[cut-n-paste from sophos.com]
Name W32/Bagle-KF
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* W32/Bagle.gen{at}MM
Prevalence (1-5) 5
Description
W32/Bagle-KF is a worm for the Windows platform.
W32/Bagle-KF includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Bagle-KF is a worm for the Windows platform.
W32/Bagle-KF includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Bagle-KF copies itself to \hldrrr.exe. The worm will then launch notepad.exe.
The following registry entries are created to run hldrrr.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
hldrrr
\hldrrr.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hldrrr
\hldrrr.exe
Registry entries are created under:
HKCU\Software\FirstRRRun\
Name W32/Bagle-KH
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* W32/Bagle.gen{at}MM
Prevalence (1-5) 3
Description
W32/Bagle-KH is a worm for the Windows platform.
W32/Bagle-KH includes functionality to access the internet and
communicate with
a remote server via HTTP.
Advanced
W32/Bagle-KH is a worm for the Windows platform.
W32/Bagle-KH includes functionality to access the internet and
communicate with
a remote server via HTTP.
When first run W32/Bagle-KH copies itself to \hldrrr.exe.
The following registry entries are created to run hldrrr.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
hldrrr
\hldrrr.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hldrrr
\hldrrr.exe
Registry entries are created under:
HKCU\Software\FirstRRRun\
Name W32/Opanki-BT
Type
* Worm
How it spreads
* Network shares
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Opanki-BT is a worm with backdoor functionality for the Windows
platform.
W32/Opanki-BT runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Opanki-BT attempts to spread via AOL Instant Messenger, by
copying itself to remote network shares and by exploiting any of the
following vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), PNP (MS05-039), IMAIL Server, ASN.1
(MS04-007).
Advanced
W32/Opanki-BT is a worm with backdoor functionality for the Windows
platform.
W32/Opanki-BT runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Opanki-BT attempts to spread via AOL Instant Messenger, by
copying itself to remote network shares and by exploiting any of the
following vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), PNP (MS05-039), IMAIL Server, ASN.1
(MS04-007).
When first run W32/Opanki-BT copies itself to \scvhost.exe.
The file scvhost.exe is registered as a new system driver service
named "lsass", with a display name of "Local Security Authority
Subsystem Service" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\lsass\
W32/Opanki-BT sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Small-BWB
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Small.crd
Prevalence (1-5) 2
Description
Troj/Small-BWB is a downloader Trojan for the Windows platform.
Advanced
Troj/Small-BWB is a downloader Trojan for the Windows platform.
Troj/Small-BWB downloads and runs an executable file to
C:\WINNT\system32\svchw.exe.
Name Troj/Zapchas-BM
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Backdoor.IRC.Zapchast
* BKDR_ZAPCHAST.EI
* IRC/Zapchast.J
Prevalence (1-5) 2
Description
Troj/Zapchas-BM is a Trojan for the Windows platform.
Troj/Zapchas-BM runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
Troj/Zapchas-BM is a Trojan for the Windows platform.
Troj/Zapchas-BM runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When Troj/Zapchas-BM is installed the following files are created:
\aliases.ini
\control.ini
\mirc.ico
\mirc.ini
\nicks.txt
\remote.ini
\script.ini
\servers.ini
\sup.bat
\sup.reg
\svchost.exe
\users.ini
The following registry entries are set or modified, so that
svchost.exe is run when files with extensions of CHA and IRC are
opened/launched:
HKCR\ChatFile\Shell\open\command
(default)
\svchost.exe" -noconnect
HKCR\irc\Shell\open\command
(default)
\svchost.exe" -noconnect
Registry entries are created under:
HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\
Name W32/Melo-E
Type
* Worm
How it spreads
* Email messages
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Reduces system security
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
W32/Melo-E is a worm for the Windows platform.
W32/Melo-E deletes all normal files in the top folder of the A: and
C: drives, replacing them with copies of itself whose filename is the
original filename plus an additional EXE extension.
