Status : moderate risk

Kaspersky Lab has detected that multiple variants of Kido, a polymorphic worm, are currently spreading widely.

Net-Worm.Win32.Kido exploits a critical vulnerability (MS08-067) in Microsoft Windows to spread via local networks and removable storage media.

The worm disables system restore, blocks access to security websites, and downloads additional malware to infected machines.

Users are strongly recommended to ensure their antivirus databases are up to date. A patch for the vulnerability is available from Microsoft.

Detailed descriptions of Net-Worm.Win32.Kido.bt, Net-Worm.Win32.Kido.dv and Net-Worm.Win32.Kido.fx are available in the Virus Encyclopaedia. A dedicated removal tool is available here.

Related links

Analysis Monthly Malware Statistics: December 2009 Monthly Malware Statistics: November 2009 Monthly Malware Statistics: October 2009 Monthly Malware Statistics: August 2009 Monthly Malware Statistics: July 2009 Blog Watching the Kido/Conficker P2P Network Bot-watching 2 Bot-watching Kido/Conficker: a sobering thought Criminals Surfing the Kido/ Conficker Hype