[cut-n-paste from sophos.com]
Name W32/Netsky-C
Type
* Worm
Aliases
* I-Worm.Moodown.c
* Win32/Netsky.C
* W32.Netsky.C{at}mm
* WORM_NETSKY.C
Prevalence (1-5) 3
Description
W32/Netsky-C is a worm which spreads via shared networks and by emailing
itself to addresses found within files located on drives C: to Z:.
The email subject line, message text and attachment filename are
randomly chosen from lists within the worm.
The name of the attached file is chosen from:
associal, msg, yours, doc, wife, talk, message, response,
creditcard, description, details, attachment, pic, me, trash,
card, stuff, poster, posting, portmoney, textfile, moonlight,
concert, sexy, information, news, note, number_phone, bill,
mydate, swimmingpool, class_photos, product, old_photos, topseller,
ps, important, shower, myaunt, aboutyou, yours, nomoney, birth,
found, death, story, worker, mails, letter, more, website,
regards, regid, friend, unfolds, jokes, doc_ang, your_stuff,
location, 454543403, final, schock, release, webcam, dinner,
intimate stuff, sexual, ranking, object, secrets, mail2, attach2,
part2, msg2, disco, freaky, visa, party, material, misc,
nothing, transfer, auction, warez, undefinied, violence, update,
masturbation, injection, naked1, naked2, tear, music, paypal,
id, privacy, word_doc, image or incest.
The attachment extension will be ZIP, COM, EXE, PIF or SCR and may be
preceded by .DOC, .HTM, .RTF or .TEXT. (e.g. visa.htm.scr)
When first run W32/Netsky-C copies itself to the Windows folder as
winlogon.exe and creates the following registry entry so that
winlogon.exe is run automatically each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ICQNet
= \winlogon.exe -stealth
W32/Netsky-C spreads via file sharing networks by copying itself to
folders on drives C: to Z: whose name contains the sub-string 'Shar',
using a filename randomly chosen from the following list:
1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
ACDSee 9.exe
Adobe Photoshop 9 full.exe
Adobe Premiere 9.exe
Ahead Nero 7.exe
Best Matrix Screensaver.scr
Clone DVD 5.exe
Cracks & Warez Archive.exe
Dark Angels.pif
Dictionary English - France.doc.exe
DivX 7.0 final.exe
Doom 3 Beta.exe
E-Book Archive.rtf.exe
Full album.mp3.pif
Gimp 1.5 Full with Key.exe
How to hack.doc.exe
IE58.1 full setup.exe
Keygen 4 all appz.exe
Learn Programming.doc.exe
Lightwave SE Update.exe
Magix Video Deluxe 4.exe
Microsoft Office 2003 Crack.exe
Microsoft WinXP Crack.exe
MS Service Pack 5.exe
Norton Antivirus 2004.exe
Opera.exe
Partitionsmagic 9.0.exe
Porno Screensaver.scr
RFC Basics Full Edition.doc.exe
Screensaver.scr
Serials.txt.exe
Smashing the stack.rtf.exe
Star Office 8.exe
Teen Porn 16.jpg.pif
The Sims 3 crack.exe
Ulead Keygen.exe
Virii Sourcecode.scr
Visual Studio Net Crack.exe
Win Longhorn Beta.exe
WinAmp 12 full.exe
Windows Sourcecode.doc.exe
WinXP eBook.doc.exe
XXX hardcore pic.jpg.exe
W32/Netsky-C attempts to delete the following registry entries if they
exist:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Taskmon
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Explorer
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAv
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAv
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\system.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\system.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\service
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Sentry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\msgsrv32
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\DELETE ME
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\D3dupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\au.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OLE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows services host
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows services host
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKLM\System\CurrentControlSet\Services\WksPatch
HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
When the worm is run on the 26th of February 2004 between 06:00 and
09:00 it may cause the computer to beep sporadically.
The Netsky-C worm contains the following text embedded in its code:
<-<- we are the skynet - you can't hide yourself! - we kill malware
writers (they have no chance!) - [LaMeRz-->]MyDoom.F is a thief of our
idea! - -- ->->
Name W32/Mytob-AK
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
* Uses its own emailing engine
Aliases
* WORM_MYTOB.BT
Prevalence (1-5) 2
Description
W32/Mytob-AK is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-AK is capable of spreading through operating system
vulnerabilities, including the LSASS (MS04-011) exploit.
W32/Mytob-AK can harvest email addresses from files on the infected
computer and from the Windows address book.
Emails sent by the worm have the following characteristics:
Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
Message body:
The message contains Unicode characters and has been sent as a binary
attachment.
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.
The original message was included as an attachment,
Here are your bank documents
Advanced
W32/Mytob-AK is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-AK is capable of spreading through operating system
vulnerabilities, including the LSASS (MS04-011) exploit.
W32/Mytob-AK can harvest email addresses from files on the infected
computer and from the Windows address book.
Emails sent by the worm have the following characteristics:
Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
Message body:
The message contains Unicode characters and has been sent as a binary
attachment.
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.
The original message was included as an attachment,
Here are your bank documents
W32/Mytob-AK copies itself to the Windows system folder as
"taskgmr32.exe " and creates the following registry entries in order to
run automatically on computer login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK =
taskgmr32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WINTASK =
taskgmr32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK =
taskgmr32.exe
The worm also creates the following registry entries:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa\
WINTASK =
taskgmr32.exe
HKCU\Software\Microsoft\OLE\
WINTASK =
taskgmr32.exe
HKLM\SOFTWARE\Microsoft\Ole\
WINTASK =
taskgmr32.exe
W32/Mytob-AK copies itself to the root folder with the following
filenames:
funny_pic.scr
my_photo2005.scr
see_this!!.scr
W32/Mytob-AK blocks access to security-related websites by writing the
following entries to the Windows hosts file:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com
W32/Mytob-AK may create a new file detected by Sophos as W32/Mytob-D.
Name Troj/Haxdoor-Y
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to
an infected system.
Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and
removal of its files.
Advanced
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to
an infected system.
Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and
removal of its files.
When the Trojan is installed the following files may be created:
<SYSTEM>\avpx32.dll
<SYSTEM>\avpx32.sys
<SYSTEM>\avpx64.sys
<SYSTEM>\p3.ini
<SYSTEM>\qy.sys
<SYSTEM>\qz.dll
<SYSTEM>\qz.sys
The Trojan registers AVPX32.SYS as a service process AVPX32 with display
name "AVPX TCP". The Trojan also registers AVPX64.SYS as a driver AVPX64
with display name "AVPX64 TCP".
The Trojan creates the following registry entries in order to run itself
on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
DllName
61,76,70,78,33,32,2e,64,6c,6c,00
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Startup
MmMapView3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Impersonate
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Asynchronous
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
MaxWait
1
Name W32/Mytob-CK
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
* Drops more malware
* Forges the sender's email address
Aliases
* WORM_MYTOB.DQ
* W32.Mytob.R{at}mm
* Net-Worm.Win32.Mytob.w
Prevalence (1-5) 2
Description
W32/Mytob-CK is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
W32/Mytob-CK may drop a file called hellmsn.exe (detected by Sophos as
W32/Mytob-D) in the same location. This component attempts to spread the
worm by sending the aforementioned SCR files through Windows Messenger
to all online contacts.
