector may also contain various checks for Virtual Machines and System tools in order to hinder analysis.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74348/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Wintrim]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/74347/dk</link>
  <description><![CDATA[Wintrim is a family of trojans that display pop-up advertisements depending on the user's keywords and browsing history. Its variants can monitor the user's activities, download applications, and send system information back to a remote server.Size: 569,100 bytes to 688,596 bytes]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/74347/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Zbot]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/73568/dk</link>
  <description><![CDATA[Zbots are trojans designed to gather potential information from the compromised computer. These trojans are designed to gather banking information from infected systems and return this information to a remote attacker. The trojans may also install a rootkit on the infected system and accept commands from remote attackers.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/73568/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Shellcode.X]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/70909/dk</link>
  <description><![CDATA[This is an exploit caused by the vulnerability in PDF where Windows is unable to identify an appropriate handler specified in a Uniform Resource Identifiers (URIs) through "mailto:" function.When the infected PDF is opened it tries to disable firewall through netsh command. It also tries to download a file "system.com” through ftp and execute it.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/70909/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Virut]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/69284/dk</link>
  <description><![CDATA[W32/Virut is a polymorphic virus that infects executables and screensaver files, and attempts to downloads additional malware. There are many variants.The Virut.CM variant also injects an iframe object into HTML based files, disables Windows file protection in order to infect essential protected Windows system files. A viral thread, running under winlogon.exe or services.exe, attempts to connect to an IRC backdoor through port 80 or 65520, in order to download additional malware components.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/69284/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Koobface]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/69263/dk</link>
  <description><![CDATA[W32/Koobface is a worm propagating through social networking sites such as Facebook. The worm spreads by sending messages with malicious links to contacts on various social networking sites. These links leads to websites that tries to trick the users into downloading the worm and other malicious software.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/69263/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Conficker]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/67723/dk</link>
  <description><![CDATA[W32/Conficker is a network-propagating worm family. There are several variants. This description mainly describes the B variant. Additional details of the C and D variants are appended.The worm's most interesting feature is that it spreads to other machines via a security vulnerability in the Windows Server Service. This vulnerability allows it to trigger a download of itself to the remote computer without the user's knowledge.When executed, the worm will copy itself as a randomly named DLL to the Windows System folder. It also copies itself to network shares and attempt to execute itself on the remote machines.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/67723/dk</guid>
  </item>
<item>
  <title><![CDATA[PDF/Pidief.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/67722/dk</link>
  <description><![CDATA[This piece of malware uses exploit code in PDF files that utilize a known vulnerability in Adobe Acrobat and Adobe Reader. Quite a lot of these PDF files have been spammed out and have used this exploit to execute arbitrary code on an affected system.You will find more information about the vulnerability here.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/67722/dk</guid>
  </item>
<item>
  <title><![CDATA[1000Years.791]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/67721/dk</link>
  <description><![CDATA[This is an old-style resident DOS virus. It infects DOS COM by appending itself.It contains the text:Memory allocatesion errorPlease try again1000 Years....It's a wonder if the Earth will survive 1000 years with Human...I'm 15th..This program was written in the city of Stockholm (C)1993 -=Lord Zer0=-]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/67721/dk</guid>
  </item>
<item>
  <title><![CDATA[HLLW.Gaobot]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/56298/dk</link>
  <description><![CDATA[This is a generic description intended to cover common functionality found in the Gaobot series of worms.
&nbsp;
Gaobots are rather large and contain a lot of functionality, most spread via Windows exploits and network shares, and will join an IRC channel that attackers can also use to send commands to an infected machine.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/56298/dk</guid>
  </item>
<item>
  <title><![CDATA[Zotob.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55617/dk</link>
  <description><![CDATA[Zotob.B is a worm that exploits a vulnerability in the Windows Plug and Play service (MS05-039) in order to propagate.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55617/dk</guid>
  </item>
<item>
  <title><![CDATA[XM/Laroux.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55996/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55996/dk</guid>
  </item>
<item>
  <title><![CDATA[X97M/Yawn.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55995/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55995/dk</guid>
  </item>
<item>
  <title><![CDATA[X97M/VCX.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55994/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55994/dk</guid>
  </item>
<item>
  <title><![CDATA[X97M/Divi]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55993/dk</link>
  <description><![CDATA[The X97M/Divi viruses is a relatively harmless family of MS Excel virus. They usually drop a file to MS Excel startup path to propagate.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55993/dk</guid>
  </item>
<item>
  <title><![CDATA[X97M/Barisada.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55992/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55992/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/barisada1.gif/dk?size=preview" length="3797" type="image/gif" />
  </item>
<item>
  <title><![CDATA[Wobbler.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55991/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55991/dk</guid>
  </item>
<item>
  <title><![CDATA[WMF/Exploit.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55990/dk</link>
  <description><![CDATA[This is a generic detection of a series of download trojans that use a variety of the notorious WMF vulnerability described in our security advisory.
At the time of this writing, only one trojan had been seen with this particular exploit, but it is very effective and it has been spammed out, giving it a high potential infection rate.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55990/dk</guid>
  </item>
<item>
  <title><![CDATA[WM/Wazzu.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55989/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55989/dk</guid>
  </item>
<item>
  <title><![CDATA[WM/Showoff.D]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55988/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55988/dk</guid>
  </item>
<item>
  <title><![CDATA[WM/Npad.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55987/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55987/dk</guid>
  </item>
<item>
  <title><![CDATA[WM/CAP]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55986/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55986/dk</guid>
  </item>
<item>
  <title><![CDATA[Win95.CIH]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55985/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55985/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Thus.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55984/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55984/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Suppl.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55983/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55983/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Story]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55982/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55982/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Shore.Q]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55981/dk</link>
  <description><![CDATA[W97M/Shore is a macro virus that infects MS Word documents and templates. When an infected document is opened it will infect the normal.dot template and then infects all documents that are opened, saved or closed. It disable the Visual Basic Editor by password protect it. If you try to open the Visual Basic Editor you will be asked to enter a password:


If you don't have the correct password you will be denied access to the Visual Basic Editor.
]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55981/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/w97_shore_1.gif/dk?size=preview" length="4813" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W97M/Seqnum.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55980/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55980/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Resume.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55979/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55979/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Proverb]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55978/dk</link>
  <description><![CDATA[W97M/Proverb is a Word97 class infector.W97M/Proverb hook three Word97 events and will infect other files when an infected document is opened, closed or a new document is created. The virus code contains lot of comments in Russian.W97M/Proverb also contains some code which is never interpreted. This additional code performes a check on Word's version number. If Word version 8 (Office 97) is running, Word's Assistant shows a randomly generated message, if another version of Word is running the virus will show a message box. Both messages are in Russian.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55978/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Pri.Q]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55976/dk</link>
  <description><![CDATA[Thist is a regular polymorphic virus that also containing the mass-replication mechanism of W97M/Melissa.A.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55976/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Myna.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55975/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55975/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Melissa.O]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55974/dk</link>
  <description><![CDATA[This particular variant has been modified to avoid detection by scanners employing heuristic capabilities, like Norman's antivirus products.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55974/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Melissa.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55973/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55973/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Marker.EJ]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55972/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55972/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/marker_ej_1.gif/dk?size=preview" length="5382" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W97M/Marker.DJ]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55971/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55971/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Marker.BQ]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55970/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55970/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Marker.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55969/dk</link>
  <description><![CDATA[This is a polymorphic virus infecting Word97 documents.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55969/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Ethan]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55968/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55968/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Corner.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55967/dk</link>
  <description><![CDATA[In October 1999 a new type of macro virus has has been discovered that infects Microsoft Office 97 and Microsoft Word 2000 Word document files and Microsoft Project 98 project files. The virus is named W97M/Corner.A in infected documents and P98M/Corner.A in infected projects. Even though the virus does not carry any payload, in depth study of the viruscode reveals that the author has tried to include mass-mailing replication in which he did not succeed. Due to advanced reserach, Norman Data Defense Systems' world renowed anti-virus product range already has been able to provide a solution to this latest threat for more than a year.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55967/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/ColdApe]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55966/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55966/dk</guid>
  </item>
<item>
  <title><![CDATA[W97M/Class]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55965/dk</link>
  <description><![CDATA[The first members of this virus famliy were discovered about July 1998 and reported in-the-wild some months later. The virus infects the global macros area on opening an infected document. During infections it exports its code to 'c:\class.sys' and insert this code into Normal.dot. An infected Normal.dot uses the same method to infect documents. The virus stored its code in the Class Module "ThisDocument" instead of in the standard Macro Module.The presence of this virus can often be confirmed by the presence of the file c:\class.sys (file with .sys exstension is default hidden by Windows). It also disables 'Tools\Macro' and 'Tools\Macro\VisualBasic Editor' menus by incorporating two empty macrosViruses in this family are generally polymorphic and change its own code by inserting comments that contains the current user name, current date and time and information about the active printer and window.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55965/dk</guid>
  </item>
<item>
  <title><![CDATA[W95/Whog.878]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55964/dk</link>
  <description><![CDATA[This is a resident virus which works only under Win9x/ME. It infects ordinary Windows applications (EXE files) as they are opened.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55964/dk</guid>
  </item>
<item>
  <title><![CDATA[W95/Matrix.3597]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55963/dk</link>
  <description><![CDATA[W95/Matrix is a polymorphic resident virus, and infects all Win9x EXE files accessed or executed while the virus is active.The virus contains the text w9x.matrix.3597.number lifewire="" by="" mylittlepoly.1534=""w9x.matrix.3597.numberwhere "number" is a counter of files infected.The virus attempts to evade detection by deleting the antivirus checksum database files AVP.CRC, ANTI-VIR.DAT, IVB.NTZ and CHKLIST.MS. It further avoids infecting files starting with the text "_AVP", "NAV", "TB", "F-", "PAV", "DRW", "DSAV", "NOD", "SCA", "NUKEN", "HL." and "MIRC".]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55963/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/matrix.gif/dk?size=preview" length="8654" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W95/CIH.1003.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55962/dk</link>
  <description><![CDATA[CIH is a memory resident file-infecting virus that attempts to infect executables when they are opened.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55962/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Zafi.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55960/dk</link>
  <description><![CDATA[Zafi.B is a mass mailing worm compressed with FSG to a filesize of  12800 bytes]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55960/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Yarner.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55959/dk</link>
  <description><![CDATA[This is an email worm written in Delphi. There  are a number of other variants (variants B to G), very similar to this one.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55959/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Yaha.M@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55958/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55958/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Yaha.K@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55957/dk</link>
  <description><![CDATA[This worm is written in Visual C++. The malicious program is 34,304 bytes and is compressed using UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55957/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Yaha.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55956/dk</link>
  <description><![CDATA[Another email worm in the Yaha series.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55956/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Yaha.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55955/dk</link>
  <description><![CDATA[This is an email and MSN Messenger worm, compressed by UPX to a size of 20992 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55955/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Wingin.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55954/dk</link>
  <description><![CDATA[This is an email worm, written in Visual Basic and compressed down to a size of 21224 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55954/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Winevar.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55953/dk</link>
  <description><![CDATA[This is an email worm, originating from Korea. File size is 91149 bytes. It tries to use an exploit to automatically execute upon opening the mail in Outlook/Outlook Express.

