TIP: Click on subject to list as thread!

ANSI

echo:	dirty_dozen
to:	ALL
from:	KURT WISMER
date:	2005-10-23 19:38:00
subject:	News, Oct. 23 2005
[cut-n-paste from sophos.com] Name W32/Mytob-EY Type * Worm How it spreads * Network shares Affected operating systems * Windows Side effects * Turns off anti-virus applications * Allows others to access the computer * Sends itself to email addresses found on the infected computer * Forges the sender's email address Aliases * Email-Worm.Win32.Doombot.a * W32/Mytob.MZ{at}mm * W32/Mytob.gen{at}MM * W32/Mytob.gi{at}MM * Worm.Mytob.GE * Worm.Mytob.IU Prevalence (1-5) 4 Description W32/Mytob-EY is a mass-mailing worm and IRC backdoor Trojan for the Windows platform. Messages sent by the worm will have the following characteristics: Subject: chosen randomly from a list including Notice of account limitation Email Account Suspension Security measures Members Support Important Notification Attachment name: chosen randomly from a list including account-report readme document account-info email-details or a few randomly chosen characters followed by the ZIP extension The ZIP file contains a copy of W32/Mytob-EY with the same basename and a double extension. The worm forges the sender address using the domain name of the recipient. Advanced W32/Mytob-EY is a mass-mailing worm and IRC backdoor Trojan for the Windows platform. Messages sent by the worm will have the following characteristics: Subject: one of Notice of account limitation Email Account Suspension Security measures Members Support Important Notification Warning Message: Your services near to be closed. Your Account is Suspended For Security Reasons DETECTED Online User Violation Your Account is Suspended Your new account password is approved You have successfully updated your password Your password has been successfully updated Your password has been updated Attachment: one of account-report readme document account-info email-details account-details important-details accepted-password account-password approved-password password new-password email-password updated-password or a few randomly chosen characters followed by the ZIP extension The ZIP file contains a copy of W32/Mytob-EY with the same basename and a double extension. The worm chooses a From: address using the recipient's domain name and one of the following usernames: support administrator mail service admin info register webmaster W32/Mytob-EY will not spread to email addresses containing any of the following strings: spm spam www abuse -._!{at} -._! .edu avp syma icrosof msn. hotmail panda sopho borlan inpris example mydomai nodomai ruslis .gov gov. .mil foo. berkeley unix math bsd mit.e gnu fsf. ibm.com google kernel linux fido usenet iana ietf rfc-ed sendmail arin. ripe. isi.e isc.o secur acketst pgp tanford.e utgers.ed mozilla root info samples postmaster webmaster noone nobody nothing anyone someone your you bugs rating site contact soft somebody privacy service help not submit feste gold-certs the.bat page admin icrosoft support ntivi listserv certific accoun W32/Mytob-EY runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. When first run W32/Mytob-EY copies itself to \winsvc.exe. The following registry entries are created to run winsvc.exe on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS SVC winsvc.