W32/Mytob-CK is capable of spreading through email and through various
operating system vulnerabilities such as LSASS (MS04-011).
The following patch for the operating system vulnerability exploited by
W32/Mytob-CK can be obtained from the Microsoft website:
LSASS (MS04-011) security vulnerability
W32/Mytob-CK is capable of spreading through email and through various
operating system vulnerabilities such as LSASS (MS04-011). Email sent by
W32/Mytob-CK has the following properties:
Subject line:
Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message text:
'Here are your banks documents.'
'The original message was included as an attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.'
'The message contains Unicode characters and has been sent as a binary
attachment.'
'Mail transaction failed. Partial message is available.'
The attached file consists of a base name followed by the extentions
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions
where the first extension is DOC, TXT or HTM and the final extension is
PIF, SCR, EXE or ZIP.
Advanced
W32/Mytob-CK is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
When first run W32/Mytob-CK copies itself to the Windows system folder
as taskgmr.exe and creates the following registry entries:
HKLM\SOFTWARE\Microsoft\Ole
WINTASK
taskgmr.exe
HKCU\Software\Microsoft\Ole
WINTASK
taskgmr.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINTASK
taskgmr.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe
W32/Mytob-CK may drop a file called hellmsn.exe (detected by Sophos as
W32/Mytob-D) in the same location. This component attempts to spread the
worm by sending the aforementioned SCR files through Windows Messenger
to all online contacts.
W32/Mytob-CK may also appends the following to the HOSTS file to deny
access to security related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com
W32/Mytob-CK is capable of spreading through email and through various
operating system vulnerabilities such as LSASS (MS04-011). Email sent by
W32/Mytob-CK has the following properties:
Subject line:
Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message text:
'Here are your banks documents.'
'The original message was included as an attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.'
'The message contains Unicode characters and has been sent as a binary
attachment.'
'Mail transaction failed. Partial message is available.'
The attached file consists of a base name followed by the extentions
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions
where the first extension is DOC, TXT or HTM and the final extension is
PIF, SCR, EXE or ZIP.
W32/Mytob-CK harvests email addresses from files on the infected
computer and from the Windows address book as well as the Microsoft
Internet Account Manager.
The following patch for the operating system vulnerability exploited by
W32/Mytob-CK can be obtained from the Microsoft website:
LSASS (MS04-011) security vulnerability
Name W32/Agobot-AAZ
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
Prevalence (1-5) 2
Description
W32/Agobot-AAZ is a network worm with backdoor Trojan functionality for
the Windows platform.
W32/Agobot-AAZ is capable of spreading to computers on the local network
protected by weak passwords.
The backdoor component runs continuously in the background providing
backdoor access to the computer through IRC channels.
Advanced
W32/Agobot-AAZ is a network worm with backdoor Trojan functionality for
the Windows platform.
W32/Agobot-AAZ is capable of spreading to computers on the local network
protected by weak passwords.
When first run, W32/Agobot-AAZ copies itself to the Windows system
folder as walg32.exe and creates the following registry entries to run
itself each time a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Application Layer Gateway
"walg32.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows Application Layer Gateway
"walg32.exe"
The backdoor component runs continuously in the background providing
backdoor access to the computer through IRC channels. The backdoor
component can be instructed to perform the following functions:
harvest email addresses
steal product registration information for certain software
take part in Distributed Denial of Service (DDoS) attacks
scan networks for vulnerabilities
download/execute arbitrary files
start a proxy server (SOCKS4/SOCKS5)
start/stop system services
monitor network communications (packet sniffing)
add/remove network shares
send email
log keypresses
W32/Agobot-AAZ attempts to terminate and disable various anti-virus and
security related programs and modifies the HOSTS file located at
%SYSTEM%\Drivers\etc\HOSTS, mapping selected anti-virus websites to the
loopback address 127.0.0.1 in an attempt to prevent access to these
sites. Typically the following mappings will be appended to the HOSTS
file:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
W32/Agobot-AAZ attempts to terminate the following processes:
_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ADAWARE.EXE
ADVXDWIN.EXE
AGENTSVR.EXE
AGENTW.EXE
ALERTSVC.EXE
ALEVIR.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ARR.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATWATCH.EXE
AU.EXE
AUPDATE.EXE
AUTO-PROTECT.NAV80TRY.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGNT.EXE
AVGSERV.EXE
AVGSERV9.EXE
AVGUARD.EXE
AVGW.EXE
AVKPOP.EXE
AVKSERV.EXE
AVKSERVICE.EXE
AVKWCTl9.EXE
AVLTMAIN.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVSYNMGR.EXE
AVWIN95.EXE
AVWINNT.EXE
AVWUPD.EXE
AVWUPD32.EXE
AVWUPSRV.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
BACKWEB.EXE
BARGAINS.EXE
BD_PROFESSIONAL.EXE
BEAGLE.EXE
BELT.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BLSS.EXE
BOOTCONF.EXE
BOOTWARN.EXE
BORG2.EXE
BPC.EXE
BRASIL.EXE
BS120.EXE
BUNDLE.EXE
BVT.EXE
CCAPP.EXE
CCEVTMGR.EXE
CCPXYSVC.EXE
CDP.EXE
CFD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
Claw95.EXE
CLAW95CF.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLICK.EXE
CMD32.EXE