Similar to the W32/Brid worms, this one also drops a special variant of the Funlove virus. This variant of FunLove is very minor, and is detected and cleaned by Norman's antivirus products already.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55953/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Wallon.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55952/dk</link>
  <description><![CDATA[Wallon.A is a mass mailing worm written in Delphi that sends a URL in the email body. When clicked on the URL will be redirected a number of times before a file is downloaded and automatically executed. The downloaded files vary slightly and have a .chm or .exe extension. Some of the .exe files are compressed using ASPACK and may be 151,552, 150,528 or 36,352, bytes long. The other .exe files are compressed using UPX and are diallers with file sizes of either 9,216, 9,200 or 9,112 bytes. The .chm files are either 11, 486, 11,484, 11,482, 11,476 or 11,450 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55952/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Vundo]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55951/dk</link>
  <description><![CDATA[This is a trojan, posing as keygenerator. It spreads via email, fileshares etc. It has a possible backdoor functionality.The trojan is usually packed with Selfextracting RAR.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55951/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Vote.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55950/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55950/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Viking.GT]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55949/dk</link>
  <description><![CDATA[This is a worm with file infecting capabilities.Standalone file size : 68303 bytes.When it first executes on a machine it installs itself and creates registry entries to make sure it is run from bootup. It also installs a number of files:File system changes:%WINDIR%\uninstall\rundl132.exe%WINDIR%\Logo_1.exe%WINDIR%\RichDll.dll%root%\_desktop.iniInfects executable files.May leave temporary BAT files in various locations and with semi-random names.The files rundl132.exe and Logo_1.exe are identical and contain the main worm, while the DLL file RichDll.dll is a backdoor/downloader trojan. _desktop.ini is a text file that contains the date of infection.File infection procedure:The virus looks for files to infect in two possible ways; first by enumerating mapped drives from C: to Z and searching for executable files in these, and also by connecting to network shares it gets access to and searching these. If an eligible file is found, the virus makes a temporary copy of this using the original file name but with an extra ".exe" extension, and proceeds to infect this by prepending its own code. It then deletes the original file and renames the temporary copy (now infected) back to the original name. Sometimes, if for some reason it cannot remove the original file, the virus circumvents this problem by making a temporary looping batch file that will delete the original file and install the infected file once the file becomes deletable - f.ex. if the application in question is closed. The virus will not infect files that are over 16MB in size or files residing under the following folders:systemsystem32windowsDocuments and SettingsSystem Volume InformationRecycledwinntProgram FilesWindows NTWindowsUpdateWindows Media PlayerOutlook ExpressInternet ExplorerComPlus ApplicationsNetMeetingCommon FilesMessengerInstallShield Installation InformationMicrosoft FrontpageMovie MakerMSN Gaming ZoneRegistry changes:HKLM\Software\Microsoft\Windows\CurrentVersion\Run load=%WINDIR%\uninstall\rundl132.exeHKLM\Software\Soft\DownloadWWW auto = 1Network activity: The worm pings the local subnet to establish whether machines are available, using the string "Hello,World!" as request data.  It then attempts to log on to found machines using the WNetAddConnection API, with the following combinations for username/passwords:administrator/no passwordadministrator/default passworddefault user/default passwordno user/no passwordIf it finds machines that it can connect to, it will attempt to copy itself over as a standalone file to the remote ADMIN$ share, using the file name it is currently running under (be it rundl132.exe or logo_1.exe). If it has been granted administrator rights on the remote machine it then proceeds to set the remote file up as a sceduled task on the remote machine using NetScheduleJobAdd.If it is unable to connect to the ADMIN$ share, or if it is running under Win9x/ME, it finds visible shares on the machine using Windows Networking and attempts to connect to these using the following credentials:default user/default passworddefault user/no passwordIf connection is successful, it attempts to infect files remotely using the file infection procedure described above. This procedure also happens once the worm is done pinging the 255 lowest IP's on the local network, it then starts enumerating network resources looking for shares and files to infect in the same manner.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55949/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Valla.2048]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55948/dk</link>
  <description><![CDATA[This is a file-infecting virus, written in assembly language. It seems to have obtained some distribution lately; this is probably because it has been "helped" by infected email/network/P2P worms.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55948/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Updatr.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55946/dk</link>
  <description><![CDATA[This is a variant of the W32/Updatr.A worm.

At the time of this writing, Norman has received one single confirmed report of Updatr.C from an infected user.

This variant is 15872 bytes long, and instead of being packed with UPX it is packed using a compression utility called PECompact.

When run it will copy itself to the Windows System directory under the name SYSTEM.EXE, and set the registry key
HKLM\Software\Microsoft\Windows\CurrentVersion\Run System = C:\WINDOWS\SYSTEM\SYSTEM.EXE
This has the effect that the worm is executed on startup.

It will also copy a small Visual Basic script worm, VBS/Updatr.C, to the startup directory. 


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55946/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Updatr.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55945/dk</link>
  <description><![CDATA[This is a variant of the W32/Updatr.A worm.At the time of this writing, Norman has received one single confirmed report of Updatr.B from an infected user.This variant is 13632 bytes long, and instead of being packed with UPX it is packed using a compression utility called Petite.When run it will copy itself to the Windows directory under the name UPDATE.EXE, and set the registry keyHKLM\Software\Microsoft\Windows\CurrentVersion\Run Update = C:\WINDOWS\UPDATE.EXEThis has the effect that the worm is executed on startup.It will also copy a small Visual Basic script worm, VBS/Updatr.A, to the startup directory.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55945/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Updatr.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55944/dk</link>
  <description><![CDATA[This is a new email worm that spreads via Microsoft Outlook. It is written in Visual Basic, and is in addition compressed using the well known packing program UPX. It is 12288 bytes long.

At the time of this writing, Norman has received only one confirmed report of Updatr.A from an infected user. We will of course monitor the situation.

When run it will copy itself to the Windows directory under the name UPDATE.EXE, and set the registry key
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Update = C:\WINDOWS\UPDATE.EXE
This has the effect that the worm is executed on startup. 


The worm will also copy a small Visual Basic script worm, VBS/Updatr.A, to the startup directory. 

There are now three other variants of this worm, W32/Updatr.B@mm, W32/Updatr.C@mm and W32/Updatr.D@mm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55944/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Tibs]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55943/dk</link>
  <description><![CDATA[This is a large malware family (10000+ discrete detections) with a variety of components and functionality. The first variants of this series were seen as early as 2005. These trojans are designed to download and install a number of other trojans. How they are installed on a machine varies - some can be installed via malicious web sites, while others can be sent via mail or be found on the peer2peer networks. In a handful of documented cases this trojan has also been associated with child pornography. Below is a list of different Tibs-related malware and its functionality.
Downloaders
These variants usually install themselves as %SYSTEM%\kernels64.exe on the local machine; but some variants use names like kernels8.exe or kernels88.exe. They create registry keys to run from startup and every time Explorer is started. In addition, the Task Manager is disabled.
Registry changes:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run &ldquo;System&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices &ldquo;SystemTools&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon &quot;Shell&quot;=&quot;Explorer.exe %SYSTEM%\kernels64.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System &quot;DisableTaskMgr&quot;= 1
Payload:
They download a set of malware components from a distribution site. These additional components are installed using random file names in the %SYSTEM% folder:
%SITE%\proxy.exe : Downloader for more components 
%SITE%\search.exe : Downloader trojan 
%SITE%\tibs.exe : Downloader for a porn dialer 
%SITE%\tool.exe : Downloader for more components 
%SITE%\winlogon.exe : Installer for a rogue spyware application
Some variants do not download directly, but instead access a PHP script which determines which file is to be downloaded. Usually information about the local machine processor and Windows version will be uploaded to the attacker at the same time.
Email address harvesters:
This type of component searches through local files and address books looking for email addresses and posts the findings to a malicious web site. These email addresses are certainly used for spam purposes.
Mail proxies:
By installing a mail proxy, the attacker can send mail through another person&rsquo;s mailserver. This is very useful for a spammer. Machines infected with this type of trojan will have an open port 25 (SMTP).
Peer-to-peer bot:
Some variants are able to connect to other machines also infected and thus create networks of infected machines. A large amount of these files were spammed out on email shortly after the large storm that hit Europe in January 2007 and the malware was given the name Stormy by some. This is a remote-controllable trojan (bot). It carries with it a list of controlling IP addresses, which it can contact to fetch information about other infected machines, and also register itself as a new peer in the network. Many variants of this also install a rootkit to hide themselves. 

Once run, it drops a file with the name wincom32.sys in the %SYSTEM% folder. It then registers this as a service. The trojan may also create a file called wincom32.ini, as well as download and install more malware.
Registry changes:
HKLM\System\CurrentControlSet\Services\wincom 
&quot;ImagePath&quot;=&quot;C:\WINDOWS\SYSTEM32\wincom32.sys&quot; 
&quot;DisplayName&quot;=&quot;wincom32&quot; 

The trojan communicates with peers on ports 4000, 7871 and 11271.
Email worm installation:
Tibs-related malware may also be downloaded and installed by the Luder email worm/virus combo. Luder drops many copies of itself in various locations, and then adds a small codepiece to innocent applications in such a way that when such infected files are run, the main virus is executed as well.
NOTE: The variables %SITE% and %SYSTEM% refers to specific web sites used, and the Windows System folder, respectively.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55943/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Tibick.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55942/dk</link>
  <description><![CDATA[W32/Tibick.C is a peer-to-peer worm compressed using LCC to a file size of 35,971 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55942/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Swen.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55941/dk</link>
  <description><![CDATA[This is an email worm which bears many similarities with the W32/Gibe series of worms. However, the Gibe series is written in Visual Basic, while Swen is written in C.

The worm gives a realistic impression of being a security patch from Microsoft.

]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55941/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/swen_a.gif/dk?size=preview" length="9938" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Stration family]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55940/dk</link>
  <description><![CDATA[This is a large family of email worms.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55940/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/SQLSlammer.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55939/dk</link>
  <description><![CDATA[This appears to be an Internet worm spreading between MS SQL Servers. It uses a known security flaw in SQL to gain access to the remote machine and spread from there.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55939/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Spester.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55938/dk</link>
  <description><![CDATA[This is a small email and IRC worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55938/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Solame.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55937/dk</link>
  <description><![CDATA[W32/Solame.A is a worm written in C. Filesize is 19456 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55937/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55936/dk</link>
  <description><![CDATA[This is another email worm in the Sobig series. File size is about 72295 bytes, though this may vary some. The worm will stop working from Sept. 10th 2003 and onwards.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55936/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55935/dk</link>
  <description><![CDATA[This is another email worm in the Sobig family. The copies we have seen are 86528 bytes long.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55935/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.D@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55934/dk</link>
  <description><![CDATA[This is an email worm in the Sobig series. This one is 59378 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55934/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55933/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55933/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55932/dk</link>
  <description><![CDATA[This is an email worm, written in C, and compressed using an UPX-like compression program to a file size of 50k (file size may vary some).]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55932/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sobig.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55931/dk</link>
  <description><![CDATA[This is a mass-mailing worm that also spreads over network shares. It is 65536 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55931/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.R@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55930/dk</link>
  <description><![CDATA[Another email worm in the Sober series. File size is 113551 (executable inside zip file).  There is also a different version being sent out, which is just an installer for this worm. File size in that case is 122751 inside zip.This worm has CME ID 151.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55930/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.N@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55929/dk</link>
  <description><![CDATA[This is another email worm in this family.  File size is 73541 bytes unarchived.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55929/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/sober_n.jpg/dk?size=preview" length="5897" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Sober.K@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55928/dk</link>
  <description><![CDATA[Another email worm in the Sober series. File size is 51688 bytes (executable files). Zipped copies may vary slightly.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55928/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.J@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55927/dk</link>
  <description><![CDATA[Sober.J@mm is a mass-mailing worm written in Visual Basic and compressed using UPX. File-sizes may vary due to the worm appending random garbage to the file, but it is typically around 43kb. This worm bears many resemblances to previous variants.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55927/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.I@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55926/dk</link>
  <description><![CDATA[This is a new email worm, email executable file size 56808 bytes long. Dropped executable files will be 46056 bytes lo]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55926/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55925/dk</link>
  <description><![CDATA[Sober.F is a mass mailing worm written in Visual Basic and compressed using UPX to a filesize of 42,496 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55925/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.D@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55924/dk</link>
  <description><![CDATA[UPX compressed email worm written in Visual Basic and comes with its own SMTP engine.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55924/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/sober_d_1.gif/dk?size=preview" length="5312" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Sober.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55923/dk</link>
  <description><![CDATA[UPX compressed email worm written in Visual Basic.
When the worm is started it will display one of the following error messages:


The worm will then make three copies of itself in the System directory. Two copies using a random/semirandom name and the last one will be named syshost.exe.
It will add two entrys to the Registry so that it is loaded from startup. 
Both files with random filename will run as separate processes, each of them continously reloading the other if it is terminated.
Registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
&nbsp;&nbsp; [random] = %SystemDir%\[random].exe. 
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
&nbsp;&nbsp; [random] = %SystemDir%\[random].exe. 
The registry keys are continously refreshed while the worm is active.
The worm will allso generate several 0-byte files in the System directory.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55923/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/sober_c1.gif/dk?size=preview" length="5486" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Sober.AA@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55922/dk</link>
  <description><![CDATA[Another email worm in the Sober series. File size is 55390 (executable inside zip file).  This worm has CME ID 681.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55922/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sober.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55921/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic and compressed down to a file size of about 65k. The file size will vary some due to a small amount random garbage appended to the files.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55921/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Small.KI@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55920/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic. File size is 95690 bytes. This worm has CME ID 24.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55920/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Skudex.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55919/dk</link>
  <description><![CDATA[This is a simple email worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55919/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/SkinTrim.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55918/dk</link>
  <description><![CDATA[SkinTrim.A is a trojan, posing as an Outlook-plugin. It spreads via file shares.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55918/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Ska]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55917/dk</link>
  <description><![CDATA[The worm does not modify any other files except the Wsock32.dll. Wsock32.dll is a regular part of Windows that provides a connection to the Internet. If Ska.exe cannot modify Wsock32.dll, it will add Ska.exe to the RunOnce section of the registry.

