[cut-n-paste from sophos.com]

Name   Troj/Zlob-PV

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Reduces system security
    * Installs itself in the Registry
    * Dropped by malware

Aliases  
    * Trojan-Downloader.Win32.Zlob.aac
    * Win32/TrojanDownloader.Zlob.VN
    * TROJ_ZLOB.AIJ

Prevalence (1-5) 2

Description
Troj/Zlob-PV is a downloader Trojan for the Windows platform.

Troj/Zlob-PV may be dropped by Troj/Zlob-PU.

Advanced
Troj/Zlob-PV is a downloader Trojan for the Windows platform.

Troj/Zlob-PV may be dropped by Troj/Zlob-PU.

When Troj/Zlob-PV is installed the following files are created:

\simpole.tlb
\hp100.tmp
\stdole3.tlb - clean file

The file hp100.tmp is registered as a COM object and Browser Helper 
Object (BHO) for Microsoft Internet Explorer, creating registry 
entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objects\(f7d40011-29bb-43eb-9c97-875ce89e9e36)
HKCR\CLSID\(f7d40011-29bb-43eb-9c97-875ce89e9e36)

Troj/Zlob-PV changes Start Page and search settings for Microsoft 
Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Search\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objecta\(f7d40011-29bb-43eb-9c97-875ce89e9e36)\

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objecta\(f7d40011-29bb-43eb-9c97-875ce89e9e36)\(default)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
dcomcfg.exe
dcomcfg.exe





Name   Troj/FakeVNC-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer

Prevalence (1-5) 2

Description
Troj/FakeVNC-A is a Trojan.

Troj/FakeVNC-A is a hacked WinVNC server, which allows an intruder 
remote access to the computer.

Advanced
Troj/FakeVNC-A is a Trojan.

Troj/FakeVNC-A is a hacked WinVNC server, which allows an intruder 
remote access to the computer.

Troj/FakeVNC-A contains modified resource information which says it 
is "System Kernel Check for Win32" from Microsoft Corporation.





Name   Troj/Haxdoor-CP

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Haxdoor.ga

Prevalence (1-5) 2

Description
Troj/Haxdoor-CP is a Trojan for the Windows platform.

Troj/Haxdoor-CP runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/Haxdoor-CP includes functionality to:

- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security 
related applications

Advanced
Troj/Haxdoor-CP is a Trojan for the Windows platform.

Troj/Haxdoor-CP runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/Haxdoor-CP includes functionality to:

- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security 
related applications

Troj/Haxdoor-CP may arrive in email with the following characteristics:

Subject line: Confirmation for Order WC2905036

Message text: "Dear Sir/Madam,

Thank you for shopping with our internet shop. Your order, WC2905036, 
has been received. Summary of your order you can see in the 
attachment file.

This email is to confirm the receipt of your order. Please do not 
reply as this email was sent from our automated confirmation system.

Please Note: There is no need to re-send your request or call our 
customer service department for status or tracking number, this will 
only delay our response time to you. Rest assured, we are making 
every effort to process and ship your order within 1 to 2 business 
days. We appreciate your understanding and patience and do value your 
business.

Once your order has been processed and shipped a FEDEX Tracking 
number will be automatically emailed to the address provided.

Please Note: Tracking information will be available in FedEx's system 
only after 10pm EST Monday thru Friday. If you receive a tracking 
number on Sunday, you will be able to track it Monday evening after 
10pm EST.

All orders placed including 1-2 or 2-3 business day options are 
shipped within 48 hours providing the merchandise is in stock.
All FedEx Ground orders will take 7-10 business days to arrive.

Some packages may require a signature upon delivery. These packages 
will not be left without a signature. For your convenience, we will 
email you a FedEx tracking number on all successfully processed and 
shipped orders.

All Plasma TVs, DVD players, Scanners, Fax Machines, Receivers, Home 
Theater, and Printers are not returnable after box is opened.

To insure the best handling of your order please allow 24-48 business 
hours for the processing and the shipping of your order. Thank you 
for your cooperation.

We hope you enjoy your order! Thank you for shopping with us!"

Attached file: WC2905036.zip

When Troj/Haxdoor-CP is installed the following files are created:

\kgctini.dat
\lps.dat
\qo.dll
\qo.sys
\ycsvga.sys
\yvsvga.dll
\yvsvga.sys

The files qo.dll, qo.sys, ycsvga.sys, yvsvga.dll and yvsvga.sys are 
detected as Troj/Haxdor-Fam.

