"MSN ghost" creates "zombie computers" to initiate flood attacks

Source: Skynet

On June 23, January 20, the anti-virus center of Jiangmin intercepted the "MSN ghost" virus (I-worm/MSN. dropbot), the virus is transmitted through MSN, and the latest backdoor/rbot variants of "Robert" can be released. yi. Hackers can use this virus to create "zombie computers" in large quantities and manipulate these botnets to initiate network flood attacks on any target.

According to Jiang Min's anti-virus experts, the biggest harm of the "MSN ghost" virus is its ability to release the latest variant of the "Robert" virus. The "Robert" family of viruses and their close relatives, the "backdoor/Agobot" Family, allow users to be completely controlled by hackers and become "zombie computers ". This variant is capable of spreading through a variety of system vulnerabilities and weak passwords, and is highly infected. Last year, Jiangmin company intercepted nearly 3000 variants of the virus. The latest variant added the function of transmitting data via MSN, making the infection better than before.

After "MSN ghost" runs, it automatically sends a file with a virus to all MSN friends of infected computer users. In order to prevent users from manually deleting the virus, the virus will stop "maid" and "taskmgr.exe ".ProgramTo prohibit right-click operations, it is very difficult to manually clear the virus. Virus releases the oms.exe file, which is the latest variant of the "Robert" virus. After the latest variant runs, the virus file lexplore.exe is generated in the system directory, and the registry key is modified to run along with the operating system.

According to anti-virus experts, the "Robert" variant released by the "MSN ghost" is similar to the previous variant. It is mainly spread through Microsoft's WebDAV vulnerability, shock wave vulnerability, shock wave vulnerability, and weak Administrator account password, and receive hacker commands from IRC, so that infected computers are completely controlled by hackers and become "zombie computers, it may cause a large number of "botnets" in the network, providing a weapon for hackers to manipulate these botnets to initiate network flood attacks.

For this virus, Jiangmin has been upgrading immediately. Please upgrade the virus database from kv2005 to July 15, January 21. do not receive unknown programs from MSN to protect your system from this virus.