W32/Melo-E monitors active windows, and when it finds a window
indicating a Hotmail email message is being composed in Microsoft
Internet Explorer, it will append one of the following links to the
composed message in order to encourage the recipient to download
another copy of the worm from the Internet :
"jaja look a that video "
"mira este video jaja"
Advanced
W32/Melo-E is a worm for the Windows platform.
W32/Melo-E deletes all normal files in the top folder of the A: and
C: drives, replacing them with copies of itself whose filename is the
original filename plus an additional EXE extension.
The worm also copies itself to C:\Windows\Cursors\wam.exe and creates
the registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
axel
"C:\Windows\Cursors\wam.exe"
W32/Melo-E monitors active windows, and when it finds a window
indicating a Hotmail email message is being composed in Microsoft
Internet Explorer, it will append one of the following links to the
composed message in order to encourage the recipient to download
another copy of the worm from the Internet :
"jaja look a that video "
"mira este video jaja"
The worm terminates the following processes:
_AVPCC
ACKWIN32
AD-AWARE
ADMINTOOL
ADVXDWIN
AGENTA
AGENTSVR
ALERTSVC
ALOGSERV
AMON9X
ANTI-TROJAN
ANTITROJ
ANTIVIRUS
APIMONITOR
APLICA32
APVXDWIN
ASHDISP
ASHQUICK
ATGUARD
ATRO55EN
ATUPDATER
ATWATCH
AUTODOWN
AUTOTRACE
AVCONSOL
AVENGINE
AVGCC32
AVGCTRL
AVGSERV
AVGSERV9
AVGUARD
AVKPOP
AVKSERV
AVKSERVICE
AVKWCTL
AVKWCTL9
AVSCHED32
AVSYNMGR
AVWINNT
AVXGUI
AVXLIVE
AVXMONITOR9X
AVXMONITORNT
AVXQUAR
BD_PROFESSIONAL
BIDSERVER
BLACKD
BLACKICE
BOOTSCAN
BOOTWARN
CCEVTMGR
CFGINTPR
CFGWIZ
CFIADMIN
CFIAUDIT
CFINET
CFINET32
CLAW95
CLAW95CF
CLEANER
CLEANER3
CLEANPC
CMGRDIAN
CMON016
CONNECTIONMONITOR
CPFNT206
CWNB181
CWNTDWMO
DEFSCANGUI
DEFWATCH
DEPUTY
DPATROL
DRWEB32
DRWEBSCD
ECENGINE
EFPEADM
ESCANH95
ESCANHNT
ESCANV95
ESPWATCH
ETRUSTCIPE
EXANTIVIRUS-CNET
EXPERT
F-AGNT95
F-PROT
F-PROT95
F-STOPW
FAMEH32
FINDVIRU
FIREWALL
FLOWPROTECTOR
FNRB32
FP-WIN
FSAV32
FSAV530STBYB
FSAVSTRT
FSGK32
FSMA32
FSMB32
GBMENU
GBPOLL
GENERICS
GLADIATOR
GUARDDOG
GUARDER
HACKERELIMINATOR
HACKTRACERSETUP
IAMAPP
IAMSERV
IAMSTATS
IBMASN
IBMAVSP
ICLOAD95
ICLOADNT
ICSUPP95
ICSUPPNT
IOMON98
IPARMOR
ISRV95
JAMMER
KAVLITE40ENG
MCVSSHLD
MFW2EN
MGAVRTCL
MGAVRTE
MGHTML
MGUTIL
MINILOG
MONITOR
MOOLIVE
MPFTRAY
MSSMMC32
MWATCH
N32SCANW
NAVAPSVC
NAVAPW32
NAVLU32
NAVSTUB
NAVW32
NAVWNT
NEOWATCHLOG
NEOWATCHTRAY
NETARMOR
NETINFO
NETMON
NETSCANPRO
NETSPYHUNTER-1.2
NETUTILS
NISSERV
NORMIST
NPFMESSENGER
NPSSVC
NSCHED32
NTRTSCAN
NTXCONFIG
NVARCH16
NWSERVICE
NWTOOL16
OSTRONET
OUTPOST
PADMIN
PANIXK
PAVFIRES
PAVPROXY
PAVSRV51
PCCCLIENT
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCWIN97
PCCWIN98
PCFWALLICON
PCSCAN
PERISCOPE
PERSFW
PFWADMIN
PINGSCAN
PLATIN
POP3TRAP
POPROXY
PORTDETECTIVE
PORTMONITOR
PPVSTOP
PRAZNA
PROCMAN
PROGRAMAUDITOR
PROPORT
PROTECTX
PVIEW95
QCONSOLE
QSERVER
QTTASK
RAPAPP
RAV7WIN
RAV8WIN32ENG
RAVMON