The following registry entries are created to run code exported by 
yvsvga.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\yvsvga
DllName
yvsvga.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\yvsvga
Startup
XFD00Safex

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\yvsvga
Impersonate
1

The file ycsvga.sys is registered as a new system driver service 
named "ycsvga", with a display name of "NDIS OSI".
Registry entries 
are created under:

HKLM\SYSTEM\CurrentControlSet\Services\ycsvga\





Name   W32/Tilebot-GA

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Prevalence (1-5) 2

Description
W32/Tilebot-GA is a worm and IRC backdoor for the Windows platform.

W32/Tilebot-GA spreads to other network computers by:
exploiting common buffer overflow vulnerabilities, including WKS 
(http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx) 
(CAN-2003-0812), PNP 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx) 
and ASN.1 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
copying itself to network shares protected by weak passwords

W32/Tilebot-GA runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-GA includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Tilebot-GA is a worm and IRC backdoor for the Windows platform.

W32/Tilebot-GA spreads to other network computers by:
exploiting common buffer overflow vulnerabilities, including WKS 
(http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx) 
(CAN-2003-0812), PNP 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx) 
and ASN.1 
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
copying itself to network shares protected by weak passwords

W32/Tilebot-GA runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-GA includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-GA copies itself to \sysdriver.exe.

The file sysdriver.exe is registered as a new system driver service 
named "systemdriver", with a display name of "System Driver
Service" 
and a startup type of automatic, so that it is started automatically 
during system startup.
Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\systemdriver\

W32/Tilebot-GA may sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

The following registry entries may be modified:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Dloadr-AKL

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Dloadr-AKL is a downloader Trojan for the Windows platform.

Troj/Dloadr-AKL may attempt to download a file to 
"C:\28348177711.exe" and execute it. The downloaded file is detected 
as Troj/FireSpy-A.

Troj/Dloadr-AKL also attempts to inject itself into "explorer.exe" to 
avoid detection.





Name   W32/Tilebot-GB

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Tilebot-GB is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-GB runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-GB spreads:

- to other network computers by exploiting the buffer overflow 
vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS 
(MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
- Weak password MSSQL server spread
- AOL Instant Messenger spread

Advanced
W32/Tilebot-GB is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-GB runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-GB spreads:

- to other network computers by exploiting the buffer overflow 
vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS 
(MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
- Weak password MSSQL server spread
- AOL Instant Messenger spread

W32/Tilebot-GB includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-GB copies itself to 
\sqlmanagement.exe.

The file sqlmanagement.exe is registered as a new system driver 
service named "sqlmanagement", with a display name of
"sqlmanagement" 
and a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\sqlmanagement\

The following registry entries are set, disabling the registry editor 
(regedit) and the Windows task manager (taskmgr):

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

W32/Tilebot-GB sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/AdClick-CR

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Clicker.Win32.Agent.al
    * AdClicker-BH

Prevalence (1-5) 2

Description
Troj/AdClick-CR is a Trojan for the Windows platform.

Troj/AdClick-CR runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/AdClick-CR includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/AdClick-CR is a Trojan for the Windows platform.

Troj/AdClick-CR runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/AdClick-CR includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/AdClick-CR is installed the following files are created:

\Click to Remove Spyware.lnk
\Remove Spyware Now!.lnk

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
ButtonText
Your PC is infected with Spyware - click here to fix your PC

HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
clsid
{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}

HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Default Visible
Yes

HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Exec
https://www.spydeleter.com/order2.php?KBID=1062
 
HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
HotIcon
\sd.ico

HKLM\SOFTWARE\Microsoft\Internet 
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Icon
\sd.ico





Name   Troj/Delf-CXN

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Delf.zt

Prevalence (1-5) 2

Description
Troj/Delf-CXN is a Trojan for the Windows platform.

Troj/Delf-CXN includes functionality to download, install and run new 
software.





Name   W32/Yurist-B

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Yurist.v

Prevalence (1-5) 2

Description
W32/Yurist-B is a network worm and information stealing Trojan for 
the Windows platform.

W32/Yurist-B includes functionality to access the internet and 
communicate with a remote server via HTTP. When W32/Yurist-B runs, it 
collects the email password information and uploads it to a website.

Advanced
W32/Yurist-B is a network worm and information stealing Trojan for 
the Windows platform.

W32/Yurist-B includes functionality to access the internet and 
communicate with a remote server via HTTP. When W32/Yurist-B runs, it 
collects the email password information and uploads it to a website.

When first run W32/Yurist-B copies itself to \xflash.exe and 
creates the file \xflasett.

