dude , you forgot to add the best one which is ''
BitDefender Total Security''
IMPORTANT NOTE : i used ''Mcafee'' and ''Kaspersky'' and i still got penetrated by the same Worm which no anti-virus stoped it except BitDefender and btw this worm is spreading fast now so be careful
heres a little description of the worm that made my life hell !
Worm.P2P.Dilly.A Spreading: high
Damage: medium
Size: random (780 Kb - 15 Mb)
Discovered: 2008 Aug 26
SYMPTOMS:
Presence of files named according to the following pattern in C: _undo_[date]_[time].bat (e.g.: C:\_undo_26-08-08_12-17-58.bat ).
Presence of files in the DC++ shared folders with a double extension ending in .SCR (e.g. .WMA.SCR, .AVI.SCR); the file names are randomly generated so as to resemble titles of pornographic movies.
TECHNICAL DESCRIPTION:
The worm is written in Delphi and has an original file size of 790,528 bytes. It spreads thorough the DC++ peer-to-peer network by copying itself to the DC++ shared folders using randomly generated file names which resemble pornographic movie titles and a double extension which ends in .SCR.
The worm locates the DC++ client folder using the registry path HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\DC++, which has a value called ShellExecute containing the path to DCPlusPlus.exe. It then opens the program's configuration file, DcPlusPlus.xml, which it expects to find in the Settings subfolder. From the coniguration file the worm retrieves the list of shared folders.
In the shared folders it has found, the worm stores copies of itself to which it appends random numbers of null bytes in order to better resemble genuine video files. It uses words from the following list to generate random names:
(full), hard, porn, ass, dildo, incest, pedo, ****ed, piss, lesbi, girls, angels, r@ygold, preteen, lolita, sex, xxx, rape, bdsm, drunk, 11yo, 10yo. It then appends a fake .WMV, .AVI, .MPG, .MP4 or .MPEG extension and after it the real .SCR extension.
It also generates a "removal" script for all the copies of itself that it creates, which is an unusual behavior for a worm. The script is a batch file with the name generated using the following pattern: [root-folder]:\_undo_[date]_[time].bat. The script contains a delete command for each copy, such as:
del "c:\shared\RAPE sex Girls R@YGOLD Xxx angels.MP4.scr"The original copy of the worm deletes itself using a batch script.
Removal instructions:
Please let BitDefender disinfect your files.
ANALYZED BY:
Vlad Ioan Topan, virus researcher
Linear Mode
