Net-Worm.Win32.Kido exploits a critical vulnerability (MS08-067) in Microsoft Windows to spread via local networks and removable storage media.

The worm disables system restore, blocks access to security websites, and downloads additional malware to infected machines.

Users are strongly recommended to ensure their antivirus databases are up to date. A patch for the vulnerability is available from Microsoft.

Detailed descriptions of Net-Worm.Win32.Kido.bt, Net-Worm.Win32.Kido.dv and Net-Worm.Win32.Kido.fx are available in the Virus Encyclopaedia. A dedicated removal tool is available here.

The new Gpcode variant encrypts files with extensions DOC, TXT, PDF, XLS, JPG, PNG, CPP, H etc. on hard drives using an RSA algorithm with a 1024-bit key.

After encrypting files, the virus leaves a text file in the folder next to the encrypted files with following message:

Currently, we detect the new variant, but we are unable to crack the 1024-bit key. Our analysts are continuing to work on both the key and the virus to resolve this issue.

Kaspersky Lab recommends that all Internet users enable maximum protection from malicious code and network attacks on their computers, refrain from executing suspicious programs received from untrustworthy sources and back up any important information on their computers.

Detection of Virus.Win32.Gpcode.ak was added to Kaspersky Anti-Virus signature databases yesterday, on June 4th, at 15:39 GMT. Please make sure to update if you haven’t already.

If you have fallen victim to Gpcode.ak, try to contact us using another computer connected to the Internet. DO NOT RESTART or POWER DOWN the potentially infected machine. Contact us by email stopgpcode@kaspersky.com and tell us the exact date and time of infection, as well everything you did on the computer in the 5 minutes before the machine was infected: which programs you have executed, which websites you have visited, etc. We'll try and help you recover any data that has been encrypted.

For more information about the malicious program, please read our weblog.

A few hours before this point, there was a noticeable increase in mail traffic of an earlier modification of Warezov - Warezov.do which featured in the October 2006 Top 20.

If you are using Kaspersky Anti-Virus 6.0 or Kaspersky Internet Security 6.0 with Proactive Protection turned on, new variants will be detected without the need to update your antivirus databases.

A full description of Email-Worm.Win32.Warezov.nf is now available in the Virus Encyclopaedia.

The worm spreads as an attachment to infected emails. Once launched, it may terminate antivirus and firewall programs and download other malware.

An urgent update to antivirus databases has been released.

If you are using Kaspersky Anti-Virus/ Kaspersky Internet Security 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

The worm spreads as an attachment to infected emails. Once launched, it may terminate antivirus and firewall programs and download other malware.

An urgent update to antivirus databases has been released.

If you are using Kaspersky Anti-Virus/ Kaspersky Internet Security 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

A detailed description of Email-Worm.Win32.Warezov.ms will be available in the near future.

New variants may be functionally similar to each other and to previous variants.

Users are reminded to keep their antivirus protection up to date, and to scan any suspicious emails with an antivirus solution.

If you are using Kaspersky Anti-Virus or Kaspersky Internet Security 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

A detailed description of Email-Worm.Win32.Zhelatin.o is available in the Virus Encyclopaedia.

Zhelatin.u is a repacked version of an earlier modification, and has the same functionality as previous variants.

Users are reminded to keep their antivirus protection up to date.

If you are using Kaspersky Anti-Virus 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

It is functionally identical to Zhelatin.o. Zhelatin.r is simply a repacked version.

If you are using Kaspersky Anti-Virus 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

Kaspersky Lab has detected a mass mailing of Email-Worm.Win32.Zhelatin.o, which is spreading as an attachment to infected emails.

Zhelatin.o is very similiar to the first Zhelatin variant - Zhelatin.a.

The Kaspersky anti-virus databases have been updated and users are recommended to update as soon as possible.

Possible subjects in infected emails:

Possible names for attachments containing the body of the worm:

Possible texts in the emails:

A detailed description of Email-Worm.Win32.Zhelatin.o is now available in the Kaspersky Virus Encyclopaedia.

A new version is being sent out in each mass mailing. The variants are all highly similar, and spread as an attachment to infected emails. Once launched, they may terminate antivirus and firewall programs and download other malware.

Antivirus updates have been released for all the latest variants. Users are strongly recommended to ensure that they keep their antivirus software up to date.

If you are using Kaspersky Anti-Virus 6.0, enable Proactive Protection, and new variants will be detected without the need to update antivirus databases.

Further details of the latest variants will be available in the near future.