&nbsp;
HKEY_LOCAL_MACHINE|SOFTWARE| Microsoft|Windows|CurrentVersion|RunOnce
The Wsock32.dll will then be modified the next time the computer starts. The Wsock32.ska (see below) will be created even if Wsock32.dll cannot be modified.

If you use Windows NT the files SKA.EXE, SKA.DLL, and WSOCK32.SKA will be created, but will not be able to modify the registry or WSOCK32.DLL.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55917/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/SirCam@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55916/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55916/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sheer.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55915/dk</link>
  <description><![CDATA[This is an email worm that sends itself to all users in the Windows Address Book.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55915/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/ServU.4_1]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55914/dk</link>
  <description><![CDATA[This is not a virus or trojan, but a commercially available FTP server application. This FTP server, originally called FTP Serv-U, is used as a tool by several backdoors and denial-of-service tools. It is important to understand that FTP Serv-U is not malicious per se; instead it provides functions that can enable hackers to set up remote access to files on the local computer.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55914/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/ServU.3_0]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55913/dk</link>
  <description><![CDATA[This is not a virus or trojan, but a commercially available FTP server application. This FTP server, originally called FTP Serv-U, is used as a tool by several backdoors and denial-of-service tools. 

It is important to understand that FTP Serv-U is not malicious per se; instead it provides functions that can enable hackers to set up remote access to files on the local computer.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55913/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Scorpina.1_0]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55912/dk</link>
  <description><![CDATA[This is a backdoor trojan written in Visual Basic. It will among other things install an open FTP server on affected machines.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55912/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Scold.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55911/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic and compressed using UPX to a file size of 28160.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55911/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sasser.F]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55910/dk</link>
  <description><![CDATA[&nbsp;This is a worm that spreads over network connections (not email) without any user interaction. It is very similar to W32/Sasser.A.
&nbsp;The following is a portion of the instant analysis done by the Norman Sandbox Technology:
[ General information ]
&nbsp;&nbsp;&nbsp; * File length:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 74752 bytes.
&nbsp;[ Changes to filesystem ]
&nbsp;&nbsp;&nbsp; * Creates file C:WINDOWS apatch.exe.
&nbsp;[ Changes to registry ]
&nbsp;&nbsp;&nbsp; * Creates value &quot;napatch.exe&quot;=&quot;C:WINDOWS apatch.exe&quot; in key &quot;HKLMSoftwareMicrosoftWindowsCurrentVersionRun&quot;.
&nbsp;[ Network services ]
&nbsp;&nbsp;&nbsp; * Attempts to resolve name &quot;101.0.158.90&quot;.
&nbsp;&nbsp;&nbsp; * Connect port 445 [IP], IP 193.75.75.100.
&nbsp;&nbsp;&nbsp; * Connect port 445 [IP], IP 101.0.158.90.
&nbsp;&nbsp;&nbsp; * Attempts to resolve name &quot;144.40.203.34&quot;.
&nbsp;&nbsp;&nbsp; * Connect port 445 [IP], IP 144.40.203.34.
&nbsp;[ Security issues ]
&nbsp;&nbsp;&nbsp; * Exploits MS04-011 vulnerability.
&nbsp;[ Process/window information ]
&nbsp;&nbsp;&nbsp; * Creates a mutex billgate.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55910/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sasser.D]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55909/dk</link>
  <description><![CDATA[This is a worm that spreads over network connections (not email) without any user interaction. It is similar to W32/Sasser.B.
File size is 16384 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55909/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sasser.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55908/dk</link>
  <description><![CDATA[This is a worm that spreads over network connections (not email) without any user interaction. It is very similar to W32/Sasser.B.
File size is 15872 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55908/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sasser.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55907/dk</link>
  <description><![CDATA[This is a worm that spreads over network connections (not email) without any user interaction. It is very similar to W32/Sasser.A.
File size is 15872 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55907/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sasser.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55906/dk</link>
  <description><![CDATA[This is a worm that spreads over network connections (not email) without any user interaction. File size is 15872 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55906/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Sality]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55905/dk</link>
  <description><![CDATA[This is a family of fileinfecting viruses with backdoor and keylogger capabilities. Some variants install a helper component in the Windows System folder. Names on this component vary by Sality variant:SYSLIB32.DLL (All early versions)OLEMDB32.DLL (Sality.M, version 3.03)WMIMGR32.DLL (Sality.N, version 3.04)VCMGRD32.DLL (Sality.P/Q, version 3.07)VCMGCD32.DLL (Sality.R, version 3.09)WDMFMC32.DLL (Sality.S, version 3.07)...and others.This DLL is then injected into running processes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55905/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Ryknos.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55904/dk</link>
  <description><![CDATA[This is a backdoor trojan. File size is 10240 bytes. It is very closely related to the Breplibot series of backdoors. It is extremely buggy, and many of its features will not work. The trojan copies itself to the System directory, where it will attempt to use the same file name as one of the components used by the First 4 Internet Digital Rights Management software. This can in certain settings hide the presence of this backdoor on the system.
The backdoor will attempt to add itself as a trusted process with the Windows Firewall.
File system changes:
Creates file \$sys$drv.exe
Registry changes:
Creates key &quot;HKCU\Software\WkbpsevaXImgvkwkbpXSmj`kswXGqvvajpRavwmkjXVqj &quot;$sys$drv&quot;=&quot;$sys$drv.exe&quot;
Creates key &quot;HKLM\Software\WkbpsevaXImgvkwkbpXSmj`kswXGqvvajpRavwmkjXVqj &quot;$sys$drv&quot;=&quot;$sys$drv.exe&quot;
The mangled registry keys is another example of bugs in the code. These keys will not autostart the backdoor from bootup.
&nbsp;It will create the mutex &quot;$sys$drv.exe&quot; if installed correctly.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55904/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Renos.DD]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55903/dk</link>
  <description><![CDATA[This is a downloader trojan in the Renos-family assosciated with Zlob,  SpyFalcon, SpyAxe/SpywareStrike and Nsag. File size: 102400 bytes]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55903/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Randex.R]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55902/dk</link>
  <description><![CDATA[Randex.R is a backdoor/worm that spreads via network shares. File size is 65,536 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55902/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Raleka.A, B and C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55901/dk</link>
  <description><![CDATA[The Raleka family of worms spreads through the DCOM RPC exploit, the same method used as the W32/Blaster worms.

For the time being we know three variants of this worm.

They attempt to download and install a hacker tool called NtRootkit. NtRootkit is a utility that hides itself and can hide other malicious processes. Thus, it may be difficult to find the malicous processes on infected machines. This utility can be attempted downloaded from a predefined web page (which is now down) or from the infected machine.

The worm also attempts to connect to IRC servers and join a channel on these; where it announces its presence and can receive commands.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55901/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/QAZ.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55900/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55900/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Prolin.A@mm36864]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55899/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55899/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Pokey.32768.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55898/dk</link>
  <description><![CDATA[This is a worm written in Visual Basic 6 and it requires VB6 libraries to run. If these libraries are not present at the system W32/Pokey will not run.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55898/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/pokey1.gif/dk?size=preview" length="5185" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Pinfi.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55897/dk</link>
  <description><![CDATA[This is a parasitic polymorphic virus which will stay resident in memory and infect *.EXE and *.SCR files.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55897/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/P2PWorm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55896/dk</link>
  <description><![CDATA[This is something possibly viral that is detected by Norman Sandbox.

W32/P2PWorm is a common description of a worm spreading over P2P networks.

If the Sandbox detects something unknown like this, you should first make sure that your Norman antivirus&nbsp;installation is completely up-to-date. If your installation is outdated, the Sandbox may have detected a virus that has recently been added to the definition files.

If an up-to-date Norman installation still detects the file in question as W32/P2PWorm, Norman has not included it in the virus definition files. If it were in the definition files it would have been given a distinct name and regular detection would have been added.&nbsp;The sandbox should always give a short analysis whether the malicious program is a worm or a virus. This can be found in the log file or in your message console.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55896/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Oror]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55895/dk</link>
  <description><![CDATA[This is a family of destructive worms that also install an IRC-controlled backdoor component. At this time, 9 variants have been found, all with minor variations in functionality.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55895/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Opaserv.K]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55894/dk</link>
  <description><![CDATA[This variant of Opaserv and another one (L) contains a very dangerous payload which distinguishes them from the rest of the family.Apart from the payload they are functionally quite similar to the rest of the family.The K variant uses the filename mqbkup.exeThe L variant uses the filename mstask.exe]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55894/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Opaserv]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55893/dk</link>
  <description><![CDATA[This is really a family of worms, and they are all so-called network crawlers; i.e. they spread by copying themselves to open network shares. In some cases they may even copy themselves to shares which have password protection; this is done through a security hole in Win9x/ME.Notice: On unpatched systems or systems with open shares, you may get multiple alarms from NVC, as the worm tries again and again to copy itself in from the network.Variant A: uses filename scrsvr.exe, 28672 bytes longVariant B: same as AVariant C: same as AVariant D:uses filename scrsvr.exe, 27136 bytes longVariant E:uses filename brasil.pif, 24064 bytes longVariant F:uses filename brasil.exe, 24064 bytes longVariant G:uses filename marco!.scr, 12800 bytes longOther variants exist which are very destructive. Please see separate description for these.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55893/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Nimda.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55891/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55891/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/NiceHello.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55890/dk</link>
  <description><![CDATA[This is an email worm that is written in Delphi and compressed using UPX down to a file size of 99382 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55890/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/NetworkWorm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55889/dk</link>
  <description><![CDATA[This is something possibly viral that is detected by Norman Sandbox.

W32/NetworkWorm is a generic description of a worm spreading over network shares.

If the Sandbox detects something unknown like this, you should first make sure that your NVC installation is completely up-to-date. If your installation is outdated, the Sandbox may have detected a virus that has recently been added to the definition files.

If an up-to-date Norman installation still detects the file in question as W32/NetworkWorm, Norman has not included it in the virus definition files. If it were in the definition files it would have been given a distinct name and regular detection would have been added. The sandbox should always give a short analysis whether the malicious program is a worm or a virus. This can be found in the log file or in your message console.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55889/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.Y@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55888/dk</link>
  <description><![CDATA[Netsky.Y is a mass mailing worm compressed using PE-PACK to a filesize of 18,944 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55888/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.X@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55887/dk</link>
  <description><![CDATA[Netsky.X is a mass mailing worm compressed to a file size of 26,112 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55887/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.V@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55886/dk</link>
  <description><![CDATA[Netsky.V is a mass mailing worm compressed using UPX and PE-Patch to a file size of 19,432 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55886/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.S@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55885/dk</link>
  <description><![CDATA[Netsky.S is a mass mailing worm compressed using UPX to a file size of 18,432 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55885/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.Q@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55884/dk</link>
  <description><![CDATA[Netsky.Q is a mass mailing worm compressed with Petite to a filesize of 28,008 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55884/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.P@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55883/dk</link>
  <description><![CDATA[This is an email and network worm. File size is 29568 bytes, but size may vary when the worm comes in a zip file.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55883/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.K@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55882/dk</link>
  <description><![CDATA[This is an email worm. File size is 22016 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55882/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55881/dk</link>
  <description><![CDATA[This is an email worm. File size is 24840 bytes.
It looks to be something of a hybrid between W32/Netsky.C and W32/Netsky.D.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55881/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.D@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55880/dk</link>
  <description><![CDATA[This is an email worm. File size is 17424 bytes. This variant is greatly simplified compared to its predecessor.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55880/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55879/dk</link>
  <description><![CDATA[This is an email worm. We have seen two versions of it; one packed with Petite (25352 bytes) and one packed with Aspack (28160 bytes).]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55879/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55878/dk</link>
  <description><![CDATA[This is an email worm; file size 22016. The file is compressed using UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55878/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.AC@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55877/dk</link>
  <description><![CDATA[This is a new email worm in the Netsky series. File size in emails is approx 36kb, but may vary some.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55877/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Netsky.AB@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55876/dk</link>
  <description><![CDATA[Netsky.AB is a mass mailing worm compressed using PECompact to a file size of 17,920 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55876/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/NetBus]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55875/dk</link>
  <description><![CDATA[This program is a remote administration hack tool which can be used to control other computers, with Netbus Server installed, through the Internet or the network. The hacker must have the Netbus Client installed.

It is important to be aware of the fact that the file PATCH.EXE, which is the server part of the program, may have another name. It is the person who sends the file who decides the name (e.g. setup.exe, icq_upda.exe, games.exe). The file will nevertheless be referred to as PATCH.EXE in this document.

Netbus will run on Windows 95/98/Me and WindowsNT.