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices WINDOWS SVC winsvc.exe W32/Mytob-EY sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess Start 4 W32/Mytob-EY terminates the following security-related processes: ACKWIN32.EXE ADAWARE.EXE ADVXDWIN.EXE AGENTSVR.EXE AGENTW.EXE ALERTSVC.EXE ALEVIR.EXE ALOGSERV.EXE AMON9X.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ARR.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATUPDATER.EXE ATWATCH.EXE AU.EXE AUPDATE.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AVCONSOL.EXE AVE32.EXE AVGCC32.EXE AVGCTRL.EXE AVGNT.EXE AVGSERV.EXE AVGSERV9.EXE AVGUARD.EXE AVGW.EXE AVKPOP.EXE AVKSERV.EXE AVKSERVICE.EXE AVKWCTl9.EXE AVLTMAIN.EXE AVNT.EXE AVP.EXE AVP32.EXE AVPCC.EXE AVPDOS32.EXE AVPM.EXE AVPTC32.EXE AVPUPD.EXE AVSCHED32.EXE AVSYNMGR.EXE AVWINNT.EXE AVWUPD.EXE AVWUPD32.EXE AVWUPSRV.EXE AVXMONITOR9X.EXE AVXMONITORNT.EXE AVXQUAR.EXE BACKWEB.EXE BARGAINS.EXE BD_PROFESSIONAL.EXE BEAGLE.EXE BELT.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BLSS.EXE BOOTCONF.EXE BOOTWARN.EXE BORG2.EXE BPC.EXE BRASIL.EXE BS120.EXE BUNDLE.EXE BVT.EXE CCAPP.EXE CCEVTMGR.EXE CCPXYSVC.EXE CDP.EXE CFD.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE CFINET.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CLICK.EXE CMD32.EXE CMESYS.EXE CMGRDIAN.EXE CMON016.EXE CONNECTIONMONITOR.EXE CPD.EXE CPF9X206.EXE CPFNT206.EXE CTRL.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE CLAW95CF.EXE DATEMANAGER.EXE DCOMX.EXE DEFALERT.EXE DEFSCANGUI.EXE DEFWATCH.EXE DEPUTY.EXE DIVX.EXE DLLCACHE.EXE DLLREG.EXE DOORS.EXE DPF.EXE DPFSETUP.EXE DPPS2.EXE DRWATSON.EXE DRWEB32.EXE DRWEBUPW.EXE DSSAGENT.EXE DVP95.EXE DVP95_0.EXE ECENGINE.EXE EFPEADM.EXE EMSW.EXE ENT.EXE ESAFE.EXE ESCANHNT.EXE ESCANV95.EXE ESPWATCH.EXE ETHEREAL.EXE ETRUSTCIPE.EXE EVPN.EXE EXANTIVIRUS-CNET.EXE EXE.AVXW.EXE EXPERT.EXE EXPLORE.EXE F-PROT.EXE F-PROT95.EXE F-STOPW.EXE FAMEH32.EXE FAST.EXE FCH32.EXE FIH32.EXE FINDVIRU.EXE FIREWALL.EXE FNRB32.EXE FP-WIN.EXE FP-WIN_TRIAL.EXE FPROT.EXE FRW.EXE FSAA.EXE FSAV.EXE FSAV32.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE FSGK32.EXE FSM32.EXE FSMA32.EXE FSMB32.EXE GATOR.EXE GBMENU.EXE GBPOLL.EXE GENERICS.EXE GMT.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HBINST.EXE HBSRV.EXE HOTACTIO.EXE HOTPATCH.EXE HTLOG.EXE HTPATCH.EXE HWPE.EXE HXDL.EXE HXIUL.EXE IAMAPP.EXE IAMSERV.EXE IAMSTATS.EXE IBMASN.EXE IBMAVSP.EXE ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPPNT.EXE IDLE.EXE IEDLL.EXE IEDRIVER.EXE IEXPLORER.EXE IFACE.EXE IFW2000.EXE INETLNFO.EXE INFUS.EXE INFWIN.EXE INIT.EXE INTDEL.EXE INTREN.EXE IOMON98.EXE ISTSVC.EXE JAMMER.EXE JDBGMRG.EXE JEDI.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KAVPF.EXE KAZZA.EXE KEENVALUE.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-WRP-421-EN-WIN.EXE KERNEL32.EXE KILLPROCESSSETUP161.EXE LAUNCHER.EXE LDNETMON.EXE LDPRO.EXE LDPROMENU.EXE LDSCAN.EXE LNETINFO.EXE LOADER.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LOOKOUT.EXE LORDPE.EXE LSETUP.EXE LUALL.EXE LUAU.EXE LUCOMSERVER.EXE LUINIT.EXE LUSPT.EXE MAPISVC32.EXE MCAGENT.EXE MCMNHDLR.EXE MCSHIELD.EXE MCTOOL.EXE MCUPDATE.EXE MCVSRTE.EXE MCVSSHLD.EXE MD.EXE MFIN32.