| TIP: Click on subject to list as thread! | ANSI |
| echo: | |
|---|---|
| to: | |
| from: | |
| date: | |
| subject: | News, February 11 2006 |
[cut-n-paste from sophos.com]
Name W32/Datom-B
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Steals information
* Forges the sender's email address
* Uses its own emailing engine
* Leaves non-infected files on computer
Aliases
* W32.Clunk.A
* Worm.Win32.Datom.d
* WORM_DATOM.B
Prevalence (1-5) 2
Description
W32/Datom-B is an information-stealing networm worm for the Windows
platform.
Advanced
W32/Datom-B is an information-stealing networm worm for the Windows
platform.
W32/Datom-B takes screenshots of browser applications and submits the
resulting images to the author by email.
Name W32/Zotob-L
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
* Uses its own emailing engine
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Net-Worm.Win32.Mytob.dy
* W32/Mytob.gen{at}MM
Prevalence (1-5) 2
Description
W32/Zotob-L is a worm and IRC backdoor Trojan for the Windows platform.
W32/Zotob-L spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: PNP (MS05-039) and ASN.1
(MS04-007).
W32/Zotob-L sends itself in emails with the following characteristics:
Subject: chosen from a list including
Warning Message: Your services near to be closed.
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Message text: one of four paragraphs claiming that the recipient has
abused their account
Advanced
W32/Zotob-L is a worm and IRC backdoor Trojan for the Windows platform.
W32/Zotob-L spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: PNP (MS05-039) and ASN.1
(MS04-007).
W32/Zotob-L sends itself in emails with the following characteristics:
Subject: one of
Warning Message: Your services near to be closed.
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
Message text: one of
Dear user ,
You have successfully updated the password of your account.
If you did not authorize this change or if you need assistance with
your account, please contact customer service at:
Thank you for using !
The Support Team
+++ Attachment: No Virus (Clean)
+++ Antivirus - www.
Dear user ,
It has come to our attention that your User Profile ( x )
records are out of date. For further details see the attached document.
Thank you for using !
The Support Team
+++ Attachment: No Virus (Clean)
+++ Antivirus - www.
Dear Member,
We have temporarily suspended your email account .
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up
process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our processors.
See the details to reactivate your account.
Sincerely,The Support Team
+++ Attachment: No Virus (Clean)
+++ Antivirus - www.
Dear Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could please take 5-10
minutes out of your online experience and confirm the attached
document so you will not run into any future problems with the online
service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The Support Team
+++ Attachment: No Virus found
+++ Antivirus - www.
W32/Zotob-L runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
When first run W32/Zotob-L copies itself to \windows.exe.
The file windows.exe is registered as a new system driver service
named "Microsoft Windows System", with a display name of "Microsoft
Windows System" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Windows System\
Name Troj/Crybot-B
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Crybot-B is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer through IRC channels.
Troj/Crybot-B includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Crybot-B is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer through IRC channels.
Troj/Crybot-B includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Crybot-B is registered as a new system driver service named
"DirectService", with a display name of "DirectX Service" and a
startup type of automatic, so that it is started automatically during
system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\DirectService\
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\DirectHimc\
The Trojan uses the system utility netsh.exe to adjust Windows
firewall settings in order to make connection to remote servers.
Name W32/Forbot-GR
Type
* Spyware Worm
How it spreads
* Email attachments
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Steals information
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Aliases
* Backdoor.Win32.Agobot.aee
Prevalence (1-5) 2
Description
W32/Forbot-GR is a network worm with backdoor functionality for the
Windows platform.
Once installed, W32/Forbot-GR connects to a preconfigured IRC server
and joins a channel from which an attacker can issue further commands.
W32/Forbot-GR also has the ability to spread via email. The email
sent by W32/Forbot-GR may have the following properties:
Subject line:
'Security measures'
'Members Support'
'*WARNING* Your email account is suspended'
'You are banned!!!'
'Important Notification'
'*DETECTED* Online User Violation'
'Your Account is Suspended For Security Reasons'
'Your Account is Suspended'
'Warning Message: Your services near to be closed.'
'We have suspended your account'
'Email Account Suspension'
'Notice of account limitation'
Message text:
Dear Member,
We have temporarily suspended your email account .
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due
to an internal error within our processors.
See the attached details to reactivate your account.
