W32.Tidserv.G

Risk Level 2: Low

Printer Friendly Page

Discovered: March 22, 2009

Updated: March 25, 2009 11:50:17 AM

Also Known As: W32/TDSS.BU [F-Secure]

Type: Worm

Infection Length: 46,592 bytes; 39,879 bytes; 10,752 bytes

Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

W32.Tidserv.G is a worm that spreads by copying itself to removable drives. It may also simulate a fake DHCP server and download potentially malicious files on to the compromised computer.

Protection

Initial Rapid Release version March 22, 2009 revision 007
Latest Rapid Release version August 22, 2009 revision 038
Initial Daily Certified version March 22, 2009 revision 018
Latest Daily Certified version August 26, 2009 revision 004
Initial Weekly Certified release date March 25, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Damage

Damage Level: Medium
Payload: Downloads additional files and redirects DNS queries.

Distribution

Distribution Level: Medium
Shared Drives: Copies itself to removable drives.

Writeup By: Mircea Ciubotariu

Technical Details

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}