CMESYS.EXE
CMGRDIAN.EXE
CMON016.EXE
CONNECTIONMONITOR.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CTRL.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
DATEMANAGER.EXE
DCOMX.EXE
DEFALERT.EXE
DEFSCANGUI.EXE
DEFWATCH.EXE
DEPUTY.EXE
DIVX.EXE
DLLCACHE.EXE
DLLREG.EXE
DOORS.EXE
DPF.EXE
DPFSETUP.EXE
DPPS2.EXE
DRWATSON.EXE
DRWEB32.EXE
DRWEBUPW.EXE
DSSAGENT.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
EFPEADM.EXE
EMSW.EXE
ENT.EXE
ESAFE.EXE
ESCANH95.EXE
ESCANHNT.EXE
ESCANV95.EXE
ESPWATCH.EXE
ETHEREAL.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXANTIVIRUS-CNET.EXE
EXE.AVXW.EXE
EXPERT.EXE
EXPLORE.EXE
F-AGNT95.EXE
F-AGOBOT.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FAMEH32.EXE
FAST.EXE
FCH32.EXE
FIH32.EXE
FINDVIRU.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FNRB32.EXE
FP-WIN.EXE
FP-WIN_TRIAL.EXE
FPROT.EXE
FRW.EXE
FSAA.EXE
FSAV.EXE
FSAV32.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
FSGK32.EXE
FSM32.EXE
FSMA32.EXE
FSMB32.EXE
GATOR.EXE
GBMENU.EXE
GBPOLL.EXE
GENERICS.EXE
GMT.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HBINST.EXE
HBSRV.EXE
HIJACKTHIS.EXE
HOTACTIO.EXE
HOTPATCH.EXE
HTLOG.EXE
HTPATCH.EXE
HWPE.EXE
HXDL.EXE
HXIUL.EXE
IAMAPP.EXE
IAMSERV.EXE
IAMSTATS.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IDLE.EXE
IEDLL.EXE
IEDRIVER.EXE
IEXPLORER.EXE
IFACE.EXE
IFW2000.EXE
INETLNFO.EXE
INFUS.EXE
INFWIN.EXE
INIT.EXE
INTDEL.EXE
INTREN.EXE
IOMON98.EXE
IPARMOR.EXE
IRIS.EXE
ISASS.EXE
ISRV95.EXE
ISTSVC.EXE
JAMMER.EXE
JDBGMRG.EXE
JEDI.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KAVPF.EXE
KAZZA.EXE
KEENVALUE.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KERNEL32.EXE
KILLPROCESSSETUP161.EXE
LAUNCHER.EXE
LDNETMON.EXE
LDPRO.EXE
LDPROMENU.EXE
LDSCAN.EXE
LNETINFO.EXE
LOADER.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LORDPE.EXE
LSETUP.EXE
LUALL.EXE
LUAU.EXE
LUCOMSERVER.EXE
LUINIT.EXE
LUSPT.EXE
MAPISVC32.EXE
MCAGENT.EXE
MCMNHDLR.EXE
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MD.EXE
MFIN32.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MGUI.EXE
MINILOG.EXE
MMOD.EXE
MONITOR.EXE
MOOLIVE.EXE
MOSTAT.EXE
MPFAGENT.EXE
MPFSERVICE.EXE
MPFTRAY.EXE
MRFLUX.EXE
MSAPP.EXE
MSBB.EXE
MSBLAST.EXE
MSCACHE.EXE
MSCCN32.EXE
MSCMAN.EXE
MSCONFIG.EXE
MSDM.EXE
MSDOS.EXE
MSIEXEC16.EXE
MSINFO32.EXE
MSLAUGH.EXE
MSMGT.EXE
MSMSGRI32.EXE
MSSMMC32.EXE
MSSYS.EXE
MSVXD.EXE
MU0311AD.EXE
MWATCH.EXE
N32SCANW.EXE
NAV.EXE
NAVAP.NAVAPSVC.EXE
NAVAPSVC.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVENGNAVEX15.NAVLU32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVSTUB.EXE
NAVW32.EXE
NAVWNT.EXE
NC2000.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NEOWATCHLOG.EXE
NETARMOR.EXE
NETD32.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NETUTILS.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NOD32.EXE
NORMIST.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NOTSTART.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NPSCHECK.EXE
NPSSVC.EXE
NSCHED32.EXE
NSSYS32.EXE
NSTASK32.EXE
NSUPDATE.EXE
NT.EXE
NTRTSCAN.EXE
NTVDM.EXE
NTXconfig.EXE
NUI.EXE
NUPGRADE.EXE
NVARCH16.EXE
NVC95.EXE
NVSVC32.EXE
NWINST4.EXE
NWSERVICE.EXE
NWTOOL16.EXE
OLLYDBG.EXE
ONSRVR.EXE
OPTIMIZE.EXE
OSTRONET.EXE
OTFIX.EXE
OUTPOST.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PATCH.EXE
PAVCL.EXE
PAVPROXY.EXE
PAVSCHED.EXE
PAVW.EXE
PCC2002S902.EXE
PCC2K_76_1436.EXE
PCCIOMON.EXE
PCCNTMON.EXE
PCCWIN97.EXE
PCCWIN98.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCIP10117_0.EXE
PCSCAN.EXE
PDSETUP.EXE
PENIS.EXE
PERISCOPE.EXE
PERSFW.EXE
PERSWF.EXE
PF2.EXE
PFWADMIN.EXE
PGMONITR.EXE
PINGSCAN.EXE
PLATIN.EXE
POP3TRAP.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
POWERSCAN.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PRIZESURFER.EXE
PRMT.EXE
PRMVR.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
PROCEXPLORERV1.0.EXE
PROGRAMAUDITOR.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
PUSSY.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAPAPP.EXE
RAV7.EXE
RAV7WIN.EXE
RAV8WIN32ENG.EXE
RAY.EXE
RB32.EXE
RCSYNC.EXE
REALMON.EXE
REGED.EXE
REGEDIT.EXE
REGEDT32.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCAN.EXE
RTVSCN95.EXE
RULAUNCH.EXE
RUN32DLL.EXE
RUNDLL.EXE
RUNDLL16.EXE
RUXDLL32.EXE
SAFEWEB.EXE
SAHAGENT.EXE
SAVE.EXE
SAVENOW.EXE
SBSERV.EXE
SC.EXE
SCAM32.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SCRSVR.EXE
SCVHOST.EXE
SD.EXE
SERV95.EXE
SERVICE.EXE
SERVLCE.EXE
SERVLCES.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SHOWBEHIND.EXE
SMC.EXE
SMS.EXE
SMSS32.EXE
SOAP.EXE
SOFI.EXE
SPERM.EXE
SPF.EXE
SPHINX.EXE
SPOLER.EXE
SPOOLCV.EXE
SPOOLSV32.EXE
SPYXX.EXE
SREXE.EXE
SRNG.EXE
SS3EDIT.EXE
SSG_4104.EXE
SSGRATE.EXE
ST2.EXE
START.EXE
STCLOADER.EXE
SUPFTRL.EXE
SUPPORT.EXE
SUPPORTER5.EXE
SVC.EXE
SVCHOSTC.EXE
SVCHOSTS.EXE
SVSHOST.EXE
SWEEP95.EXE
SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
SYMPROXYSVC.EXE
SYMTRAY.EXE
SYSEDIT.EXE
SYSTEM.EXE
SYSTEM32.EXE
SYSUPD.EXE
TASKMG.EXE
TASKMO.EXE
TASKMON.EXE
TAUMON.EXE
TBSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TDS2-98.EXE
TDS2-NT.EXE
TEEKIDS.EXE
TFAK.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRICKLER.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
TSADBOT.EXE
TVMD.EXE
TVTMD.EXE
UNDOBOOT.EXE
UPDAT.EXE
UPDATE.EXE
UPGRAD.EXE
UTPOST.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VET32.EXE
VET95.EXE
VETTRAY.EXE
VFSETUP.EXE
VIR-HELP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC32.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCAN40.EXE
VSCENU6.02D30.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBDAV.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WFINDV32.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
WIMMUN32.EXE
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINNET.EXE
WINPPR32.EXE
WINRECON.EXE
WINSERVN.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
WINTSK32.EXE
WINUPDATE.EXE
WKUFIND.EXE
WNAD.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE
W32/Agobot-AAZ will also hide all files which contain the string 'soun'.