Sincerely,The Support Team
Your e-mail account was used to send a huge amount of unsolicited
spam messages
during the recent week. If you could please take 5-10 minutes out of
your
online experience and confirm the attached document so you will not
run into
any future problems with the online service.
Virtually yours,
The Support Team
Some information about your account is attached.
The Support Team
Attached file:
The mail may contain an attached file with one of the following
filenames
followed by the ZIP file extension:
account-details
account-info
account-report
accounts
administrator
document
email-details
important-details
information
readme
register
The file inside the ZIP may have several spaces before a final
extension of CMD,EXE,PIF or BAT.
Advanced
W32/Forbot-GR is a network worm with backdoor functionality for the
Windows platform.
When first run, W32/Forbot-GR copies itself to the Windows system
folder as svchosts.exe and sets the following registry entries in
order to run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32 Driver
"svchosts.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Win32 Driver
"svchosts.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win32 Driver
"svchosts.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32 Driver
"svchosts.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Win32 Driver
"svchosts.exe"
W32/Forbot-GR also creates its own service named "SHIT", with the
display name "Win32 Driver".
Once installed, W32/Forbot-GR connects to a preconfigured IRC server
and joins a channel from which an attacker can issue further
commands. These commands can cause the infected computer to perform
any of the following actions:
flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files
The worm can spread to unpatched computers affected by the operating
system vulnerabilities LSASS (MS04-011), WKS (MS03-049)
(CAN-2003-0812) and ASN.1 (MS04-007).
When first run, W32/Forbot-GR creates a randomly named file in the
Temp folder and an additional randomly named file in the Windows
system folder. The file created in the Temp folder is detected as
W32/Bobax-X while the file created in the Windows system folder is
detected as W32/Bobax-S.
W32/Forbot-GR also has the ability to spread via email. The email
sent by W32/Forbot-GR may have the following properties:
Subject line:
'Security measures'
'Members Support'
'*WARNING* Your email account is suspended'
'You are banned!!!'
'Important Notification'
'*DETECTED* Online User Violation'
'Your Account is Suspended For Security Reasons'
'Your Account is Suspended'
'Warning Message: Your services near to be closed.'
'We have suspended your account'
'Email Account Suspension'
'Notice of account limitation'
Message text:
Dear Member,
We have temporarily suspended your email account .
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due
to an internal error within our processors.
See the attached details to reactivate your account.
Sincerely,The Support Team
Your e-mail account was used to send a huge amount of unsolicited
spam messages
during the recent week. If you could please take 5-10 minutes out of
your
online experience and confirm the attached document so you will not
run into
any future problems with the online service.
Virtually yours,
The Support Team
Some information about your account is attached.
The Support Team
Attached file:
The mail may contain an attached file with one of the following
filenames
followed by the ZIP file extension:
account-details
account-info
account-report
accounts
administrator
document
email-details
important-details
information
readme
register
The file inside the ZIP may have several spaces before a final
extension of CMD,EXE,PIF or BAT.
Name W32/Opanki-AJ
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.ahj
* W32.Spybot.Worm
* W32/Opanki.worm
Prevalence (1-5) 2
Description
W32/Opanki-AJ is a worm and IRC backdoor for the Windows platform.
Advanced
W32/Opanki-AJ is a worm and IRC backdoor for the Windows platform.
W32/Opanki-AJ spreads through AOL Instant Messenger, network shares
and by exploiting the LSASS (MS04-011), RPC-DCOM(MS04-12), WKS
(MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007)
software vulnerabilities.
W32/Opanki-AJ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When run W32/Opanki-AJ copies itself to \scvhost.exe
W32/Opanki-AJ sets the following registry entries:
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Name Troj/Flat-G
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Flat-G is a Trojan for the Windows platform.
Troj/Flat-G includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Flat-G is a Trojan for the Windows platform.
Troj/Flat-G includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Flat-G copies itself to the Windows system folder as
jusched.exe, and the Trojan also copies itself to Start Menu folder
as CFTM0N.EXE.
Troj/Flat-G creates entries in the registry at the following
locations to run itself on system restart:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sun
When Troj/Flat-G is installed it creates the file * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)SEEN-BY: 633/267 270 @PATH: 123/140 500 106/2000 633/267 |
|
| SOURCE: echomail via fidonet.ozzmosis.com | |
Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.