RAVWIN8
REALMON
RMVTRJAN
RRGUARD
RSHELL
RTVSCN95
RULAUNCH
SAFEWEB
SBSERV
SCAN32
SCANPM
SCRSCAN
SGSSFW32
SPHINX
SS3EDIT
SUPFTRL
SUPPORTER5
SWEEP95
SWNETSUP
SYMPROXYSVC
TASKALERT
TAUMON
TAUSCAN
TBSCAN
TDS2-NT
THGUARD
TITANIN
TITANINXP
TRJSCAN
TROJAN
TROJANHUNTER
TROJANTRAP3
TUCONF
TWEAK-XP
UMXAGENT
UMXLDRA
V530WTBYB
VBCMSERV
VBCONS
VBWIN9X
VBWINNTW
VETTRAY
VIR-HELP
VNLAN300
VPFW30S
VPTR AY
VPTRAY
VSCAN40
VSCHED
VSECOMR
VSHWIN32
VSMAIN
VSSTAT
WATCHDOG
WATCHER
WEBSCANX
WEBTRAP
WFINDV32
WGFE95
WIMMUN32
WINGATE
WINRECON
WINROUTE
WRADMIN
WRCTRL
WSBGATE
XCOMMSVR
XPF202EN
ZATUTOR
ZAUINST
ZONALM2601
Name Troj/Zlob-NW
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Zlob-NW is a downloader Trojan for the Windows platform.
Advanced
Troj/Zlob-NW is a downloader Trojan for the Windows platform.
When run Troj/Zlob-NW creates the file \ld.tmp and
\regperf.exe.
Once installed, the following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
wininet.dll
regperf.exe
Name Troj/DwnLdr-DCY
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Win32/TrojanDownloader.Delf.AJD
Prevalence (1-5) 2
Description
Troj/DwnLdr-DCY is a Trojan for the Windows platform.
Advanced
Troj/DwnLdr-DCY is a Trojan for the Windows platform.
Troj/DwnLdr-DCY includes functionality to access the internet and
communicate
with a remote server via HTTP.
Name W32/Sdbot-BVK
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Used in DOS attacks
* Scans network for open ports
Aliases
* Backdoor.Win32.SdBot.aoz
* W32/Sdbot.SZP
Prevalence (1-5) 2
Description
W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Sdbot-BVK can spread via network shares protected by weak
passwords, or by exploiting common vulnerabilities, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007).
W32/Sdbot-BVK runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Sdbot-BVK includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Sdbot-BVK can spread via network shares protected by weak
passwords, or by exploiting common vulnerabilities, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007).
W32/Sdbot-BVK runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Sdbot-BVK includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Sdbot-BVK copies itself to \netbtd.exe.
The file netbtd.exe is registered as a new system driver service
named "NetBTD", with a display name of "NetBTD(ntbtd)"
and a startup
type of automatic, so that it is started automatically during system
startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\
W32/Sdbot-BVK sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Agent-CBA
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Proxy.Win32.Agent.ji
Prevalence (1-5) 2
Description
Troj/Agent-CBA is a downloader Trojan for the Windows platform.
Troj/Agent-CBA includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Agent-CBA attempts to stealth itself on an infected system.
Advanced
Troj/Agent-CBA is a downloader Trojan for the Windows platform.