Name W32/Rbot-RF
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Rbot.gen
* W32/Sdbot.worm.gen.j
* WORM_SPYBOT.HF
Prevalence (1-5) 2
Description
W32/Rbot-RF is a network worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-RF spreads using a variety of techniques including exploiting
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using
backdoors opened by other worms or Trojans.
W32/Rbot-RF can be controlled by a remote attacker over IRC channels.
The backdoor component of W32/Rbot-RF can be instructed by a remote user
to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
Advanced
W32/Rbot-RF is a network worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-RF spreads using a variety of techniques including exploiting
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using
backdoors opened by other worms or Trojans.
W32/Rbot-RF can be controlled by a remote attacker over IRC channels.
The backdoor component of W32/Rbot-RF can be instructed by a remote user
to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
The worm copies itself to a file named WindowsSP.exe in the Windows
system folder and creates the following registry entries:
HKCU\Software\Microsoft\OLE
Microsoft Service Pack
"WindowsSP.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Service Pack
"WindowsSP.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Service Pack
"WindowsSP.exe"
Patches for the operating system vulnerabilities exploited by
W32/Rbot-RF can be obtained from Microsoft at:
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx
Name W32/Kassbot-D
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
Aliases
* Backdoor.Win32.Delf.zq
Prevalence (1-5) 2
Description
W32/Kassbot-D is a network worm with backdoor functionality for the
Windows platform.
The backdoor component joins a predetermined IRC channel and awaits
further commands from remote attackers.
W32/Kassbot-D monitors internet sessions and begins logging keypresses
when it detects traffic to certain banking websites.
Advanced
W32/Kassbot-D is a network worm with backdoor functionality for the
Windows platform.
When run, W32/Kassbot-D copies itself to the Windows system folder as
spools.exe and sets the following registry entry in order to run each
time a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Spools Service Controller
\spools.exe
W32/Kassbot-D drops a helper file to the Windows system folder as
xee32.dll. Sophos's anti-virus products detect xee32.dll as
W32/Kassbot-C.
The backdoor component joins a predetermined IRC channel and awaits
further commands from remote attackers. The backdoor can be instructed
to perform various tasks, including:
-start a proxy server
-take part in distributed denial of service (DDoS) attacks
-download and execute arbitrary files
-download updated copies of itself
-monitor internet sessions for visits to certain banking websites
-log keypresses
-serve as an email relay, allowing remote users the ability to route
email through the infected computer
-list/terminate processes
-redirect HTTP requests to alternate sites
-list,modify or delete files/folders
-execute arbitrary commands
-search the infected computer for specified files
To achieve the functionality of redirecting of HTTP requests,
W32/Kassbot-D modifies the HOSTS file (typically located in \Drivers\etc). The worm initially appends data to the
HOSTS file which prevents access to the following domains, though it can
be instructed to append additional data via backdoor commands:
barclays.co.uk
d-eu-1f.kaspersky-labs.com
d-eu-1h.kaspersky-labs.com
d-eu-2f.kaspersky-labs.com
d-eu-2h.kaspersky-labs.com
d-ru-1f.kaspersky-labs.com
d-ru-1h.kaspersky-labs.com
d-ru-2f.kaspersky-labs.com
d-ru-2h.kaspersky-labs.com
d-us-1f.kaspersky-labs.com
d-us-1h.kaspersky-labs.com
downloads1.kaspersky.ru
downloads2.kaspersky.ru
downloads3.kaspersky.ru
downloads4.kaspersky.ru
downloads5.kaspersky.ru
hsbc.co.uk
ibank.barclays.co.uk
kaspersky-labs.com
kaspersky.ru
lloydstsb.co.uk
nwolb.com
online.lloydstsb.co.uk
personal.barclays.co.uk
www.barclays.co.uk
www.hsbc.co.uk
www.kaspersky-labs.com
www.kaspersky.ru
www.lloydstsb.co.uk
www.lloydstsb.com
www.nwolb.com
W32/Kassbot-D monitors internet sessions and begins logging keypresses
when it detects traffic to any URLs containing the following strings:
194.145.64.98
amfederal
apobank.de
bank.eldersruralbank.com.au
banking.apobank.de
banking.apobank.de
banking.bankhaus-mayer.de
banking.bmwbank.de
banking.bw-bank.de
banking.cc-bank.de
banking.degussa-bank.de
banking.diba.de
banking.donner.de
banking.elba.at
banking.europace.ie
banking.hypo.at
banking.ing-diba.at
banking.martinbank.de
banking.privatbank.at
banking.raiffeisen.at
banking.santander.de
banking.seb.de
banking.vkb-bank.at
baufinanzierung.dslbank.de
billscenter.paytrust.com
bob.bankwest.com.au
brokerage.comdirect.de
cash.rin.ru
creditplus.de
davis-company.com
dfbonline.deutsche-factoring.de
dws-direkt.deutsche-bank.de
e-bank.feibbank.com
e-bank.wuestenrot.de
ebank.laiki.com
ebanker.arabbank.com.au
ebanking.bawag.com
ebanking.bgl.lu
ern.nnctx.com.ru
etimebanker.bankofthewest.com
ewm.ubs.com
fiservdmecom
fnc.asbbank.co.nz
hbci-banking.allbank.de
homebank.tsbbank.co.nz
ib.national.com.au
ib2.inetbank.net.au
ibank.stgeorge.com.au
inetbnkp.adelaidebank.com.au
internetbanking.gad.de
internetbanking.suncorpmetway.com.au
investing.schwab.com
konto.xcom-bank.de
leu.directnet.com
mbk.rbc.ru
mein.raiffeisen.at
my.banklenz.de
my.hypovereinsbank.de
my.ingretirementplans.com
netbanking.sozialbank.de
noname.de
olb.westpac
online-banking.weberbank.de
online-service.allianz.de
online.btfunds.com.au
online.westpac.com.au
onlineservices.amp.com.au
personal.macquarie.com.au
portal01.commerzbanking.de
portal1.izb.de
privatebanking.debema.de
privatkunden.union-investment.de
sec.westpac.co.nz
secure.accu.com.au
secure.americanfederal.net
secure.bankone.com.au
secure.dnetz-b2b.de
secure.easy-car-credit.de
secure.nationalinterbank.com
secure.rabobank.com.au
services.credit-suisse.de
ssl.4alpha.de
sso.americanexpress.com
swkbank.de
union-investment.de
uniservices3.uobgroup.com
upib.unionplanters.com
web.cplnn.com
web.da-us.citibank.com
webbank.standardchartered.com
wertpapier.schwaebische-bank.de
ww2.homebanking-berlin.de
www.abnamrofutures.com
www.amazon.com
www.americanexpress.com
www.anb.com.sa
www.anz.com
www.asia.citibank.com
www.axabanque.fr
www.bacaf.at
www.bamernet.hn
www.banco-general.com
www.banking.co.at
www.bankingonline.de
www.bankofindia.com
www.bankone.com
www.bankone.com.au
www.banpais.hn
www.barclaycard.de
www.bendigobank.com.au
www.berenbergbank.de
www.bks-banking.at
www.blcdirect.banquelaurentienne.ca
www.bnz.co.nz
www.boq.com.au
www.bv-activebanking.de
www.cashcards.net