Netbus allows a hacker to access the host computer through TCP/IP. The Netbus Server program can be distributed as any executable file, and once &quot;logged on&quot; to your machine the intruder can:

    
        Open/close the CD-ROM once or in intervals (specified in seconds). 
        Show optional image. If no full path of the image is given it will look for it in the Patch-directory. The supported image-formats is BMP and JPG. 
        Swap mouse buttons - the right mouse button gets the left mouse button's functions and vice versa. 
        Start optional application.
        Play optional sound-file. If no full path of the sound-file is given it will look for it in the Patch-directory. The supported sound-format is WAV. 
        Point the mouse to optional coordinates. The intruder can even navigate the mouse on the target computer with his/her own! 
        Show a message dialog on the screen. The answer is always sent back to the intruder! 
        Shutdown the system, log off the user etc.
        Go to an optional URL with the default web-browser. 
        Send keystrokes to the active application on the target computer! The text in the field &quot;Message/text&quot; will be inserted in the application that has focus. (&quot;|&quot; represents enter). 
        Listen for keystrokes and send them back to the intruder! 
        Get a screendump!
        Return information about the target computer. 
        Upload any file to the target computer! With this feature it will be possible to remotely update Patch with a new version. 
        Increase and decrease the sound-volume. 
        Record sounds that the microphone catch. The sound is sent back to the intruder! 
        Make click sounds every time a key is pressed!
        Download and delete any file from the target. The intruder chooses which file to download/delete in a view that represents the harddisks on the target! 
        Keys (letters) on the keyboard can be disabled. 
        Password protection management. 
        Show, kill and focus windows on the system. 
    
    
    
    &nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55875/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Navidad.32768.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55874/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55874/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Navidad.16896.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55873/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55873/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/navidad_b.gif/dk?size=preview" length="10544" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Naked@mm.73728.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55872/dk</link>
  <description><![CDATA[This is a dangerous email worm written in Visual Basic 6.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55872/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/jibjab.jpg/dk?size=preview" length="7355" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Nachi.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55871/dk</link>
  <description><![CDATA[This is network worm that uses the DCOM RPC and WebDAV vulnerabilities to spread.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55871/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mytob]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55870/dk</link>
  <description><![CDATA[The Mytob family is a big family of worms that can spread via email and via security vulnerabilities in the operating system. This is a general description of the family.
Mytob is loosely based on two other worm series: The Mydoom email worms and the SDBot/Spybot network worms. The SDBot series of worms is very common, but does not have email spreading. In addition, SDBots are rather plugin-based and&nbsp;easy to&nbsp;adjust to&nbsp;new technologies, so that they finally got equipped with email-spreading came as no surprise.
They appear to at least initially be spammed out from the author(s). New variants have occurred at a high frequency, with a regularity which looks almost scheduled.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55870/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyParty.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55869/dk</link>
  <description><![CDATA[This is a minor variant of the W32/MyParty.A@mm worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55869/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyParty.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55868/dk</link>
  <description><![CDATA[This is an email worm that sends itself to addresses in the Windows Address Book.It has a time limit on operation - it stops working after Jan. 29th 2002.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55868/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyLife.J@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55867/dk</link>
  <description><![CDATA[Yet another worm in the MyLife series. As the others, this is programmed in Visual Basic and compressed by UPX. File size is 22528 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55867/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/mylife_j.gif/dk?size=preview" length="18647" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/MyLife.I@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55866/dk</link>
  <description><![CDATA[Yet another worm in the MyLife series. As the others, this is programmed in Visual Basic and compressed bu UPX. File size is 12288 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55866/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/mylife_i.gif/dk?size=preview" length="18609" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/MyLife.H@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55865/dk</link>
  <description><![CDATA[Yet another worm in the MyLife series. As the others, this is programmed in Visual Basic and compressed bu UPX. File size is 7168 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55865/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyLife.G@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55864/dk</link>
  <description><![CDATA[Yet another worm in the MyLife series. As the others, this is programmed in Visual Basic and compressed bu UPX. File size is 13824 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55864/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyLife.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55863/dk</link>
  <description><![CDATA[This is a new variant in the MyLife series of email worms.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55863/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyLife.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55859/dk</link>
  <description><![CDATA[This is an email worm, written in Visual Basic and compressed using UPX. It is 11524 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55859/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/mylife_b.gif/dk?size=preview" length="6638" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/MyLife.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55858/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic and compressed using UPX 1.20.File length is 30720 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55858/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.M@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55857/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55857/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.L@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55856/dk</link>
  <description><![CDATA[W32/MyDoom.L@mm is a mass mailing worm compressed using UPX. Filesizes may vary as the worm appends random data to itself, but samples seem to be at least 28kbytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55856/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55855/dk</link>
  <description><![CDATA[This is an email worm. File size is approximately 34k bytes, size may vary some.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55855/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55854/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55854/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.AQ@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55853/dk</link>
  <description><![CDATA[Another worm in the MyDoom series; file size usually 25771 bytes. This appears to be more or less a repackaging of an earlier variant, although small differences exist.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55853/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.AH@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55852/dk</link>
  <description><![CDATA[W32/MyDoom.AH is a mass-mailing peer-to-peer worm, compressed using UPX to a file size of 31,744 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55852/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MyDoom.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55851/dk</link>
  <description><![CDATA[This is a worm. File size is 22528 bytes, though size may vary some when the worm comes as zip.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55851/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Music.40960.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55850/dk</link>
  <description><![CDATA[W32/Music is a worm written in Visual Basic. This worm will only run on Win9x/Me platforms, not WinNT/2000. It will not run if the Visual Basic ver5 DLL is not present on the system.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55850/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/music1.gif/dk?size=preview" length="7783" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/MTX@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55849/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55849/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/MSNSpamta.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55848/dk</link>
  <description><![CDATA[The malware disguises itself as a link to a JPEG-image from a random hotmail address. It has a double-extension - .JPEG.EXE.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55848/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mitglied.gen]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55847/dk</link>
  <description><![CDATA[This is a trojan which might have backdoor, downloader and worm characteristics. Because of the similarities between many of the Mitglied variants this is a generic description.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55847/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail_Based@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55846/dk</link>
  <description><![CDATA[This member of the Mimail family is an e-mail worm/backdoor that mass mails a polymorphic variant of itself and attempts to obtain credit card/e-gold information. Files size is either 50,720 bytes or 32,768 bytes.Mimail_based is a detection that will cover two known variants; Mimail.Q and Mimail.S.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55846/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail.J@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55845/dk</link>
  <description><![CDATA[This is an email worm in the Mimail family. File size is 13856 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55845/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail.I@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55844/dk</link>
  <description><![CDATA[This is an email worm in the Mimail family. File size is 12832 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55844/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55843/dk</link>
  <description><![CDATA[This is an email worm in the Mimail family. File size is 10784 bytes]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55843/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55842/dk</link>
  <description><![CDATA[This is an email worm in the Mimail family. File size is 12832 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55842/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mimail.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55841/dk</link>
  <description><![CDATA[This is an email worm which uses several security flaws in order to execute an exe program from within what appears to be a HTML file.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55841/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Matcher@mm.28672]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55840/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55840/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Mari.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55839/dk</link>
  <description><![CDATA[This is a minor variant in the W32/Mari series of email worms. It is quite similar to the rest of the family - the main changes seem to be some of the text-fields inside - references to "marijuana" are changed into "skatedork", and the pro-marijuana message box shown in the other variants have been changed to a rant against a person at skatedork.com.It will only work under Win9x/ME because of it's dependence on RegisterServiceProcess, a function that does not exist in Windows NT/2000/XP.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55839/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Malware]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55838/dk</link>
  <description><![CDATA[This is something possibly viral that is detected by Norman Sandbox.
If the Sandbox detects something unknown like this, you should first make sure that your NVC installation is completely up-to-date. If your installation is outdated, the Sandbox may have detected a virus that has recently been added to the definition files.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55838/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Maldal.I@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55837/dk</link>
  <description><![CDATA[This is another email worm in the Maldal series.This variant is 23552 bytes long, and compressed with the compression program Aspack.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55837/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/maldal_i_2.gif/dk?size=preview" length="4759" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Maldal.G@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55836/dk</link>
  <description><![CDATA[This is a variant in the Maldal email worm series. So far there are at least seven variants in this family.

This variant is compressed using the Aspack compression utility, and is 27648 bytes long.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55836/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Maldal.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55835/dk</link>
  <description><![CDATA[This is a variant in the Maldal email worm series. So far there are at least seven variants in this family.This variant is compressed using the Aspack compression utility, and is 27136 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55835/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Maldal.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55834/dk</link>
  <description><![CDATA[This is an email worm which will attempt to send itself to all users in the Outlook address book.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55834/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Maldal.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55833/dk</link>
  <description><![CDATA[This is an email worm that sends itself to all users in the Outlook address book. It is written in Visual Basic.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55833/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Magistr.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55832/dk</link>
  <description><![CDATA[This is a new variant of the dangerous W32/MagistrA@mm worm.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55832/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Magistr.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55831/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55831/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lovgate.K@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55830/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55830/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lovgate.J@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55829/dk</link>
  <description><![CDATA[This is a further development of the Lovgate email worm series, of which Lovgate.F has been the most prominent. The J variant has added file infection capability.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55829/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lovgate.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55828/dk</link>
  <description><![CDATA[This is an email worm that also spreads over network shares. File size is 107008 bytes.

Note that the variant called W32/Lovgate.G@mm is also detected as the F variant.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55828/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lovgate.B@m]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55827/dk</link>
  <description><![CDATA[This is an Aspack-compressed email and network worm, originally written in C. File size is 78848 bytes. It will also install a backdoor trojan.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55827/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lovgate.AJ]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55826/dk</link>
  <description><![CDATA[This is an email/network worm very similar to Lovgate.F. File size is 152&nbsp;064 bytes.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55826/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lirva.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55825/dk</link>
  <description><![CDATA[This worm is similar to the W32/Lirva.A worm. 

In contrast to its predecessor, it attempts to download a BackOrifice backdoor server from a web site in Kazakhstan. The download sites have however been closed.

The worm is 34815 bytes long.

When run, it copies itself to the Windows System directory, under a random name. It will also make copies of itself in the root directory and in the TEMP directory. A key will be inserted in the Registry so that the worm is started from bootup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run &quot;Avril Lavigne - Muse&quot; = filename.
It will not be visible in the task list under Win9x/ME.
The worm searches local files as well as the Windows Address Book for email addresses to send itself to. In addition it attempts to copy itself over shared network drives, and to send itself over IRC and ICQ. It will also copy itself into the shared files directory if the file sharing software Kazaa is installed.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55825/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lirva.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55824/dk</link>
  <description><![CDATA[This is a mass-mailing worm, written in C and compressed using UPX to a file size of 32766 bytes. 

When run, it copies itself to the Windows System directory, under a random name. It will also make copies of itself in the root directory and in the TEMP directory. A key will be inserted in the Registry so that the worm is started from bootup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run &quot;Avril Lavigne - Muse&quot; = filename.

It will not be visible in the task list under Win9x/ME.

The worm searches local files as well as the Windows Address Book for email addresses to send itself to. In addition it attempts to copy itself over shared network drives, and to send itself over IRC and ICQ. It will also copy itself into the shared files directory if the file sharing software Kazaa is installed.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55824/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Lioten.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55823/dk</link>
  <description><![CDATA[This is a network crawler that spreads over shares on NT networks. Users on Win9x/ME systems will not be affected.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55823/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Linong.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55822/dk</link>
  <description><![CDATA[This is an email worm and a network crawler.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55822/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/linong.jpg/dk?size=preview" length="4017" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Klez.H@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55821/dk</link>
  <description><![CDATA[General commentsThis is a new email worm in the Klez series. It is in many ways similar to the previous variants, but some destructivity has been removed.The worm spreads over email using email addresses picked from several sources on the infected computer - web pages, Windows address book, and ICQ contact lists. Note that it will also use a random address as sender, so the one who appears to be the sender does not neccessarily have to be the real sender. The email is formatted in such a way that the worm may get executed without the user having to click on any attachment.The worm makes copies of itself on the local machine and on network shares in both a plain executable form and in an archive with a *.RAR extension.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55821/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Klez.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55820/dk</link>
  <description><![CDATA[This is a variant in the Klez worm family, which has also been expanded with basic file-infecting capabilities.