Troj/Agent-CBA includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Agent-CBA attempts to stealth itself on an infected system.
When first run Troj/Agent-CBA copies itself to \clcbt.exe and
creates the file \comdlg66.dll.
The following registry entry is created to run clcbt.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
clcbt.exe
\clcbt.exe
Name Troj/Adclick-CP
Type
* Trojan
Affected operating systems
* Windows
Aliases
* Trojan-Spy.Win32.Delf.dq
Prevalence (1-5) 2
Description
Troj/Adclick-CP is a Trojan for the Windows platform.
When run, Troj/Adclick-CP launches Internet Explorer and attempts to
access predefined URLs.
Advanced
Troj/Adclick-CP is a Trojan for the Windows platform.
When run, Troj/Adclick-CP launches Internet Explorer and attempts to
access predefined URLs.
When run, Troj/Adclick-CP creates the following files:
\001122.html
\51link.html
\536net.html
\access_log
\agent_log
\dy.html
\error_log
\index11.html
\index2005.html
\index24.html
\index8.html
\is686_.html
\pop001122.html
\pop536.html
\referer_log
\ulink.html
\yule.html
These files can be deleted safely.
Troj/Adclick-CP modifies the file \drivers\etc\hosts with the
following information:
127.0.0.1 www1.tmdqq.net
127.0.0.1 www3.57185.com
127.0.0.1 www.szfocus.net
9.9.9.9 skypetools.tom.com
9.9.9.9 www.cool-pic.com
9.9.9.9 www.511ku.com
9.9.9.9 www.511q.com
9.9.9.9 www.fvip.cn
9.9.9.9 17rm.com
9.9.9.9 www.mv23.com
9.9.9.9 www.911y.com
9.9.9.9 www.kanhaha.com
9.9.9.9 168.tu9.cn
9.9.9.9 liao8.top22.cn
9.9.9.9 top22.cn
9.9.9.9 tu9.cn
9.9.9.9 liao8.tu9.cn
9.9.9.9 www.haha9999.com
9.9.9.9 haha9999.com
9.9.9.9 www.mmm168.com
9.9.9.9 www.rm78.com
9.9.9.9 rm78.com
9.9.9.9 v.511.cc
9.9.9.9 www.kvip.cn
9.9.9.9 assistant.3721.com
9.9.9.9 www.10uu.com
9.9.9.9 168.8799.com
9.9.9.9 www.movieon.net
9.9.9.9 www.18mei.com
9.9.9.9 vod.xp99.net
9.9.9.9 vcd.58so.com
9.9.9.9 www.movie78.com
9.9.9.9 www.103h.com
9.9.9.9 www.kan8dy.com
9.9.9.9 www.yk88.com
9.9.9.9 www.qq500.cn
9.9.9.9 www.921mn.com
9.9.9.9 www.38mtv.com
9.9.9.9 www.591mn.com
9.9.9.9 liao2.sees8.com
9.9.9.9 www.66pp.net
9.9.9.9 www.581mm.com
9.9.9.9 www.cl258.com
9.9.9.9 www.sedy8.com
9.9.9.9 www.531kdy.com
9.9.9.9 www.ku90.com
9.9.9.9 www.47028.com
9.9.9.9 client.jogo.cn
9.9.9.9 iebar.t2t2.com
9.9.9.9 download.3721.com
9.9.9.9 vod.mmm168.com
9.9.9.9 www.521lan.com
9.9.9.9 www.dy87.com
9.9.9.9 www.55p5.com
9.9.9.9 liao.kkddd.com
9.9.9.9 www.ddkkk.com
9.9.9.9 www.setu8.com
9.9.9.9 www.mfvo.com
9.9.9.9 vod.soucn.net
9.9.9.9 vod.88997.com
9.9.9.9 www.777dy.com
9.9.9.9 pi.51.net
9.9.9.9 liao8.ip33.cn
9.9.9.9 2liao8.ip33.cn
9.9.9.9 www.kku98.com
9.9.9.9 wwv.86565.com
9.9.9.9 wwv.vbdy.com
9.9.9.9 00565.com
9.9.9.9 www.88588cc.com
9.9.9.9 www.bb90dy.com
9.9.9.9 www.0011222.com
9.9.9.9 www.5k8dy.com
9.9.9.9 www.0730dy.com
9.9.9.9 www.5111dy.com
9.9.9.9 www.999ko.com
9.9.9.9 www.gongzhusms.com
9.9.9.9 www.cc911.com
9.9.9.9 www.rongtv.com
Name Troj/FeebDl-R
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
Prevalence (1-5) 2
Description
Troj/FeebDl-R is a Trojan for the Windows platform.