www.cebit.de
www.cetelem.de
www.cetelembank.de
www.citibank.com.au
www.cortalconsors.de
www.creditmutuel.fr
www.daimlerchrysler-bank.com
www.dhbbank.com
www.dresdner-privat.de
www.dslstar.de
www.e-gold.com
www.ebank.hsbc.co.nz
www.ebankinter.com
www.efirstbank.com
www.eservices.baj.com.sa
www.fcb-e-bank.com
www.fh-vie.ac.at
www.firstbanks.com
www.fiservdmecom1.net
www.fiservdmecom1.net
www.fiservla3.com
www.generalibank.at
www.global-banking.de
www.goldpouchexpress.com
www.hoernerbank.de
www.kiwibank.co.nz
www.loyalbank.com
www.midamericabank.com
www.mmgbank.com
www.myaxa.de
www.national-bank.de
www.ncrbanks.com
www.necu.com.au
www.netbank-money.de
www.netbanking.at
www.oberbank-banking.at
www.portal-banking.de
www.regions.com
www.sabadellatlantico.com
www.saradar.com
www.servicebank.at
www.site-secure.com
www.southtrust.com
www.sovereign.com
www.superbank.co.nz
www.usbank.com
www.visionsfcu.com
www.vr-ebanking.de
www.vr-networld-ebanking.de
www.westlbmarkets.net
www.winweb.seceti.it
www.wsk-bank.at
www0.advisernet.com.au
www1.internet-trading1.com
www1.netbank.commbank.com.au
www2.bankingonline.de
Name W32/Mytob-BZ
Type
* Worm
How it spreads
* Email attachments
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
* Steals information
* Drops more malware
Prevalence (1-5) 2
Description
W32/Mytob-BZ is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
W32/Mytob-BZ is capable of spreading through email and through various
operating system vulnerabilities such as LSASS (MS04-011).
W32/Mytob-BZ harvests email addresses from files on the infected
computer and from the Windows address book.
Advanced
W32/Mytob-BZ is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
When first run W32/Mytob-BZ copies itself to the Windows system folder
as taskgmr.exe and creates the following registry entries:
HKCU\System\CurrentControlSet\Control\Lsa
W1NTASK
taskgmr.exe
HKCU\Software\Microsoft\OLE
W1NTASK
taskgmr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
W1NTASK
taskgmr.exe
HKLM\System\CurrentControlSet\Control\Lsa
W1NTASK
taskgmr.exe
HKLM\Software\Microsoft\Ole
W1NTASK
taskgmr.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
W1NTASK
taskgmr.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
W1NTASK
taskgmr.exe
W32/Mytob-BZ copies itself to the root folder as:
funny_pic.scr
my_photo2005.scr
see_this!!.scr
and drops a file called hellmsn.exe (detected by Sophos as W32/Mytob-D)
in the same location. This component attempts to spread the worm by
sending the aforementioned SCR files through Windows Messenger to all
online contacts.
W32/Mytob-BZ also appends the following to the HOSTS file to deny access
to security related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com
W32/Mytob-BZ is capable of spreading through email and through various
operating system vulnerabilities such as LSASS (MS04-011). Email sent by
W32/Mytob-BZ has the following properties:
Subject line:
document
Good day
Mail Delivery System
Mail Transaction Failed
message
readme
Server Report
Status
Message text:
'This is a multi-part message in MIME format.'
'Mail transaction failed. Partial message is available.'
'The message contains Unicode characters and has been sent as a binary
attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.'
'The original message was included as an attachment.'
'Here are your banks documents.'
The attached file consists of a base name followed by the extentions
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions
where the first extension is DOC, TXT or HTM and the final extension is
PIF, SCR, EXE or ZIP.
W32/Mytob-BZ harvests email addresses from files on the infected
computer and from the Windows address book. The worm avoids sending
email to addresses that contain the following:
.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your
Name Troj/Vidlo-J
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Vidlo.m
* Downloader-AAP
Prevalence (1-5) 2
Description
Troj/Vidlo-J is a downloading Trojan for the Windows platform that
downloads from a predefined web location a prev.exe file detected by
Sophos's anti-virus products as Troj/Dloader-NN
Advanced
Troj/Vidlo-J is a downloading Trojan for the Windows platform that
downloads from a predefined web location a prev.exe file detected by
Sophos's anti-virus products as Troj/Dloader-NN.
Troj/Vidlo-J will inject its downloading code into Internet Explorer in
an attempt to hide its activity and bypass firewalls.
Name W32/Opanki-I
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Aliases
* IM-Worm.Win32.Opanki.b
* WORM_OPANKI.I
Prevalence (1-5) 2
Description
W32/Opanki-I is an instant-messanging worm that attempts to spread via
AOL Instant Messenger (AIM).
W32/Opanki-I sends the message "check out my pictures" to the infected
user's contacts with a link to download a PIF file from
http://redblock.co.kr. At the time of writing this file was unavailable
for download.
Name W32/Oscabot-F
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
Aliases
* TROJ_DLOADER.LS
Prevalence (1-5) 2
Description
W32/Oscabot-F is an instant messaging worm that can exploit users of AOL
Instant Messaging clients.
W32/Oscabot-F connects to a specific channel on an IRC service and waits
for an attacker to instruct the bot to send messages to contacts in the
infected user's AOL contacts list. The message will read:
"lol have you seen this?"
The word "this" is a link to the W32/Oscabot-F executable on the
infected computer.
Advanced
W32/Oscabot-F is an instant messaging worm that can exploit users of AOL
Instant Messaging clients.
W32/Oscabot-F connects to a specific channel on an IRC service and waits
for an attacker to instruct the bot to send messages to contacts in the
infected user's AOL contacts list. The message will read:
"lol have you seen this?"
The word "this" is a link to the W32/Oscabot-F executable on the
infected computer.
When run W32/Oscabot-F copies itself to the Windows folder as a
read-only, hidden, system file named userint32.exe.
W32/Oscabot-F then performs the following actions to run itself on user
logon:
creates the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Manager
%WINDOWS%\userint32.exe
changes the following registry entry:
from:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe
to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe %WINDOWS%\userint32.exe
changes the following entry in %WINDOWS%\system.ini:
from:
[boot]
shell = explorer.exe
to:
[boot]
shell = Explorer.exe %WINDOWS%\userint32.exe
Name Troj/Zapchas-J
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Backdoor.Win32.mIRC-based
* Backdoor.IRC.Zapchast
* IRC/Flood.mirc
Prevalence (1-5) 2
Description
Troj/Zapchas-J is an mIRC-based backdoor Trojan.