It carries with it a file infecting virus, W32/Elkern.B.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55820/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Klez.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55819/dk</link>
  <description><![CDATA[This is a variant of the W32/Klez.A@mm worm.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55819/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Klez.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55818/dk</link>
  <description><![CDATA[This is a variation on the W32/Klez.A@mm worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55818/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Klez.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55817/dk</link>
  <description><![CDATA[This is an email worm that also carries with it a file infecting virus - W95/Elkern.A

In its original form the worm is 57345 bytes long, but size may vary since the worm itself often gets infected by the virus it carries.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55817/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Intruzzo.1_0]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55816/dk</link>
  <description><![CDATA[This is a simple backdoor written in Visual Basic. It consists of two parts - one client part which is used by the hacker, and a server part which is unknowingly run by the user.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55816/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Hybris@m]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55815/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55815/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/HLLC.Sash.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55814/dk</link>
  <description><![CDATA[This is a simple companion-type virus, which infects EXE files.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55814/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/hllc_sash.gif/dk?size=preview" length="5899" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Hiton.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55813/dk</link>
  <description><![CDATA[Hiton.A is a mass mailing worm. File size is either 45,036 bytes or 65,028 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55813/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Haxdoor]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55812/dk</link>
  <description><![CDATA[Haxdoor is a large family of backdoor and rootkit combinations. This was first found as early as 2003, but is still being distributed at the time of writing.
&nbsp;
&nbsp;
&nbsp;

The malware is created by a creation kit that is for sale on the Internet, and that allows attackers to easily make custom variants. Several hundred variants (at least) exist.
Typical Installation
The trojan is installed via malicious web pages or spammed out as attachments to email. Once run, it usually copies several components to the %SYSTEM% folder and registers one of them as a service. It then modifies registry keys so that specified functions will be called in this service.
Example:
File system changes:
Creates file %TEMP%10320054.gif.
Creates file %SYSTEM%\dvb03a.dll.
Creates file %SYSTEM%\qo.dll.
Creates file %SYSTEM%\dvb06a.sys.
Creates file %SYSTEM%\qo.sys.
Creates file%SYSTEM%\dvb03a.sys.
Deletes file lps.dat.
Registry changes:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a&quot;. 
DllName=dvb03a.dll
Startup=DVBz637890
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dvb06a.sys &quot;&quot;=Driver
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dvb06a.sys&quot;. &quot;&quot;=Driver
HKLM\System\CurrentControlSet\Services\dvb06a
ImagePath=%SYSTEM%\dvb06a.sys
DisplayName=WDVB 05
In this example the malware uses the name dvb06a, but names used are variable. Usually installations will include at least one driver (*.SYS) and one library (*.DLL) and be installed by an executable (*.EXE).
Once installed, the malware components will typically neither be visible in the process list nor as files on disk, and special tools or rootkit-aware antimalware utilities are needed to uncover their presence.
The variables %SITE% and %SYSTEM% refers to specific web sites used, and the Windows System folder, respectively.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55812/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Hai.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55811/dk</link>
  <description><![CDATA[This is a worm that does not spread over mail. Instead it spreads over open network shares; a so-called "network creeper".There are at least two variants of this worm. Both are packed/encrypted using teh PELOCK protection program.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55811/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Goner.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55809/dk</link>
  <description><![CDATA[This is an email and ICQ worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55809/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/goner2.gif/dk?size=preview" length="7317" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Gokar.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55808/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic, which also has been compressed with UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55808/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Gibe.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55807/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic. The main part of the worm is 155648 bytes long. It also appears to install a backdoor.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55807/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Gibe.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55806/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic. File size is 122880 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55806/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/w32_gibe2.jpg/dk?size=preview" length="7634" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Ganda.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55805/dk</link>
  <description><![CDATA[This is an email virus which seems to originate in Sweden. It contains a lot of text in Swedish. The worm sends itself using it's own SMTP engine and is not dependant upon any mail program in particular.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55805/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FunLove.4099]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55804/dk</link>
  <description><![CDATA[This is a virus that infects Windows executable (*.EXE, *.SCR and *.OCX) files on both Win9x/Me and WinNT/2000. When run, it will install a file called FLCSS.EXE in the windows system directory (e.g. C:\WINDOWS\SYSTEM or C:\WINNT\SYSTEM32).Under WinNT this file is running as a system process service and infects files on local disks and will also spread itself to shared network drives. Under Win9x it runs as a hidden program not visible in the task list.If it is run on an NT administrator account on NT 4.0, it will attempt to patch the files NTOSKRNL.EXE and NTLDR in such a way that NT's admin privileges are given to all that asks for it.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55804/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Frethem.K@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55803/dk</link>
  <description><![CDATA[This is another worm in the Frethem family.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55803/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Frethem.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55802/dk</link>
  <description><![CDATA[This is an email worm that sends itself to addresses found in the Windows Address Book and other sources. File size is 35840 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55802/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Frantes.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55801/dk</link>
  <description><![CDATA[This is an Italian email worm, compressed with the Petite compression program. File size is 34761.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55801/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Fizzer.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55800/dk</link>
  <description><![CDATA[This is an email worm written in C, file size is approximately 220k (though size may vary).It contains some backdoor functionality.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55800/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Finaldo.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55799/dk</link>
  <description><![CDATA[This virus is a largely rewritten variation of the W32/Finaldo.A virus. When it is first activated on the users machine, it will create a static file in the TEMP directory called FinalDoom.dll, which is immediately loaded and run. In addition it creates a file called FinalDoom.eml, which is basis for the emailing routine.It will then attempt to infect EXE, SCR and OCX files on local and network drives, and send itself over email as replies to messages in the users mailbox.The virus is very buggy and may cause applications to crash.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55799/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Finaldo.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55798/dk</link>
  <description><![CDATA[This is a polymorphic virus which infects EXE files. It will create a file in the Windows TEMP directory called FinalDoom.EXE.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55798/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FileInfector]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55797/dk</link>
  <description><![CDATA[This is something possibly viral that is detected by Norman Sandbox.

W32/FileInfector is a generic description of a virus infecting regular executables.

If the Sandbox detects something unknown like this, you should first make sure that your NVC installation is completely up-to-date. If your installation is outdated, the Sandbox may have detected a virus that has recently been added to the definition files.

If an up-to-date NVC installation still detects the file in question as W32/FileInfector,Norman has not included it in the virus definition files. If it were in the definition files it would have been given a distinct name and regular detection would have been added. The sandbox should always give a short analysis whether the malicious program is a worm or a virus. This can be found in the log file or in your message console.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55797/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Feebs]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55796/dk</link>
  <description><![CDATA[Feebs is a family of email and peer-to-peer worms.  They normally attempt to steal some confitential information, as well as disable some security-related software.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55796/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FBound.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55795/dk</link>
  <description><![CDATA[This is a small email worm, 12288 bytes long. It is very similar to W32/FBound.B.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55795/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FBound.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55794/dk</link>
  <description><![CDATA[This is a small email worm, 12288 bytes long.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55794/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/FBound.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55793/dk</link>
  <description><![CDATA[This is a small email worm. File size is 24576 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55793/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/w32_zcrypt.jpg/dk?size=preview" length="7273" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/ExploreZip.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55792/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55792/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/ExploreZip.N@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55791/dk</link>
  <description><![CDATA[This is a variant of the &quot;old&quot; W32/ExploreZip worm from 1999. It is repacked using a slightly modified UPX compressor to a file size of 91048 bytes.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55791/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/ExploreZip.120495.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55790/dk</link>
  <description><![CDATA[This worm is a standard W32/ExploreZip.210432.Worm (the original ExploreZip), except that it has been compressed with a popular compression program, Neolite.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55790/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/EmailWorm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55789/dk</link>
  <description><![CDATA[This is something possibly viral that is detected by Norman Sandbox.

W32/Emailworm is a generic description of a worm spreading over email

If the Sandbox detects something unknown like this, you should first make sure that your Norman antivirus installation is completely up-to-date. If your installation is outdated, the Sandbox may have detected a virus that has recently been added to the definition files.

If an up-to-date Norman antivirus installation still detects the file in question as W32/EmailWorm, Norman has not included it in the virus definition files. If it were in the definition files it would have been given a distinct name and regular detection would have been added. The sandbox should always give a short analysis whether the malicious program is a worm or a virus. This can be found in the log file or in your message console.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55789/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/ElKern.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55788/dk</link>
  <description><![CDATA[This is a minor variant of the W32/ElKern virus.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55788/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Elkern.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55787/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55787/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Eira.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55786/dk</link>
  <description><![CDATA[This is a simple email worm written in Visual Basic, which uses Microsoft Outlook to spread.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55786/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Dumaru.Y@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55785/dk</link>
  <description><![CDATA[This is an email worm in the Dumaru family.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55785/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Dumaru.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55784/dk</link>
  <description><![CDATA[This is an email worm that pretends to be a patch from Microsoft. However, Microsoft never sends out patches by mail.File size is about 9.2k. The file is packed using UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55784/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Doomjuice.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55783/dk</link>
  <description><![CDATA[This is a worm, vaguely similar to the MyDoom worm family. It does not have email propagation, which makes it different enough to deserve a new name.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55783/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Donut.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55782/dk</link>
  <description><![CDATA[This is a virus written as a proof-of-concept to demonstrate the infection of Microsoft .NET files.It needs the .NET runtime (MSCOREE.DLL) to be installed to work.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55782/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Dinoxi.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55781/dk</link>
  <description><![CDATA[W32/Dinoxi.A is a AOL-messenger worm written i Visual Basic. File size is 266 240 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55781/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Darce.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55779/dk</link>
  <description><![CDATA[W32/Darce.A is a multi-component trojan that is packed using UPX and RAR. Filesize is 259,012 bytes or 258,999 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55779/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Cycle.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55778/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55778/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/CodeRed.F]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55777/dk</link>
  <description><![CDATA[This is a minor variant of W32/CodeRed.C - only two bytes differ.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55777/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/CodeRed]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55776/dk</link>
  <description><![CDATA[Another worm seen in the wild some days after the original one also installs a backdoor on compromized servers.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55776/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Chet.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55775/dk</link>
  <description><![CDATA[This is an email worm written in C, file size 26628 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55775/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Cervivec.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55774/dk</link>
  <description><![CDATA[This is an email worm written in Delphi and then compressed using UPX down to a size of 227872 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55774/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/cervivec_1.gif/dk?size=preview" length="5018" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Certen.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55773/dk</link>
  <description><![CDATA[This is an email worm written in Visual Basic and compressed using UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55773/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bymer.A.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55772/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55772/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bugbear.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55771/dk</link>
  <description><![CDATA[This is an email and network virus. The virus is written in Visual C and compressed down to a file size of 72192 bytes.

It will also drop a keylogging trojan.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55771/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bugbear.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55770/dk</link>
  <description><![CDATA[This is an email worm written in Visual C and compressed using UPX to a file size of 50688 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55770/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bropia.E]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55769/dk</link>
  <description><![CDATA[W32/Bropia.E is an MSN worm written in Visual Basic. This variant also drops a copy of W32/SDBot.DPH.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55769/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Brid.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55768/dk</link>
  <description><![CDATA[This is an email worm, written in Visual Basic 6, which also drops a new variant of an old file-infecting virus.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55768/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Botmirc.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55767/dk</link>
  <description><![CDATA[This is not a virus or trojan, but a commercial application which is used as a tool by several backdoors and denial-of-service tools. 

The original version of this application, MIRC32.EXE, is a very popular Internet Relay Chat client, and is not detected by Norman's antivirus products. 

The only difference between the original version and Botmirc is that Botmirc is packed using a known compression program, and is as such easy to distinguish from the original.

It is important to understand that Botmirc is not malicious per se; instead it provides functions that enables backdoors and DOS tools to be remote controlled from IRC.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55767/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bofra.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55766/dk</link>
  <description><![CDATA[This family has now been renamed to Bofra, after deciding that these worms are too different from the Mydoom family to belong there.File size is 21508 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55766/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blebla@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55765/dk</link>
  <description><![CDATA[This is an worm that spreads over e-mail. It exploits a known security hole in Microsoft Internet Explorer 5 and Microsoft Outlook, called the Microsoft IFrame vulnerability. This security hole enables the worm to spread without the need to click on any attachment.A description of the security hole is to be found here: http://www.ntsecurity.net/Articles/Index.cfm?ArticleID=9474&SearchString=iframe]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55765/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blaster.F]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55764/dk</link>
  <description><![CDATA[This is a new variant in the W32/Blaster series of worms. It is similar to the W32/Blaster.A variant except for a couple of details.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55764/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blaster.D]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55763/dk</link>
  <description><![CDATA[This is a variation of the Blaster.A worm. The file size is 11776 bytes.

It is otherwise very similar to the A variant, except for the filename mspatch.exe and some text inside the virus body.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55763/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blaster.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55762/dk</link>
  <description><![CDATA[This is a variation of the Blaster.A worm. The file size is 7200 bytes; or 11296 bytes unpacked.

It is otherwise identical to the A variant, except for the filename penis32.exe.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55762/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blaster.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55761/dk</link>
  <description><![CDATA[This is a variation of the Blaster.A worm. This variation is compressed using the FSG compressor, file size is 5360 bytes.

It is otherwise identical to the A variant, except for the filename (teekids.exe), and some text inside the worm body.