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGAVRTCL.EXE MGAVRTE.EXE MGHTML.EXE MGUI.EXE MINILOG.EXE MMOD.EXE MONITOR.EXE MOOLIVE.EXE MOSTAT.EXE MPFAGENT.EXE MPFSERVICE.EXE MPFTRAY.EXE MRFLUX.EXE MSAPP.EXE MSBB.EXE MSBLAST.EXE MSCACHE.EXE MSCCN32.EXE MSCMAN.EXE MSCONFIG.EXE MSDM.EXE MSDOS.EXE MSIEXEC16.EXE MSINFO32.EXE MSLAUGH.EXE MSMGT.EXE MSMSGRI32.EXE MSSMMC32.EXE MSSYS.EXE MSVXD.EXE MU0311AD.EXE MWATCH.EXE N32SCANW.EXE NAV.EXE AUTO-PROTECT.NAV80TRY.EXE NAVAP.NAVAPSVC.EXE NAVAPSVC.EXE NAVAPW32.EXE NAVDX.EXE NAVLU32.EXE NAVNT.EXE NAVSTUB.EXE NAVW32.EXE NAVWNT.EXE NC2000.EXE NCINST4.EXE NDD32.EXE NEOMONITOR.EXE NEOWATCHLOG.EXE NETARMOR.EXE NETD32.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NETUTILS.EXE NISSERV.EXE NISUM.EXE NMAIN.EXE NOD32.EXE NORMIST.EXE NORTON_INTERNET_SECU_3.0_407.EXE NOTSTART.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NPSCHECK.EXE NPSSVC.EXE NSCHED32.EXE NSSYS32.EXE NSTASK32.EXE NSUPDATE.EXE NT.EXE NTRTSCAN.EXE NTVDM.EXE NTXconfig.EXE NUI.EXE NUPGRADE.EXE NVARCH16.EXE NVC95.EXE NVSVC32.EXE NWINST4.EXE NWSERVICE.EXE NWTOOL16.EXE OLLYDBG.EXE ONSRVR.EXE OPTIMIZE.EXE OSTRONET.EXE OTFIX.EXE OUTPOST.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PATCH.EXE PAVCL.EXE PAVPROXY.EXE PAVSCHED.EXE PAVW.EXE PCFWALLICON.EXE PCIP10117_0.EXE PCSCAN.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PERSWF.EXE PF2.EXE PFWADMIN.EXE PGMONITR.EXE PINGSCAN.EXE PLATIN.EXE POP3TRAP.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PORTMONITOR.EXE POWERSCAN.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PRIZESURFER.EXE PRMT.EXE PRMVR.EXE PROCDUMP.EXE PROCESSMONITOR.EXE PROCEXPLORERV1.0.EXE PROGRAMAUDITOR.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE PURGE.EXE QCONSOLE.EXE QSERVER.EXE RAPAPP.EXE RAV7.EXE RAV7WIN.EXE RAV8WIN32ENG.EXE RAY.EXE RB32.EXE RCSYNC.EXE REALMON.EXE REGED.EXE REGEDIT.EXE REGEDT32.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCAN.EXE RTVSCN95.EXE RULAUNCH.EXE RUN32DLL.EXE RUNDLL.EXE RUNDLL16.EXE RUXDLL32.EXE SAFEWEB.EXE SAHAGENT.EXE SAVE.EXE SAVENOW.EXE SBSERV.EXE SC.EXE SCAM32.EXE SCAN32.EXE SCAN95.EXE SCANPM.EXE SCRSCAN.EXE SETUPVAMEEVAL.EXE SETUP_FLOWPROTECTOR_US.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SHOWBEHIND.EXE SMC.EXE SMS.EXE SMSS32.EXE SOAP.EXE SOFI.EXE SPERM.EXE SPF.EXE SPHINX.EXE SPOLER.EXE SPOOLCV.EXE SPOOLSV32.EXE SPYXX.EXE SREXE.EXE SRNG.EXE SS3EDIT.EXE SSGRATE.EXE SSG_4104.EXE ST2.EXE START.EXE STCLOADER.EXE SUPFTRL.EXE SUPPORT.EXE SUPPORTER5.EXE SVC.EXE SVCHOSTC.EXE SVCHOSTS.EXE SVSHOST.EXE SWEEP95.EXE SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE SYMPROXYSVC.EXE SYMTRAY.EXE SYSEDIT.EXE SYSTEM.EXE SYSTEM32.EXE SYSUPD.EXE TASKMG.EXE TASKMO.EXE TASKMON.EXE TAUMON.EXE TBSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS-3.EXE TDS2-NT.EXE TEEKIDS.EXE TFAK.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRICKLER.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE TSADBOT.EXE TVMD.EXE TVTMD.EXE UNDOBOOT.EXE UPDAT.EXE UPDATE.EXE UPGRAD.EXE UTPOST.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VET32.EXE VET95.EXE VETTRAY.EXE VFSETUP.EXE VIR-HELP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC32.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCAN40.EXE VSCENU6.02D30.EXE VSCHED.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBDAV.EXE WEBSCANX.EXE WEBTRAP.EXE WFINDV32.EXE WHOSWATCHINGME.EXE WIMMUN32.EXE WIN-BUGSFIX.EXE WIN32.EXE WIN32US.EXE WINACTIVE.EXE WINDOW.EXE WINDOWS.EXE WININETD.EXE WININIT.EXE WININITX.EXE WINLOGIN.EXE WINMAIN.EXE WINNET.EXE WINPPR32.EXE WINRECON.EXE WINSERVN.EXE WINSSK32.EXE WINSTART.EXE WINSTART001.EXE WINTSK32.EXE WINUPDATE.EXE WKUFIND.EXE WNAD.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WUPDATER.EXE WUPDT.