The Trojan creates several files in the Windows\system folder. One of
these files, svchost.exe, is a renamed copy of the mIRC application, one
is a mIRC script file (also detected as Troj/Zapchas-J) and the
remainder are configuration settings for the Trojan.
Advanced
Troj/Zapchas-J is an mIRC-based backdoor Trojan.
The Trojan creates several files in the Windows\system folder. One of
these files, svchost.exe, is a renamed copy of the mIRC application, one
is a mIRC script file (also detected as Troj/Zapchas-J) and the
remainder are configuration settings for the Trojan.
Troj/Zapchas-J may create the following registry entry in order to be
automatically run at logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
GNP Generic Host Process
C:\WINNT\system\svchost.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SNP Generic Host Process
C:\WINDOWS\system\svchost.exe
Troj/Zapchas-J connects to a preconfigured IRC server and joins a
channel in which it can receive further instructions from any of a list
of usernames specified in one of the configuration files.
Harmless files dropped in windows\system:
aliases.ini
control.ini
mirc.ico
mirc.ini
nicks.txt
remote.ini
servers.ini
sup.bat
sup.reg
users.ini
Name Troj/Vidlo-J
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Vidlo.m
* Downloader-AAP
Prevalence (1-5) 2
Description
Troj/Vidlo-J is a downloading Trojan for the Windows platform that
downloads from a predefined web location a prev.exe file detected by
Sophos's anti-virus products as Troj/Dloader-NN
Advanced
Troj/Vidlo-J is a downloading Trojan for the Windows platform that
downloads from a predefined web location a prev.exe file detected by
Sophos's anti-virus products as Troj/Dloader-NN.
Troj/Vidlo-J will inject its downloading code into Internet Explorer in
an attempt to hide its activity and bypass firewalls.
Name W32/Mytob-CJ
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
Prevalence (1-5) 2
Description
W32/Mytob-CJ is a member of the W32/Mytob family of email worms.
Once installed, W32/Mytob-CJ attempts to logon to remote IRC servers and
open a backdoor to allow remote commands to be executed. W32/Mytob-CJ
also tries to download files from a remote website and run them.
W32/Mytob-CJ also terminates anti-virus and system related processes.
W32/Mytob-CJ also modifies the HOSTS file to deny access to anti-virus
and security related websites.
W32/Mytob-CJ will harvest email addresses and server related information
from the Windows Address Book and the Microsoft Internet Account
Manager. Email messages sent by W32/Mytob-CJ has the following
characteristics:
Subject line chosen from:
'Notice: **Last Warning**'
'Your email account access is restricted'
'Your Email Account is Suspended For Security Reasons'
'Notice:***Your email account will be suspended***'
'Security measures'
'Email Account Suspension'
'*IMPORTANT* Please Validate Your Email Account'
'*IMPORTANT* Your Account Has Been Locked'
'*WARNING* Your Email Account Will Be Closed'
Message text chosen from:
'Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.'
'To unblock your email account acces, please see the attachment.'
'Follow the instructions in the attachment.'
'We have suspended some of your email services, to resolve the problem
you should read the attached document.'
'To safeguard your email account from possible termination, please see
the attached file.'
'please look at attached document.'
'Account Information Are Attached!'
Attached filenames chosen from:
email-info
email-text
email-doc
information
your_details
document_full
INFO
IMPORTANT
info-text
The attached file consists of any of the abovementioned base names
followed by the extentions PIF, SCR, EXE, CMD, BAT or ZIP. The worm may
optionally create double extensions where the first extension is DOC,
TXT or HTM and the final extension is PIF, SCR, EXE, CMD, BAT or ZIP.
Advanced
W32/Mytob-CJ is a member of the W32/Mytob family of email worms.
In order to run automatically W32/Mytob-CJ copies itself to the file
sky.exe.exe in the Windows system folder and creates the following
registry entries to run itself on user logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WINDOWS SKY
sky.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SKY
sky.exe
The worm also changes the following registry entry from its default
Windows setting:
from:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000003
to:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000004
W32/Mytob-CJ will harvest email addresses and server related information
from the Windows Address Book and the Microsoft Internet Account
Manager. Email messages sent by W32/Mytob-CJ has the following
characteristics:
Subject line chosen from:
'Notice: **Last Warning**'
'Your email account access is restricted'
'Your Email Account is Suspended For Security Reasons'
'Notice:***Your email account will be suspended***'
'Security measures'
'Email Account Suspension'
'*IMPORTANT* Please Validate Your Email Account'
'*IMPORTANT* Your Account Has Been Locked'
'*WARNING* Your Email Account Will Be Closed'
Message text chosen from:
'Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.'
'To unblock your email account acces, please see the attachment.'
'Follow the instructions in the attachment.'
'We have suspended some of your email services, to resolve the problem
you should read the attached document.'
'To safeguard your email account from possible termination, please see
the attached file.'
'please look at attached document.'
'Account Information Are Attached!'
Attached filenames chosen from:
email-info
email-text
email-doc
information
your_details
document_full
INFO
IMPORTANT
info-text
The attached file consists of any of the abovementioned base names
followed by the extentions PIF, SCR, EXE, CMD, BAT or ZIP. The worm may
optionally create double extensions where the first extension is DOC,
TXT or HTM and the final extension is PIF, SCR, EXE, CMD, BAT or ZIP.
W32/Mytob-CJ also terminates anti-virus and system related processes.
W32/Mytob-CJ also appends the following mappings to the HOSTS file to
deny access to anti-virus and security related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
Once installed, W32/Mytob-CJ attempts to logon to remote IRC servers and
open a backdoor to allow remote commands to be executed. W32/Mytob-CJ
also tries to download files from a remote website and run them.
Name W32/Mytob-CI
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
Aliases
* Email-Worm.Win32.Mydoom.am
Prevalence (1-5) 2
Description
W32/Mytob-CI is a member of the W32/Mytob family of email worms.
W32/Mytob-CI also terminates various anti-virus and system related
processes and modifies the HOSTS file.
Once installed, W32/Mytob-CI attempts to logon to remote IRC servers and
open a backdoor to allow remote commands to be executed. W32/Mytob-CI
also tries to download files from a remote website and run them.
W32/Mytob-CI will harvest email addresses and server related information
from the Windows Address Book and the Microsoft Internet Account
Manager. Email messages sent by W32/Mytob-CI have the following
characteristics:
Subject line chosen from:
'Notice: **Last Warning**'
'Your email account access is restricted'
'Your Email Account is Suspended For Security Reasons'
'Notice:***Your email account will be suspended***'
'Security measures'
'Email Account Suspension'
'*IMPORTANT* Please Validate Your Email Account'
'*IMPORTANT* Your Account Has Been Locked'
Message text chosen from:
'Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.'
'To unblock your email account acces, please see the attachment.'
'Follow the instructions in the attachment.'
'We have suspended some of your email services, to resolve the problem
you should read the attached document.'
'To safeguard your email account from possible termination, please see
the attached file.'