&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55761/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Blaster.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55760/dk</link>
  <description><![CDATA[This worm spreads using a buffer overflow exploit in Windows DCOM RPC service. The file, called MSBlast.exe, is 6176 bytes long, and compressed using UPX.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55760/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagz.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55759/dk</link>
  <description><![CDATA[W32/Bagz.F is a mass-mailing/network worm, compressed using UPX to a file-size of 166,914 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55759/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.U@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55758/dk</link>
  <description><![CDATA[Bagle.u is a mass mailing worm compressed using FSG to a file size of 8208 bytes. Compared to previous Bagle variants this one is greatly simpified.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55758/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.R@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55757/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55757/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.Q@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55756/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55756/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.O@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55755/dk</link>
  <description><![CDATA[Another worm in the Bagle family.
Closely resembles W32/Bagle.N, though some new functionality seems to be added.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55755/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.N@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55754/dk</link>
  <description><![CDATA[This Bagle variant is a file infecting virus as well as spreading over email.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55754/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.J@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55753/dk</link>
  <description><![CDATA[This is an email worm in the Bagle series, somewhat reworked. This variant is 12288 bytes in size, and is packed using UPX. It will go inactive from April 25th 2005.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55753/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.F@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55752/dk</link>
  <description><![CDATA[This is an email worm, somewhat similar to the W32/Bagle.E@mm worm. This variant is approximately 23k in size, and is packed using a anti-debugging encryption tool called PeX.
It will stop working March 25th 2005.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55752/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.E@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55751/dk</link>
  <description><![CDATA[This is an email worm, somewhat similar to the W32/Bagle.C@mm worm.
This variant is approximately 17k in size, and is packed using a anti-debugging encryption tool called PeX. It will stop working March 25th 2004.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55751/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.D@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55750/dk</link>
  <description><![CDATA[This is an email worm. It is very similar to W32/Bagle.C@mm.
The main differences are that the registry entry where it stores its own data is called

HKCUSOFTWAREDateTime3 (the C variant used DateTime2)

and the mutex created to stop it running multiple copies of itself is called imain_m2 instead of imain_mutex.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55750/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.C@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55748/dk</link>
  <description><![CDATA[This is an email worm. File size is 15872 (UPX packed) or 28160 bytes (unpacked). It will remove itself if date is later than March 14th 2004.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55748/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55747/dk</link>
  <description><![CDATA[This is an email worm in the Bagle family and closely related to the Mitglied backdoor/worm family. It has a timeout function, and will stop spreading Feb 25th 2004.The file is compressed with UPX, file size 11264 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55747/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AV@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55746/dk</link>
  <description><![CDATA[This is an email worm in the Bagle series. File size is originally approximately 19k, but live infections are usually bigger.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55746/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AQ@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55745/dk</link>
  <description><![CDATA[This is an email and P2P worm. File size is 19-24k, size varies because files usually are appended with garbage data.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55745/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AK]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55744/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55744/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AI@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55743/dk</link>
  <description><![CDATA[W32/Bagle.AI@mm is a mass mailing worm compressed using PEX 0.99.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55743/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AH@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55742/dk</link>
  <description><![CDATA[W32/Bagle.AH@mm is a mass mailing worm compressed using PeX 0.99. Filesize is variable, but is typically between 20 and 32 KBytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55742/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AF@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55741/dk</link>
  <description><![CDATA[W32/Bagle.AF@mm is a mass mailing worm compressed using PEX. Filesize is variable.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55741/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.AE@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55740/dk</link>
  <description><![CDATA[This is an email worm in the Bagle series. File size is variable.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55740/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Bagle.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55739/dk</link>
  <description><![CDATA[This is an email worm, size is 15872 bytes. It will stop functioning January 28th 2004.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55739/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Badtrans.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55737/dk</link>
  <description><![CDATA[This is a variant of the known Badtrans.A worm, updated with some new tricks.

When run, it will copy itself to the Windows system directory under the name KERNEL32.EXE - should not be mistaken for the Windows main library KERNEL32.DLL.

It will also set a key in the registry
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Kernel32 = KERNEL32.EXE
in order to execute automatically during startup.




&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55737/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Badtrans.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55736/dk</link>
  <description><![CDATA[This is an internet worm that spreads via Microsoft Outlook. It does this by replying to unread messages in the user?s inbox.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55736/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/BackOrifice_2k.Trojan]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55735/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55735/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/AutoUpdater.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55734/dk</link>
  <description><![CDATA[This is a tool which installs an additional toolbar to your browser. As it turns out, this software seems to be silently installed by a number of websites through known browser security holes. Once installed, the initial component will download and install other components belonging to the package.The full functionality of the tool is still somewhat unclear, but it is a fact that at least in some cases it installs completely silently without any user notification at all.There are a number of files installed by this tool:mnsvc.exe (initial download component)ausvc.exe absr.exeauupg.exebvt.exeWe have so far not been able to pinpoint any overtly malicious action conducted by this tool, but we consider the silent installation of it as worrisome. We may remove detection later if the tool changes behaviour.The scanner will detect these as belonging to the group "aggressive commercials"; a group of software encompassing among other things adware and spyware.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55734/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Ascetic.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55733/dk</link>
  <description><![CDATA[This is a trojan of 53801 bytes that has been spammed out. After executing this trojan it will send out lots of messages. The messages are text-only messages and do NOT contain a copy of the trojan.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55733/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Apost.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55732/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55732/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/apost1.gif/dk?size=preview" length="5872" type="image/gif" />
  </item>
<item>
  <title><![CDATA[W32/Aplore.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55731/dk</link>
  <description><![CDATA[This is an email and web (and partly IRC and AOL Instant Messenger worm), written in Delphi and compressed using UPX to a file size of 319488 bytes.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55731/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/psec_1.jpg/dk?size=preview" length="7410" type="image/jpeg" />
  </item>
<item>
  <title><![CDATA[W32/Anset.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55730/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55730/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Aliz.4096@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55729/dk</link>
  <description><![CDATA[This is a small email worm that sends itself to users in the Windows address book.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55729/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Alcaul family]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55728/dk</link>
  <description><![CDATA[This is a huge series of worms written by the same author. They have been give a number of different names by different companies, but Norman has chosen to group them all together in the Alcaul family. Names used by other companies include (prefixes removed):
Sysnom, Freetrips, Janis, Alcarys, Syra, Toget, SexSounds, Monkey, Black, Porman, Alcop, 2002 and probably more.



&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55728/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Aladino]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55727/dk</link>
  <description><![CDATA[Aladino is a backdoor trojan. It enables the affected computer to be remote controlled. It consists of a server part which is run on the victims computer, and a client part which is run by a would-be attacker.

The server listens on TCP port 5005 and contains a keylogger, an FTP server, a telnet server and other functions.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55727/dk</guid>
  </item>
<item>
  <title><![CDATA[W32/Agent.ULL]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55726/dk</link>
  <description><![CDATA[This is a trojan horse program that installs various ad- and spyware utilities, as well as extracting and showing a child pornographic movie. File size is 193536 bytes. File name as submitted to us is &quot;childporn*******movie.mpeg.exe&quot;.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55726/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Veryfun.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55724/dk</link>
  <description><![CDATA[This is a simple email worm written in Visual Basic scripting.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55724/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.Z@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55723/dk</link>
  <description><![CDATA[This is aVB Script created by a virus creation utility called VBSWG.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55723/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/vbswg_z.gif/dk?size=preview" length="9187" type="image/gif" />
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.X@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55722/dk</link>
  <description><![CDATA[This is a new variant of the VBS/VBSWG worm family. It is created by a virus creation utility called VBSWG2.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55722/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.K@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55721/dk</link>
  <description><![CDATA[This is a new variant of the VBS/VBSWG worm family targeting those using the German language. It is created by a virus creation utility called VBSWG, which is the same utility, used to create VBS/VBSWG.J (AnnaKournikova).]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55721/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.J@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55720/dk</link>
  <description><![CDATA[This is an encrypted VB Script created by a virus creation utility called VBSWG.

The worm contains the text Vbs.OnTheFly Created By OnTheFly

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55720/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.AQ@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55719/dk</link>
  <description><![CDATA[This is an encrypted email, network and IRC worm written in VB script. It is created by the worm creation tool Visual Basic Script Worm Generator (VBSWG).]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55719/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/vbswg_aq.gif/dk?size=preview" length="4601" type="image/gif" />
  </item>
<item>
  <title><![CDATA[VBS/VBSWG.AF@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55718/dk</link>
  <description><![CDATA[This worm is generated by the known virus generation kit VBSWG. The worm is hyped by media as a consequence of the reports on Anthrax infections on human beings autumn 2001.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55718/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Updatr.C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55717/dk</link>
  <description><![CDATA[This is a Visual Basic Script worm installed by another the W32/Updatr.C@mm worm.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55717/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Updatr.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55716/dk</link>
  <description><![CDATA[This is a small VB Script worm that is installed by the W32/Updatr.A@mm worm.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55716/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Tune.A/B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55715/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55715/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Timofon.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55714/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55714/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Stages.A@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55713/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55713/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Req.A@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55712/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55712/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Redlof.A@m]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55711/dk</link>
  <description><![CDATA[This is an encrypted Visual Basic script virus.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55711/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Pleh.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55710/dk</link>
  <description><![CDATA[This particular virus is not polymorphic and will activate whenever the scriptfile is executed/opened.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55710/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Placid.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55709/dk</link>
  <description><![CDATA[This is a simple email and IRC worm written in Visual Basic Script.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55709/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Netlog.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55708/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55708/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/LoveLetter.BD@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55706/dk</link>
  <description><![CDATA[VBS/LoveLetter.BD@mm is a variant of VBS/LoveLetter.A@mm, but has been rewritten severely.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55706/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/LoveLetter.AS@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55705/dk</link>
  <description><![CDATA[VBS/LoveLetter.AS@mm is a variant of VBS/LoveLetter.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55705/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/loveletter_as_1.gif/dk?size=preview" length="6852" type="image/gif" />
  </item>
<item>
  <title><![CDATA[VBS/LoveLetter.A-V@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55704/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55704/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Jean.A@mm.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55703/dk</link>
  <description><![CDATA[VBS/Jean is a Visual Basic Script worm.

Common for all VBS script using e-mail to propagate, is that they all make use of MS Windows Scripting Host (WSH). WSH is default installed by Win98/Me, Win2000 and Internet Explorer 5. 
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55703/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Haptime.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55702/dk</link>
  <description><![CDATA[This is a variant of the VBS/Haptime virus. The main changes are in file names used and that the message &quot;I am sorry happy time&quot; has been changed to &quot;What a KING SIZE PIG!!&quot;
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55702/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Haptime.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55701/dk</link>
  <description><![CDATA[VBS/Haptime is a virus that infects files with extensions HTML, VBS, HTM, ASP and HTT.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55701/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/GenMail]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55700/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of Visual Basic scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on by email.

There are several such detections in our definition files; they are distinguished by a letter - f.ex VBS/GenMail.A or VBS/GenMail.D. The difference lies in what characteristics these definitions look at to determine whether the examined file contains something viral.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55700/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/FriendMess.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55699/dk</link>
  <description><![CDATA[This is a destructive email worm, based on the same principles as VBS/LoveLetter, but totally rewritten.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55699/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/FreeLinks]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55698/dk</link>
  <description><![CDATA[VBS/Fireburn is a VBS (Visual Basic Script) worm using WSH (Windows Scripting Host). WSH is default installed by Win98/Me, Win2000 and Internet Explorer 5.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55698/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Fool.A-C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55697/dk</link>
  <description><![CDATA[VBS/Fool is a Visual Basic Script. Common for all VBS script is that they make use of MS Windows Scripting Host (WSH) to infect other files. WSH is default installed by Win98 and Win2000.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55697/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/vbs_fool.gif/dk?size=preview" length="9997" type="image/gif" />
  </item>
<item>
  <title><![CDATA[VBS/Fireburn@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55696/dk</link>
  <description><![CDATA[VBS/Fireburn is a VBS (Visual Basic Script) worm using WSH (Windows Scripting Host). WSH is by default installed with Win98/Me, Win2000 and Internet Explorer 5.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55696/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/fireburn.gif/dk?size=preview" length="4443" type="image/gif" />
  </item>
<item>
  <title><![CDATA[VBS/Drodo]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55695/dk</link>
  <description><![CDATA[This is a VBS worm that tries to infect MS Word Normal.dot and overwrite all .htm, .html and .txt but doesn't succeed very well. The vbs script is embedded in HTML. When run, this script will infect the normal.dot file, but the infection is non-virual and will not spread further. It then tries to overwrite all .htm, .html and .txt files but because of bugs in the code this fail.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55695/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Districts.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55694/dk</link>
  <description><![CDATA[This is a Visual Basic script worm that spreads via the MSN Messenger communication program.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55694/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Dismissed.B@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55693/dk</link>
  <description><![CDATA[This is a script virus that is helped distributed by the W32/Maldal.C worm.

It is an updated variant of the VBS/Dismissed.A virus.