The following registry entry is created to run xflash.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
xflash
xflash.exe





Name   Troj/Keylog-HD

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Agent.aec

Prevalence (1-5) 2

Description
Troj/Keylog-HD is a Trojan for the Windows platform.

Troj/Keylog-HD includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/Keylog-HD is a Trojan for the Windows platform.

Troj/Keylog-HD includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/Keylog-HD displays a slideshow of 3 photos called 
"Victoria Stasova" with three different pictures. The Trojan silently 
copies itself to \svchst.exe and creates the file 
\svchst.dll, where  is a random two digit number.

The following registry entry is created to run svchst.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
svchst
\svchst.exe

Registry entries are created under:

HKLM\SOFTWARE\Ezhik\





Name   Troj/Agent-CIO

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Deletes files off the computer
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Agent.ael

Prevalence (1-5) 2

Description
Troj/Agent-CIO is a backdoor Trojan which allows a remote intruder to 
gain access and control over the computer.

Troj/Agent-CIO includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/Agent-CIO is a backdoor Trojan which allows a remote intruder to 
gain access and control over the computer.

Troj/Agent-CIO includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/Agent-CIO copies itself to \mcvswin.exe.

The following registry entries are created to run mcvswin.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
prnsyst
\mcvswin.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
prnsyst
\mcvswin.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
prnsyst
\mcvswin.exe

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL
udpg
2328426

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL
ver





Name   W32/Looked-E

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs adware

Aliases  
    * Worm.Win32.Viking.p
    * W32/HLLP.Philis
    * Win32/Viking.P
    * W32.Looked.P
    * PE_LOOKED.AN

Prevalence (1-5) 2

Description
W32/Looked-E is a virus and backdoor for the Windows platform.

W32/Looked-E runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Looked-E attempts to copy itself to network shares and infect EXE 
files. W32/Looked-E may attempt to disable certain Anti-virus 
applications.

W32/Looked-E includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Looked-E is a virus and backdoor for the Windows platform.

W32/Looked-E runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Looked-E attempts to copy itself to network shares and infect EXE 
files. W32/Looked-E may attempt to disable certain Anti-virus 
applications.

W32/Looked-E includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Looked-E copies itself to \rundl132.exe 
and creates the file \%CurrentFolder%\viDll.dll.

The following registry entry is created to run rundl132.exe on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
\rundl132.exe

Registry entries are created under:

HKLM\SOFTWARE\Soft\DownloadWWW\





Name   Troj/Delf-EDE

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * PWS-LegMir.gen.e

Prevalence (1-5) 2

Description
Troj/Delf-EDE is a Trojan for the Windows platform.

Advanced
Troj/Delf-EDE is a Trojan for the Windows platform.

When first run Troj/Delf-EDE copies itself to \svchoxt.exe.

The following registry entry is created to run svchoxt.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysDesk
\svchoxt.exe





Name   W32/Spybot-LA

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Spybot-LA is a worm and IRC backdoor for the Windows platform.

W32/Spybot-LA runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

Advanced
W32/Spybot-LA is a worm and IRC backdoor for the Windows platform.

W32/Spybot-LA runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

When first run W32/Spybot-LA copies itself to \wns.exe.

The following registry entries are created to run wns.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft DLL Verifier
wns.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft DLL Verifier
wns.exe

W32/Spybot-LA sets the following registry entries, disabling the 
automatic
startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft
Internet Connection Firewall (ICF).

Registry entries are set as follows:

HKCU\Software\Microsoft\OLE
Microsoft DLL Verifier
wns.exe

HKLM\SOFTWARE\Microsoft\Ole
EnableRemoteConnect
N

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPer1_0Server
50

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPerServer
50

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





Name   W32/Tilebot-GD

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aad

Prevalence (1-5) 2

Description
W32/Tilebot-GD is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-GD spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: LSASS (MS04-011), 
RPC-DCOM (MS04-012), PNP ( MS05-039) and ASN.1 (MS04-007).

W32/Tilebot-GD runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Tilebot-GD copies itself to \smsc.exe.

Advanced
W32/Tilebot-GD is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-GD spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: LSASS (MS04-011), 
RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007).

W32/Tilebot-GD runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Tilebot-GD copies itself to \smsc.exe.

The file smsc.exe is registered as a new Windows service named 
"Window Services Connection", with a display name of "Window Services 
Connection" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\Window Services Connection\

W32/Tilebot-GD sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

 
--- MultiMail/Win32 v0.43