'please look at attached document.'
'Account Information Are Attached!'
Attached filenames chosen from:
email-info
email-text
email-doc
information
your_details
document_full
INFO
IMPORTANT
info-text
The attached file consists of any of the abovementioned base names
followed by the extentions PIF, SCR, EXE, CMD, BAT or ZIP. The worm may
optionally create double extensions where the first extension is DOC,
TXT or HTM and the final extension is PIF, SCR, EXE, CMD, BAT or ZIP.
Advanced
W32/Mytob-CI is a member of the W32/Mytob family of email worms.
In order to run automatically W32/Mytob-CI copies itself to the file
LienVandeKelder.exe in the Windows system folder and creates the
following registry entries to run itself on user logon:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
http://www.lienvandekelder.be
LienVandeKelder.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
http://www.lienvandekelder.be
LienVandeKelder.exe
The worm also changes the following registry entry from its default
Windows setting:
from:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000003
to:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000004
W32/Mytob-CI will harvest email addresses and server related information
from the Windows Address Book and the Microsoft Internet Account
Manager. Email messages sent by W32/Mytob-CI have the following
characteristics:
Subject line chosen from:
'Notice: **Last Warning**'
'Your email account access is restricted'
'Your Email Account is Suspended For Security Reasons'
'Notice:***Your email account will be suspended***'
'Security measures'
'Email Account Suspension'
'*IMPORTANT* Please Validate Your Email Account'
'*IMPORTANT* Your Account Has Been Locked'
Message text chosen from:
'Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.'
'To unblock your email account acces, please see the attachment.'
'Follow the instructions in the attachment.'
'We have suspended some of your email services, to resolve the problem
you should read the attached document.'
'To safeguard your email account from possible termination, please see
the attached file.'
'please look at attached document.'
'Account Information Are Attached!'
Attached filenames chosen from:
email-info
email-text
email-doc
information
your_details
document_full
INFO
IMPORTANT
info-text
The attached file consists of any of the abovementioned base names
followed by the extentions PIF, SCR, EXE, CMD, BAT or ZIP. The worm may
optionally create double extensions where the first extension is DOC,
TXT or HTM and the final extension is PIF, SCR, EXE, CMD, BAT or ZIP.
W32/Mytob-CI also terminates the following anti-virus and system related
processes:
regedit.exe
msconfig.exe
cmd.exe
taskmgr.exe
netstat.exe
zapro.exe
navw32.exe
navapw32.exe
zonealarm.exe
wincfg32.exe
PandaAVEngine.exe
W32/Mytob-CI also appends the following mappings to the HOSTS file to
deny access to anti-virus and security related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.oxyd.fr
127.0.0.1 oxyd.fr
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
-=Copyright (C) 2005-2006 HellBot3 Team All Rights Reserved.=-
Once installed, W32/Mytob-CI attempts to logon to remote IRC servers and
open a backdoor to allow remote commands to be executed. W32/Mytob-CI
also tries to download files from a remote website and run them.
Name Troj/Kelvir-P
Type
* Trojan
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
Prevalence (1-5) 2
Description
Troj/Kelvir-P is a Trojan for the Windows platform.
The Trojan monitors the status of Windows Messenger contacts and sends
the following text to all online contacts:
Hey look at this
/profile.php?email=http:///profile.php?email= user's email address>
Name W32/Oscabot-E
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* W32/Sdbot.worm.gen.bh
Prevalence (1-5) 2
Description
W32/Oscabot-E is an instant messaging worm that can exploit users of AOL
Instant Messaging clients.
W32/Oscabot-E connects to a specific channel on an IRC service and waits
for an attacker to instruct the bot to send messages to contacts in the
infected user's AOL contacts list. The message will read:
"check this out, is that you?".
Advanced
W32/Oscabot-E is an instant messaging worm that can exploit users of AOL
Instant Messaging clients.
W32/Oscabot-E connects to a specific channel on an IRC service and waits
for an attacker to instruct the bot to send messages to contacts in the
infected user's AOL contacts list. The message will read:
"check this out, is that you?".
The word "this" is a link to the W32/Oscabot-E executable on the
infected computer.
When first run W32/Oscabot-E moves itself to the Windows folder as
msgs.exe.
The following registry entries are created or modified:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Manager
\msgs.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe \userint32.exe
Name W32/Eyeveg-G
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Steals information
* Forges the sender's email address
* Uses its own emailing engine
Aliases
* Worm.Win32.Eyeveg.f
* W32/Eyeveg.worm.gen
* WORM_WURMARK.J
Prevalence (1-5) 2
Description
W32/Eyeveg-G is a worm for the Windows platform with backdoor
capabilities.
Advanced
W32/Eyeveg-G is a worm for the Windows platform with backdoor
capabilities.
W32/Eyeveg-G will send itself to email addresses found on the infected
computer as a ZIP file. The executable in the ZIP file will have one of
the following names:
screensaver .scr
song.wav .scr
music.mp3 .scr
video.avi .scr
photo.jpg .scr
girls.jpg .scr
pic.jpg .scr
message.txt .scr
image.jpg .scr
news.doc .scr
details.doc .scr
resume.doc .scr
love.jpg .scr
readme.txt .scr
The ZIP file's name and the subject will be the same as the name above
without an extension.
W32/Eyeveg-G will also attempt to contact a predefined URL in order to
get commands. The tasks that the worm can be instructed to do are:
Keylogging
Monitoring web traffic
Sending email
Stealing passwords from an infected computer
W32/Eyeveg-G will avoid sending email to addresses containing the
following strings:
admin
hostmaster
messagelab
symantec
localdomain
localhost
mcafee
postmaster
webmaster
spam
report
noreply
recipients
abuse
microsoft
root
W32/Eyeveg-G will copy itself to the Windows system folder with a random
name. W32/Eyeveg-G will then create the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
.exe
W32/Eyeveg-G also drops a DLL with a random filename to the Windows
system folder.
Name Troj/Haxdoor-Y
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to
an infected system.
Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and
removal of its files.
Advanced
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to
an infected system.
Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and
removal of its files.
When the Trojan is installed the following files may be created:
<SYSTEM>\avpx32.dll
<SYSTEM>\avpx32.sys
<SYSTEM>\avpx64.sys
<SYSTEM>\p3.ini
<SYSTEM>\qy.sys
<SYSTEM>\qz.dll
<SYSTEM>\qz.sys
The Trojan registers AVPX32.SYS as a service process AVPX32 with display
name "AVPX TCP". The Trojan also registers AVPX64.SYS as a driver AVPX64
with display name "AVPX64 TCP".
The Trojan creates the following registry entries in order to run itself
on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
DllName
61,76,70,78,33,32,2e,64,6c,6c,00
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Startup
MmMapView3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Impersonate
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Asynchronous
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
MaxWait
1
Name W32/Mytob-AZ
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Uses its own emailing engine
* Reduces system security
* Installs itself in the Registry
Aliases
* Net-Worm.Win32.Mytob.au
Prevalence (1-5) 2
Description
W32/Mytob-AZ is a mass-mailing worm and backdoor Trojan which allows a
remote intruder to gain access and control over the computer via IRC
channels.
