pnabais
Power Member
Atenção a este virus, porque os PC's são infectados sem qualquer intervenção dos utilizadores, desde que o windows não esteja actualizado.
Ontem já apanhei este virus num PC na rede da Netcabo.
http://vil.nai.com/vil/content/v_125007.htm
"METODO DE INFECÇÃO:
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host is accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445"
Se os vossos PC's não estiverem actualizados é boa ideia fazer um Windows Update.
Se já tiverem infectados podem remover o virus usando o Stinger,
http://vil.nai.com/vil/stinger/
Claro que depois deverão actualizar o windows para não voltar a apanhar o virus.
Ontem já apanhei este virus num PC na rede da Netcabo.
http://vil.nai.com/vil/content/v_125007.htm
"METODO DE INFECÇÃO:
This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.
This worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE. It creates a remote shell on TCP port 9996. Next it creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host. The infected host is accepts this FTP traffic on TCP port 5554.
The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The destination port is TCP 445"
Se os vossos PC's não estiverem actualizados é boa ideia fazer um Windows Update.
Se já tiverem infectados podem remover o virus usando o Stinger,
http://vil.nai.com/vil/stinger/
Claro que depois deverão actualizar o windows para não voltar a apanhar o virus.
Hey...
estranho?