The Trojan attempts to download and execute files from remote sites.
The Trojan may arrive via email and may contain an attached file with
the ZIP file extension. The ZIP file contains an HTML based script
file which may have the file extension HTA.
Advanced
Troj/FeebDl-R is a Trojan for the Windows platform.
The Trojan attempts to download and execute files from remote sites.
The Trojan may arrive via email and may contain an attached file with
the ZIP file extension. The ZIP file contains an HTML based script
file which may have the file extension HTA.
Downloaded files are placed in the C:\Recycled folder and are named
"userinit.exe"
The Trojan may delete the following registry entries, if they exist:
HKLM\SYSTEM\CurrentControlSet\Services
pcipim
HKLM\SYSTEM\CurrentControlSet\Services
pcIPPsC
HKLM\SYSTEM\CurrentControlSet\Services
RapDrv
HKLM\SYSTEM\CurrentControlSet\Services
FirePM
HKLM\SYSTEM\CurrentControlSet\Services
KmxFile
Troj/FeebDl-R may copy itself to the "Common Startup" folder as
determined by the registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Common Startup
Name W32/Tilebot-FI
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aoz
* WORM_SDBOT.DJ
Prevalence (1-5) 2
Description
W32/Tilebot-FI is a worm with backdoor functionality for the Windows
platform.
W32/Tilebot-FI spreads to other network computers by exploiting
common buffer
overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812),
PNP
(MS05-039) and ASN.1 (MS04-007). The worm may also spreads via
network shares
and MSSQL servers protected by weak passwords.
W32/Tilebot-FI runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Tilebot-FI includes functionality to:
- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks
Advanced
W32/Tilebot-FI is a worm with backdoor functionality for the Windows
platform.
W32/Tilebot-FI spreads to other network computers by exploiting
common buffer
overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812),
PNP
(MS05-039) and ASN.1 (MS04-007). The worm may also spreads via
network shares
and MSSQL servers protected by weak passwords.
W32/Tilebot-FI runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Tilebot-FI includes functionality to:
- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks
When first run W32/Tilebot-FI copies itself to the Windows folder as
netbtd.exe.
The file netbtd.exe is registered as a new system driver service
named "NetBTD",
with a display name of "NetBTD(ntbtd)" and a startup type of
automatic, so that
it is started automatically during system startup. Registry entries
are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\
W32/Tilebot-FI sets the following registry entries, disabling the
automatic
startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4
Additional registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0
HKLM\SYSTEM\CurrentControlSet\Control\
WaitToKillServiceTimeout
7000
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name Troj/Haxdoor-HM
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Haxdoor.hm
* BackDoor-BAC
Prevalence (1-5) 2
Description
Troj/Haxdoor-HM is a Trojan for the Windows platform.
Troj/Haxdoor-HM runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/Haxdoor-HM includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security
related applications
Advanced
Troj/Haxdoor-HM is a Trojan for the Windows platform.
Troj/Haxdoor-HM runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/Haxdoor-HM includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security
related applications
When Troj/Haxdoor-HM is installed the following files are created:
\klgcptini.dat
\ms87.dat
\pptp16.dll
\pptp24.sys
\qz.dll
\qz.sys
The files pptp16.dll and qz.dll are detected as Troj/Haxdor-Fam and
the files pptp24.sys and qz.sys are detected as Troj/Haxdor-Gen.