&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55693/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Dismissed.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55692/dk</link>
  <description><![CDATA[This is a script virus that is helped distributed by the W32/Maldal.C worm.

The Maldal worm sets the Internet Explorer home page to point to an infectious page on Geocities.
This home page contains a javascript that will attempt to plant and run a malicious Visual Basic script virus - VBS/Dismissed - on the users hard disk. This page is now down, so further infection should be stopped.

This script is located on the root directory under the name ROL.VBS, and will:

    Set the start page of Internet Explorer to a different site.
    copy itself to the Windows directory as Zacker.vbs
    create Dalal.HTM to the Windows directory. This file contains only a reference to the original home page on geocities.
    Delete files from a number of antivirus installations.
    Copy ZACKER.VBS and DALAL.HTM to the root directory of available network drives under the names SERVER.VBS and DALLAH.HTM, respectively.
    Look for ASP, HTM anf HTML files and append a reference to the infectious web site
    Look for LNK, ZIP, JPG, JPEG, MPG, MPEG, DOC, XLS, MDB, TXT, PPT, PPS, RAM, RM, MP3 and SWF files and create a copy of Zacker.vbs under the same name, but with an appended .VBS extension. So, if you have a file called FILE.ZIP, you will get an infectious copy called FILE.ZIP.VBS. The original file will be deleted. This can cause a lot of destruction.
    If it finds a file called MIRC.INI, it will overwrite all INI files in that directory with a small string that will advertise the infectious URL every time the user is on IRC.
    Depending on a semi-random value, it will attempt to delete all files in the Windows directory and its subfolders. It then will display a messagebox containing antisemitic text, and reboot the machine.
    Some of this functionality seems to be somewhat buggy and may not work properly.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55692/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/CoolNot@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55691/dk</link>
  <description><![CDATA[VBS/CoolNot is a Visual Basic Script Worm similar to  VBS/LoveLetter.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55691/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Cidco]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55690/dk</link>
  <description><![CDATA[This is a small worm which copies it self to "C:\program files\Common files\Symantec Shared\VirusDefs\lulock.dat" and creates a key in the registry to run this file each time Windows is started. It then searh through all local disks and mapped networks drives after files with a .VBS extension and overwrites them with its own code.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55690/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Bubble.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55689/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55689/dk</guid>
  </item>
<item>
  <title><![CDATA[VBS/Ablank.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55687/dk</link>
  <description><![CDATA[This is a simple email worm written in VB Script.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55687/dk</guid>
  </item>
<item>
  <title><![CDATA[Upgrade Internet.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55686/dk</link>
  <description><![CDATA[Language versionsSpanish, English.The first version of this hoax was in Spanish, but an English translation has later appeared.Description of the hoaxThe "Upgrade Internet" hoax is also seen in an "Upgrade Internet2" variant that only has minor changes from the original version.Note that known viruses use some of the file names mentioned in these variants.Spanish version Si reciben un mail titulado "up-grade internet2 " NO LO ABRAN ,ya que contiene un ejecutable con un ?cono muy gracioso ,el ejecutable se llama PERRIN.EXE. Este virus borrar? toda la infomaci?n del disco duro ,y de alguna manera se refugia en la memoria del computadora ,por lo que cada vez que carguen informaci?n en el disco duro ,este lo borrar? De nuevo ,dejando practicamente inservible la computadora. Esta informaci?n fu? publicada ayer en la p?gina Web de la CNN.Se ha dicho que este virus es muy peligroso y que a?n no existe antivirus para el. Reenvien este mensaje a toda la gente que puedan ,ya que si bien es cierto no puede ser detenido ,al menos que salga perjudicada la menor cantidad de gente posible.English versionPls, carefully ! !PLEASE SEND THIS INFORMATION TO EVERY PERSON IN YOUR ADDRESS BOOK.IF YOU RECEIVE AN E-MAIL THAT READS "UPGRADE INTERNET" DO NOT OPEN IT, AS IT CONTAINS AN EXECUTABLE NAMED "PERRIN.EXE." IT WILL ERASE ALL THE DATA IN YOUR HARD DRIVE AND IT WILL STAY IN MEMORY. EVERY TIME THAT YOU UPLOAD ANY DATA, IT WILL BE AUTOMATICALLY ERASED AND YOU WILL NOT BE ABLE TO USE YOUR COMPUTER AGAIN.THIS INFORMATION WAS PUBLISHED YESTERDAY IN THE CNN WEB SITE. THIS IS A VERY DANGEROUS VIRUS. TO THIS DATE, THERE IS NO KNOWN ANTIVIRUS PROGRAM FOR THIS PARTICULAR VIRUS. PLEASE FORWARD THIS INFORMATION TO YOUR FRIENDS, SO THAT THEY WILL BE ON THE ALERT. ALSO CHECK THE LIST BELOW, SENT BY IBM, WITH THE NAMES OF SOME E-MAILS THAT, IF RECEIVED, SHOULD NOT BE OPENED AND MUST BE DELETED IMMEDIATELY, BECAUSE THEY CONTAIN ATTACHED VIRUSES. THIS WAY YOUR COMPUTER WILL BE SAFE.THE TITLES ARE:1) buddylst.exe2) calcu18r.exe3) deathpr.exe4) einstein.exe5) happ.exe6) girls.exe7) happy99.exe8) japanese.exe9) keypress.exe10) kitty.exe11) monday.exe12) teletubb.exe13) The Phantom Menace14) prettypark.exe15) UP-GRADE INTERNET216) perrin.exe17) I love You18) CELCOM Screen Saver or CELSAVER.EXE19) Win a Holiday (e-mail)20) JOIN THE CREW O PENPALSONCE AGAIN, DO NOT OPEN THESE E-MAILS especially all attachment with exe extension.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55686/dk</guid>
  </item>
<item>
  <title><![CDATA[SWF/LFM.926]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55685/dk</link>
  <description><![CDATA[This is the first virus to infect Shockwave Flash (*.SWF) animation files. It will only work on Windows NT based platforms.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55685/dk</guid>
  </item>
<item>
  <title><![CDATA[Sulfnbk.EXE.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55684/dk</link>
  <description><![CDATA[Language versionsIts original language seems to be English but there are variants in several other languages. Description of the hoaxAn email that warns about the file SULFNBK.EXE, and advices the email recipient to delete this file from his/her computer. This file is part of some Windows installations and provides support for backing up long file names, and should not be deleted. It can of course be infected, as any other program file.This hoax was first reported to Norman in May 2001.As most hoaxes do, it encourages you to everyone you have sent mail to the last months. Please DO NOT DO THAT! Just delete the mail. The hoax message (English version) is referred above.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55684/dk</guid>
  </item>
<item>
  <title><![CDATA[SULFNBK.EXE]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55683/dk</link>
  <description><![CDATA[This is a known hoax - a false virus warning. It has been around since early 2001.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55683/dk</guid>
  </item>
<item>
  <title><![CDATA[SubSeven.Trojan]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55682/dk</link>
  <description><![CDATA[SubSeven is a backdoor that may be used to get unauthorized access to computers. (NetBus was the first trojan that really made it easy for hackers to get access to and abuse an infected system.)

SubSeven is a client/server application. The server part has to be installed at the victim's system to gain access to it. SubSeven has all the same features as NetBus, including some more.

The SubSeven trojan can be configured to inform someone when an infected computer connects to the Internet, and tell that person all the necessary information to use the SubSeven Client part to connect to the victim's computer. This notification can be done via ICQ, IRC or Email.

The recent versions of SubSeven are supplied with a configuration utility. This configuration utility allows the user to customize the server part; Startup methods, Notification methods, Installation methods, Icon, Server filename, etc.


SubSeven can be considered to be one of the most advanced backdoor program at the Internet.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55682/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/subseven.gif/dk?size=preview" length="7694" type="image/gif" />
  </item>
<item>
  <title><![CDATA[Stoned.Angelina]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55681/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55681/dk</guid>
  </item>
<item>
  <title><![CDATA[Sober.O@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55680/dk</link>
  <description><![CDATA[Another email worm in the Sober series. File size is 53554 bytes in unpacked form.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55680/dk</guid>
  </item>
<item>
  <title><![CDATA[Slacke.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55679/dk</link>
  <description><![CDATA[Slacke.A is an internet worm that spreads over open shared drives. It connects to port 445/tcp and attempts to guess passwords. If successful, it copies itself over.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55679/dk</guid>
  </item>
<item>
  <title><![CDATA[SDBot]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55678/dk</link>
  <description><![CDATA[SDBots are worms that propagate via network shares. They also contain backdoor functionality, which connects to an IRC channel and waits for commands.
&nbsp;
Because of the similarities between many of the SDBot variants this is a generic desciption.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55678/dk</guid>
  </item>
<item>
  <title><![CDATA[PrettyPark.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55677/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55677/dk</guid>
  </item>
<item>
  <title><![CDATA[Perl/Santy.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55676/dk</link>
  <description><![CDATA[This is an internet worm that spreads between webservers running the popular bulletin board software phpBB.&nbsp;Some versions of this software (versions 2+) had a bug that could allow an attacker to run code on the server. Users should upgrade to phpBB ver. 2.0.11 or later, in which this vulnerability has been patched.
More information about this here:

    http://secunia.com/advisories/13239
    http://isc.sans.org/diary.php?date=2004-12-21]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55676/dk</guid>
  </item>
<item>
  <title><![CDATA[Parity_Boot]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55674/dk</link>
  <description><![CDATA[The Parity_Boot viruses are activated randomly, and display the message "PARITY CHECK". Then the computer halts and simulates a real error situation due to memory error. This message will appear one hour after you started to work with the computer, and only of no diskettes were infected during this time frame.If you run the DOS command CHKDSK, the total system and free memory is reduced by 1024 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55674/dk</guid>
  </item>
<item>
  <title><![CDATA[O97M/Tristate]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55672/dk</link>
  <description><![CDATA[This virus is able to cross-infect different MS Office 97 applications. It infects MS Word documents, MS Excel spreadsheets and MS Power Point presentation. The way it infects is different from each of this MS Office Applications.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55672/dk</guid>
  </item>
<item>
  <title><![CDATA[O97M/Cybernet]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55671/dk</link>
  <description><![CDATA[O97M/Cybernet.A is a polymorphic cross-infector macro virus, infecting both MS Word and MS Excel files.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55671/dk</guid>
  <enclosure url="http://www.norman.com/images/screenshots/third_party/cybernet.gif/dk?size=preview" length="3473" type="image/gif" />
  </item>
<item>
  <title><![CDATA[NoInt.A-C]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55670/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55670/dk</guid>
  </item>
<item>
  <title><![CDATA[MSH/Danom]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55669/dk</link>
  <description><![CDATA[MSH/Danom is a detection&nbsp;for a new proof-of-concept virus that infects MSH (Microsoft Shell) scripts.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55669/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_XLS]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55668/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send an Excel spreadsheet on to others, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55668/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_VBS]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55667/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on as a VB script file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55667/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_SCR]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55666/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send a SCR file (normally a screensaver) on to others, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55666/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_INI]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55665/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on as a INI file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55665/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_HTM]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55664/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on as a HTML file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55664/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_EXE]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55663/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send on an EXE file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55663/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_DOC]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55662/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send a document on to others, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55662/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_COM]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55661/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send a COM file on to others, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55661/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_CHM]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55660/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on as a CHM file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55660/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/Gen_BAT]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55659/dk</link>
  <description><![CDATA[This is a generic detection. It means that the scanner has detected a piece of IRC scripting code that it doesn't immediately recognise as a known virus, but which seems to be able to send itself on as a BAT file, and as such may be a worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55659/dk</guid>
  </item>
<item>
  <title><![CDATA[mIRC/DMSetup.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55658/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55658/dk</guid>
  </item>
<item>
  <title><![CDATA[Linux/Slapper.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55657/dk</link>
  <description><![CDATA[This is a worm written in pure C, and propagates between Linux systems only.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55657/dk</guid>
  </item>
<item>
  <title><![CDATA[Life is beautiful]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55656/dk</link>
  <description><![CDATA[This is a false virus warning (a so-called hoax).]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55656/dk</guid>
  </item>
<item>
  <title><![CDATA[Kelvir.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55655/dk</link>
  <description><![CDATA[Kelvir.B is a worm that spreads through MSN Messenger.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55655/dk</guid>
  </item>
<item>
  <title><![CDATA[Junkie]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55654/dk</link>
  <description><![CDATA[Junkie is a memory resistant, multi party encrypted virus that originated in Sweden.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55654/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/SQLSpida.B]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55653/dk</link>
  <description><![CDATA[This is a worm that spreads to machines running Microsoft SQL server.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55653/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/SQLSpida.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55652/dk</link>
  <description><![CDATA[This is a worm that spreads to machines running Microsoft SQL server.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55652/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/KAK.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55651/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55651/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Gigger.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55650/dk</link>
  <description><![CDATA[This is an email worm written in Javacript.It is detected generically by NVC as unknown virus, and is as such nothing to worry about. It is listed as being a certain threat on a couple of other web sites, but as far as we know this worm is NO THREAT AT ALL.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55650/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Fortnight.E@m]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55649/dk</link>
  <description><![CDATA[This is an email worm that consists of multiple components.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55649/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Exploit_based]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55648/dk</link>
  <description><![CDATA[This is a small piece of javascript code that is sometimes used to break through the security in Internet Explorer. Usually the code is used in connection with "planting" new default start pages, search bars, and favourites to your browser without you knowing about it.The script does this using a bug in Internet Explorer, and it is the code to "use" this bug that we detect.It is important to understand that while the script in most cases does not constitute more than an annoyance, it may be used for more destructive actions.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55648/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Coolsite.A@mm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55647/dk</link>
  <description><![CDATA[A malicious web page popup would plant a malicious javascript at unsuspecting users machines. This script would send out large amounts of mail referring to the main web page. This web page has now been closed.





