|
JS.Fortnigh Viruses Information
| Name: |
JS.Fortnigh |
| Category: |
Viruses |
| Description:
|
Details
JS.Fortnight
JS.Fortnight is an Internet worm that uses infected emails with hidden links to an Internet Web page from which it downloads its infected code.
Infected messages contain a hidden link to a Web page containing the worm. When a user opens an infected email message the link opens and downloads the worm's body and executes it in a hidden frame.
The worm uses the Microsoft VM ActiveX security vulnerability for which Microsoft released a security patch three years ago. This allows the worm's code to be executed on the local (victim) computer.
More information about this vulnerability and the patch for it is available at:
http://www.microsoft.com/technet/security/bulletin/ms00-075.asp
The Fortnight worm uses a cookie named "TF" to mark infected computers. If this cookie is absent it changes the Internet Explorer default Web page address to a pornographical site.
Next the worm copies the default signature of Outlook Express 5.0 to the file C:Program Filessign.htm with the link added to its body. All messages sent later from an infected computer contain this link.
The Fortnight worm creates 3 links in the "Favorites" folder:
"SEXXX. Totaly Teen.url"
"Make BIG Money.url"
"6544 Search Engines Submission.url"
Fortnight installs two cookies that act as infection marks.
The site that contained the worm's body was blocked as soon as the worm appeared in the wild and is still down.
I-Worm.JS.Fortnight.f
The Fortnight.f worm creates 3 links in the "Favorites" folder:
"Nude Nurses.url"
"Search You Trust.url"
"Your Favorite Porn Links.url." |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Crasher.65
Macro.Word.Macrokille
HXH.168
I-Worm.Sobig.
Macro.Word97.Cyberhac
Search.41
Sink.40
Backdoor.Throd.
Tie.61
PresidentB.150
|