When first run W32/Mytob-AZ copies itself to
<SYSTEM>\LienVandeKelder.exe.
W32/Mytob-AZ modifies the HOSTS file, changing the URL to IP mappings
for selected websites, thus preventing normal access to these sites.
Advanced
W32/Mytob-AZ is a mass-mailing worm and backdoor Trojan which allows a
remote intruder to gain access and control over the computer via IRC
channels.
When first run W32/Mytob-AZ copies itself to
<SYSTEM>\LienVandeKelder.exe.
W32/Mytob-AZ creates the following registry entries so that the worm is
run when a user logs on to Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
http://www.lienvandekelder.be
"LienVandeKelder.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
http://www.lienvandekelder.be
"LienVandeKelder.exe"
W32/Mytob-AZ attaches itself to emails with the following
characteristics:
Subject lines:
*IMPORTANT* Please Validate Your Email Account
*IMPORTANT* Your Email Account Has Been Locked
Email Account Suspension
Your Email Account is Suspended For Security Reasons
Security Measures
Notice:***Your email account will be suspended***
Your email account access is restricted
Notie:***Last Warning***
Message texts:
"To safeguard your email account from possible termination, please see
the attached file."
"Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal."
"We have suspended some of your email services, to resolve the problem
you should read the attached document."
"please look at attached document."
"Account Information Are Attached!"
"Follow the instructions in the attachment."
Attached files will have the extension ZIP, EXE, PIF, SCR or CMD and one
of the following basenames:
email-text
document_full
information
info-text
Your_details
IMPORTANT
email-info
email-doc
INFO
Occasionally the subject line, message text and attachment name will
consist of a random set of characters.
W32/Mytob-AZ modifies the HOSTS file, changing the URL to IP mappings
for selected websites, thus preventing normal access to these sites.
Name W32/Sdbot-YJ
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Rbot.gen
* W32/Sdbot.worm.gen.w
* W32.Spybot.Worm
* WORM_SDBOT.BVC
Prevalence (1-5) 2
Description
W32/Sdbot-YJ is a network worm with backdoor functionality for the
Windows platform.
W32/Sdbot-YJ runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels. The worm may spread to remote network
shares with weak passwords.
The following patches for the operating system vulnerabilities exploited
by W32/Sdbot-YJ can be obtained from the Microsoft website:
MS02-039
MS03-049
MS04-011
MS04-012
MS04-045
Advanced
W32/Sdbot-YJ is a network worm with backdoor functionality for the
Windows platform.
W32/Sdbot-YJ runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels. The worm may spread to remote network
shares with weak passwords.
The following patches for the operating system vulnerabilities exploited
by W32/Sdbot-YJ can be obtained from the Microsoft website:
MS02-039
MS03-049
MS04-011
MS04-012
MS04-045
When first run the worm copies itself to \sdkimddprovment2.exe and creates the file \mskdll.dll. The latter file is detected as Troj/NtRootK-F.
The following registry entries are created to run sdkimddprovment2.exe
on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SDK Codre Function22
sdkimddprovment2.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SDK Codre Function22
sdkimddprovment2.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
SDK Codre Function22
sdkimddprovment2.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
SDK Codre Function22
sdkimddprovment2.exe
W32/Sdbot-YJ sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
Registry entries are set as follows:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
SDK Codre Function22
sdkimddprovment2.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
SDK Codre Function22
sdkimddprovment2.exe
HKCU\Software\Microsoft\OLE
SDK Codre Function22
sdkimddprovment2.exe
HKLM\SOFTWARE\Microsoft\Ole
SDK Codre Function22
sdkimddprovment2.exe
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name W32/Mytob-AM
Type
* Worm
How it spreads
* Email attachments
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Drops more malware
* Forges the sender's email address
* Reduces system security
Aliases
* Net-Worm.Win32.Mytob.x
* W32/Mytob.gen{at}MM
Prevalence (1-5) 2
Description
W32/Mytob-AM is a mass-mailing worm and backdoor Trojan that targets
users of Internet Relay Chat programs.
W32/Mytob-AM may arrive in an email with the following characteristics:
Subject line:
hello
Good day
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message text:
'This is a multi-part message in MIME format.'
'Mail transaction failed. Partial message is available.'
'The message contains Unicode characters and has been sent as a binary
attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.'
'The original message was included as an attachment.'
'Here are your banks documents.'
Attachment name:
text
body
readme
doc
document
data
file
message
random characters
Possible attachment extensions,
pif
bat
scr
zip
cmd
exe
If the attachment is a zip archive the archived file may have a double
extension, for example 'readme.htm .exe'.
W32/Mytob-AM harvests email addresses from files on the infected
computer and from the Windows address book.
W32/Mytob-AM is capable of spreading through operating system
vulnerabilities, including the LSASS (MS04-011) exploit.
Advanced
W32/Mytob-AM is a mass-mailing worm and backdoor Trojan that targets
users of Internet Relay Chat programs.
W32/Mytob-AM may arrive in an email with the following characteristics:
Subject line:
hello
Good day
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Message text:
'This is a multi-part message in MIME format.'
'Mail transaction failed. Partial message is available.'
'The message contains Unicode characters and has been sent as a binary
attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been
sent as a binary attachment.'
'The original message was included as an attachment.'
'Here are your banks documents.'
Attachment name:
text
body
readme
doc
document
data
file
message
random characters
Possible attachment extensions,
pif
bat
scr
zip
cmd
exe
If the attachment is a zip archive the archived file may have a double
extension, for example 'readme.htm .exe'.
W32/Mytob-AM can harvest email addresses from files on the infected
computer and from the Windows address book.
W32/Mytob-AM avoids sending email to addresses that contain the
following:
.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your
W32/Mytob-AM is capable of spreading through operating system
vulnerabilities, including the LSASS (MS04-011) exploit.
Once executed W32/Mytob-AM copies itself to the Windows system folder
with the filename msplus32.exe and sets the following registry entries:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa\
MSPLUS
"msplus32.exe"
HKCU\Software\Microsoft\OLE\
MSPLUS
"msplus32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
MSPLUS
"msplus32.exe"
HKLM\SOFTWARE\Microsoft\Ole\
MSPLUS
"msplus32.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MSPLUS
msplus32.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
MSPLUS
"msplus32.exe"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
MSPLUS
"msplus32.exe"
W32/Mytob-AM copies itself to the root folder with the following
filename:
funny_pic.scr
my_photo2005.scr
see_this!!.scr
W32/Mytob-AM also drops a helper executable to the roor folder with the
filename msnplus.exe detected by Sophos's anti-virus products as
W32/Mytob-D.
The worm also appends the following mappings to the Windows HOSTS file
to deny access to anti-virus and security-related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
SEEN-BY: 633/267 270
@PATH: 123/140 500 106/2000 633/267
|