&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55647/dk</guid>
  </item>
<item>
  <title><![CDATA[JS/Coolnow.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55646/dk</link>
  <description><![CDATA[This is a worm that spreads over MSN Messenger. Several variants exist.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55646/dk</guid>
  </item>
<item>
  <title><![CDATA[JPEG/Exploit.gen]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55645/dk</link>
  <description><![CDATA[JPEG/Exploit.gen is a generic detection for all JPEGs that exploit the vulnerability described in &ldquo;Microsoft Security Bulletin MS04-028 Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)&quot;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55645/dk</guid>
  </item>
<item>
  <title><![CDATA[JDBGMGR.EXE]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55644/dk</link>
  <description><![CDATA[This is another computer virus hoax, a clone of the SULFNBK.EXE hoax that has plagued the world for a while already.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55644/dk</guid>
  </item>
<item>
  <title><![CDATA[IRC script worms]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55643/dk</link>
  <description><![CDATA[]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55643/dk</guid>
  </item>
<item>
  <title><![CDATA[HTML/MyDoom]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55642/dk</link>
  <description><![CDATA[This is a detection that covers the emails generated by some MyDoom variants; in particular W32/MyDoom.AH@mm If you see this alert, it means that NVC has picked up a mail that contains the hyperlink to download and execute the above mentioned worm.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55642/dk</guid>
  </item>
<item>
  <title><![CDATA[Good times.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55639/dk</link>
  <description><![CDATA[This was the first widely spread hoax. It appeared late 1994 and warns about a file named Goodtimes that is supposed to erase your hard disk.As typically for all hoaxes it contains and exhortation to forward it to all your friends:Here is some important information. Beware of a file called Goodtimes.Happy Chanukah everyone, and be careful out there. There is a virus onAmerica Online being sent by E-Mail. If you get anything called "Good Times", DON'T read it or download it. It is a virus that will erase your hard drive.Forward this to all your friends. It may help them a lot. VariantsA lot of different variants with minor or major changes exist. Penpal Greetings is a typical variant of this hoax.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55639/dk</guid>
  </item>
<item>
  <title><![CDATA[Friend Greetings]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55638/dk</link>
  <description><![CDATA[It is debatable whether this can be called a virus or worm, as it actually tells you what it does and asks for permission. However, in our opinion it is an example of &quot;bad marketing&quot; - such things are the reasons why we made a separate detection class in Norman Virus Control for &quot;Aggressive Commercials&quot;.


&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55638/dk</guid>
  </item>
<item>
  <title><![CDATA[Form.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55637/dk</link>
  <description><![CDATA[The Form virus is a memory resident virus, which normally does not destroy data. The exception is diskettes; the virus may destroy the content on infected diskettes.
The Form.A virus does not infect files.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55637/dk</guid>
  </item>
<item>
  <title><![CDATA[Flow.461]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55636/dk</link>
  <description><![CDATA[This is a slightly encrypted DOS virus, which infects COM files using direct action method - i.e. looks for and infects files directly. On sundays it stops infected programs from working with the following message:Je suis votre ordinateur, il est dimanche je refuse donc de travailler !The virus contains the textFloW V1.4 - TiPiaX/VDS]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55636/dk</guid>
  </item>
<item>
  <title><![CDATA[Ericsson giveaway.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55635/dk</link>
  <description><![CDATA[This hoax claimes that Ericsson is offering free mobile phones to everyone forwarding the hoax to at least 8 people as well as a copy to Anna Swelund at Ericsson. According to Ericsson, this person is not an Ericsson employe. Ericsson has an article about this hoax at their web site.

It seems to be two different variants of this hoax. One that says you have to send it to 8 people and one that claims that you have to send it to 20 people to get a free mobile phone.

&nbsp;
Dear Customer,
Our main competitor, Nokia, is giving free
mobile phones away on the internet.
Here at Ericsson we want to counter their
offer. So we are giving our newest
WAP-phones away as well. They are
especially developed for internet happy customers
who value cutting edge technology. By giving free
phones away, we get valuable customer
feedback and great World-of-Mouth effect.

All you have to do, is to forward this message to
8 friends. After two weeks delivery time, you will
receive a Ericsson T18. If you forward it to 20
friends, you will receive the brand new
Ericsson R320 WAP-phone.

Just remember to send a copy toMailto:anna.swelund@ericsson.com
Mailto:Anna.Swelund@ericsson.com
That is the only way we could see that you
forwarded the message.

Best of luck
Anna Swelund
Executive Promotion Manager for Ericsson

Marketing
Language versions
English.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55635/dk</guid>
  </item>
<item>
  <title><![CDATA[Dumador.IK]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55634/dk</link>
  <description><![CDATA[Dumador.IK is a multi-component backdoor/keylogger, packed using UPX to a filesize of 26,112 bytes.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55634/dk</guid>
  </item>
<item>
  <title><![CDATA[California.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55633/dk</link>
  <description><![CDATA[This hoax warns you about an email with an attachment named California.

It claims that this file contains the &quot;very dangerous Wobbler virus&quot;. That is not true, there is no such virus. It further encourages you to send this message to everyone in you address book. The hoax asserts that this information came from IBM - which is not true.
If you receive an email with a file called &quot;California&quot;, do not open the
file. The file contains the WOBBLER virus.

This information was announced yesterday morning from IBM; AOL
States that this is a very dangerous virus, much worse than the &quot;Melissa&quot;
Some very sick individual has succeeded in using the reformat function from
Norton Utilities causing it to completely erase all documents on the hard drive.
It has been designed to work with Netscape Navigator and Microsoft Internet
This is a new, very malicious virus and not many people know about it.

Please Pass this warning along to EVERYONE in your address book
And please share it with all your online friends ASAP so that this threat
may be stopped. 
Its original language is English but there are variants in several other languages.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55633/dk</guid>
  </item>
<item>
  <title><![CDATA[Body.1383]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55632/dk</link>
  <description><![CDATA[This is a DOS virus, which infects COM files using direct action method - i.e. looks for and infects files directly. The virus contains some code to be able to insert references to itself into pascal source code.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55632/dk</guid>
  </item>
<item>
  <title><![CDATA[Bill Gates fortune]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55631/dk</link>
  <description><![CDATA[This is an email hoax, tricking users to send a chain letter on.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55631/dk</guid>
  </item>
<item>
  <title><![CDATA[Beda.3291]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55630/dk</link>
  <description><![CDATA[This is a DOS virus, which infects COM and EXE files. The virus goes resident, and infects programs when they are executed.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55630/dk</guid>
  </item>
<item>
  <title><![CDATA[BAT/Hawa.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55629/dk</link>
  <description><![CDATA[This is a simple batch trojan.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55629/dk</guid>
  </item>
<item>
  <title><![CDATA[BAT/Firkin.A, B and C.Worm]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55628/dk</link>
  <description><![CDATA[These three network worms are closely related. They consist of a set of batch files, pif files and an innocent exe file, which is used to hide the worm&rsquo;s open windows from view.
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55628/dk</guid>
  </item>
<item>
  <title><![CDATA[BAT/Becky]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55627/dk</link>
  <description><![CDATA[Simple IRC worm and BAT file virus consisting of a batch file that attempts to install an IRC script. 
&nbsp;]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55627/dk</guid>
  </item>
<item>
  <title><![CDATA[Backdoor trojans]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55626/dk</link>
  <description><![CDATA[Most backdoor trojans come in several parts. The victim usually run the server part in good faith, usually believing that it is a cool screensaver, a funny animation, or, not uncommon, something pornographic.The user will normally not see anything unusual to begin with. However, the server sets the users machine open for remote control. Machines that have been affected this way will often "advertise" their presence to malicious persons. When such a machine is being remote controlled by a hacker, it may exhibit very strange symptoms: CD-ROM door opening and closing of itself, strange messages popping up, files appearing and disappearing etc. The hacker may listen in on whatever is typed on the keyboard and shown on the screen, and also obtain sensitive documents, passwords and other data.Backdoor trojans are very common, and another good reason why you should not run any programs that come from untrusted sources.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55626/dk</guid>
  </item>
<item>
  <title><![CDATA[AntiVirus2008]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55625/dk</link>
  <description><![CDATA[AntiVirus 2008 is a family of "rogue" antivirus software that will display false virus warnings. It creates popups and attempts to connect to a series of websites to make the user download additional malware and trick them into paying for the false services the applications provide.New variants of this family are as of this writing created continously.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55625/dk</guid>
  </item>
<item>
  <title><![CDATA[AntiEXE]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55624/dk</link>
  <description><![CDATA[This virus has no visible signs of infections. What you may see is that total amount of system memory is decreased by 1024 bytes. You can see this by running the command CHKDSK in DOS. This command should normally report "655.360 total bytes memory". If the number is less then this it may indicate an infection.No variants are detected as AntiEXE only. The virus will always be detected with the name (i.e. letter) for the variant in question. E.g. AntiEXE.K, AntiEXE.A-F, etc.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55624/dk</guid>
  </item>
<item>
  <title><![CDATA[ABAP/Rivpas.A]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55622/dk</link>
  <description><![CDATA[This is a proof of concept virus written to demonstrate the possibility of viruses in the Advanced Business Application Programming (ABAP) script. Some lines in the virus have been deliberately mangled, so it is nonfunctional in its current form - i.e. an "intended" virus.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55622/dk</guid>
  </item>
<item>
  <title><![CDATA[A-OD.552/571]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55621/dk</link>
  <description><![CDATA[Two variants exist, one 552 bytes long and one 571 bytes long.These are resident DOS viruses, which infect COM files using direct action method - i.e. look for and infect files directly. They use some stealth techniques to hide file growth.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55621/dk</guid>
  </item>
<item>
  <title><![CDATA[A&A.506]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55620/dk</link>
  <description><![CDATA[This is a DOS virus, which copies itself into the interrupt vector table and remains resident there.It infects COM files as they are executed. If started between February and October it will display a screen effect.It contains the text:{A&A}]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55620/dk</guid>
  </item>
<item>
  <title><![CDATA[A Virtual Card For You.Hoax]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/55619/dk</link>
  <description><![CDATA[This is not a malicious program but a hoax.Language versionsIts original language is English but there are variants in several other languages.Description of the hoaxThe hoax claims that by opening an email with the title "A Virtual Card For You" your hard drive will be erased. This is not true. The hoax further encourages you to send the message to everyone in you address book. There are several different variants of the email body of this hoax; both in content and in language.]]></description>
  <pubDate></pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/55619/dk</guid>
  </item>
<item>
  <title><![CDATA[Virusbeskrivelser [EN]]]></title>
  <link>http://www.norman.com/security_center/virus_description_archive/dk</link>
  <description><![CDATA[Choose CharacterClick on a character above to find descriptions for that particular character. Malicious programs are listed by full name and "popular name" and common aliases. E.g. W32/Ska.Worm will be listed under:    H: as Happy99    S: as Ska    W: as W32/SkaSyntax used in the names of malicious programsThe letters/numbers before a slash represent the platform/application which the malicious program infects. The text after a slash represents the general name. Variants are represented by a dot and one or several letters at the end of the name.WM=Word 6.x/7.x W97M=Word 97 XF=Excel 4.0 formulas XM=Excel 5.0 X97M=Excel 6.0 P98M=Project 98 PP97M=PowerPoint 97 A97M=Access 97 CVS=Corel ScriptWP2kM=WordPerfect 2000 VBS=Visual Basic Script mIrc=IRC script W32=Win32 (WinNT/2000 and Win95/98/Me)W95=Win95]]></description>
  <pubDate>Fri, 14 Nov 2008 15:18:00 +0100</pubDate>
  <guid>http://www.norman.com/security_center/virus_description_archive/dk</guid>
  </item>
</channel></rss>
