|
Worm.Win32.Dato Viruses Information
| Name: |
Worm.Win32.Dato |
| Category: |
Viruses |
| Description:
|
Details
Worm.Win32.Datom
This is a network worm. It replicates via shared network resources. The worm consists of 3 different files:
MSVXD.EXE
MSVXD16.DLL
MSVXD32.DLL
The first component, MSVXD.EXE activates the worm by loading the MSVXD16.DLL library. In turn, MSVXD16.DLL loads the MSVXD32.DLL component, which performs the worming operations.
Replication
The worm searches for available network resources and tries to connect to their host computers. If the connection has been successfull, the worm then searches for a shared directory that appears to be the Windows directory: it tries the "WinNT" name, and also tries to read the "WinDir" section in the MSDOS.SYS file (if it exists and is available). Then the worm copies all its components to the remote Windows directory, and then sets MSVXD.EXE up to start with Windows automatically: if there is file called "Win.ini" in the remote Windows directory, it writes "MSVXD.EXE" string in the "Run" section of this file, otherwise it creates a link file pointing to MSVXD.exe and called "VxD Manager.lnk" in the common ("All users") Startup directory on the remote computer.
Other
The worm searched for the presence of the ZoneAlarm firewall, and tries to terminate its active instances. It also tries to send "notification" e-mail messages to one of two different addresses that may belong to the author of the worm. These messages contain information about the infected system. |
Top Viruses Visited Pages:
Invader. - 231 visits
not-a-virus:RiskWare.Tool.RegPatch. - 69 visits
Worm.P2P.Harex. - 63 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 55 visits
Small.58. - 55 visits
Coito.64 - 53 visits
I-Worm.Mapson. - 45 visits
Win16.Klon.1177 - 41 visits
Win32.Hidra - 41 visits
Marine.500 - 34 visits
Random Viruses Pages:
Terminator.150
Getto.200
Macro.Word97.Techn
Ekaterinbur
Murphy.Delirium.178
Milena.1160.
Sov.120
Eliza.128
Wogo
BadBoy.1001.
|