The following registry entries are created to run code exported by
pptp16.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pptp16
DllName
pptp16.dll
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pptp16
Startup
KeImageDBG
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pptp16
Impersonate
1
The file pptp24.sys is registered as a new system driver service
named "pptp16", with a display name of "MMX2 virtualization
service"
and a startup type of automatic, so that it is started automatically
during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\pptp16\
The file pptp24.sys is registered as a new system driver service
named "pptp24", with a display name of "MMX virtualization
service".
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\pptp24\
Name Troj/Doctrix-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Doctrix-A is a Trojan for the Windows platform.
Troj/Doctrix-A may be distributed with the filename "My
Documents.exe" and an icon designed to look like a folder icon, so
that users may inadvertantly execute the Trojan when intending to
open the "My Documents" folder.
Advanced
Troj/Doctrix-A is a Trojan for the Windows platform.
Troj/Doctrix-A may be distributed with the filename "My
Documents.exe" and an icon designed to look like a folder icon, so
that users may inadvertantly execute the Trojan when intending to
open the "My Documents" folder.
When first run Troj/Doctrix-A copies itself to the Windows folder and
creates the file \Pacuks.
The following registry entry is created to run Troj/Doctrix-A on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System File
\
Name Troj/Repkill-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Reduces system security
* Installs itself in the Registry
Aliases
* Virus.Win32.VB.ar
Prevalence (1-5) 2
Description
Troj/Repkill-A is a Trojan for the Windows platform.
Troj/Repkill-A attempts to kill W32/Repper worms, but also terminates
some security related processes.
Advanced
Troj/Repkill-A is a Trojan for the Windows platform.
When Troj/Repkill-A is installed it copies itself to \svchost.exe, and creates the file \autorun.inf.
The following registry entries are created to run svchost.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ip
\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
io
\svchost.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
ff
Troj/Repkill-A attempts to kill any processes with the following names:
ravmon.exe
ntsd.exe
reper.exe
viewer.exe
n0tepad.exe
The final three names suggest that Troj/Repkill-A is designed to kill
the W32/Repper family of worms.
Name Troj/FeebDl-S
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* JS/Feebs.gen.f{at}MM
Prevalence (1-5) 2
Description
Troj/FeebDl-S is a Trojan downloader for the Windows platform.
When run the Trojan will attempt to download and execute components
from the internet. The downloaded components are detected by Sophos
as W32/Feebs-Gen.
Name Troj/Stinx-W
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Win32/IRCBot.PH
Prevalence (1-5) 2
Description
Troj/Stinx-W is an IRC backdoor Trojan for the Windows platform.
Troj/Stinx-W may arrive as an attachment to an email message
variously claiming to be CCTV footage of a rape on a university campus.
Advanced
Troj/Stinx-W is an IRC backdoor Trojan for the Windows platform.
When first run, Troj/Stinx-W copies itself to the Windows system
folder with the name svchon32.exe and creates the following registry
entry to run itself automatically:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ProtocolModuleCmd
svchon32.exe
Troj/Stinx-W connects to a preconfigured IRC server and joins a
specific channel. A remote attacker can then gain access and control
over the infected computer.
Troj/Stinx-W may arrive as an attachment to an email message
variously claiming to be CCTV footage of a rape on a university campus.
Name W32/Tilebot-FK
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aoy
Prevalence (1-5) 2
Description
W32/Tilebot-FK is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-FK runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-FK exploits the following software vulnerabilities:
LSASS (MS04-011)
ASN.1 (MS04-007)
W32/Tilebot-FK includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-FK copies itself to \winscntrl.exe.
Advanced
W32/Tilebot-FK is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-FK runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-FK exploits the following software vulnerabilities:
LSASS (MS04-011)
ASN.1 (MS04-007)
W32/Tilebot-FK includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-FK copies itself to \winscntrl.exe.
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Wins\
W32/Tilebot-FK sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
SEEN-BY: 633/267 270
@PATH: 123/140 500 106/2000 633/267
|