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE ZONALM2601.EXE ZONEALARM.EXE _AVP32.EXE _AVPCC.EXE _AVPM.EXE CMD.EXE TASKMGR.EXE NEC.EXE W32/Mytob-EY appends entries to the Windows HOSTS file in order to prevent access to several computer security websites. Name W32/Mytob-GH Type * Worm How it spreads * Email attachments Affected operating systems * Windows Side effects * Turns off anti-virus applications * Allows others to access the computer * Sends itself to email addresses found on the infected computer * Forges the sender's email address Aliases * Email-Worm.Win32.Doombot.b * W32/Mytob.NA{at}mm * W32/Mytob.gh{at}MM Prevalence (1-5) 4 Description W32/Mytob-GH is a mass-mailing worm and IRC backdoor Trojan for the Windows platform. Messages sent by the worm will have the following characteristics: Subject: chosen randomly from a list including Notice of account limitation Email Account Suspension Security measures Members Support Important Notification Attachment name: chosen randomly from a list including readme.zip document.zip account-info.zip email-details.zip account-details.zip The worm forges the sender's address, using the same domain name as the recipient. Advanced W32/Mytob-GH is a mass-mailing worm and IRC backdoor Trojan for the Windows platform. Messages sent by the worm will have the following characteristics: Subject: one of Notice of account limitation Email Account Suspension Security measures Members Support Important Notification Warning Message: Your services near to be closed. Your Account is Suspended For Security Reasons DETECTED Online User Violation Your Account is Suspended Your new account password is approved You have successfully updated your password Your password has been successfully updated Your password has been updated Attachment: one of readme.zip document.zip account-info.zip email-details.zip account-details.zip important-details.zip accepted-password.zip account-password.zip approved-password.zip password.zip new-password.zip email-password.zip updated-password.zip or a few randomly chosen characters followed by the ZIP extension The ZIP file contains a copy of W32/Mytob-GH with the same basename and a double extension. The worm chooses a From: address using the recipient's domain name and one of the following usernames: support administrator mail service admin info register webmaster W32/Mytob-GH will not spread to email addresses containing any of the following strings: spm spam www abuse -._!{at} -._! .edu avp syma icrosof msn. hotmail panda sopho borlan inpris example mydomai nodomai ruslis .gov gov. .mil foo. berkeley unix math bsd mit.e gnu fsf. ibm.com google kernel linux fido usenet iana ietf rfc-ed sendmail arin. ripe. isi.e isc.o secur acketst pgp tanford.e utgers.ed mozilla root info samples postmaster webmaster noone nobody nothing anyone someone your you bugs rating site contact soft somebody privacy service help not submit feste gold-certs the.bat page admin icrosoft support ntivi listserv certific accoun W32/Mytob-GH runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. When first run W32/Mytob-GH copies itself to \d.exe. The following registry entries are created to run d.exe on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SYSTEM d.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices SYSTEM d.exe W32/Mytob-GH sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess Start 4 W32/Mytob-GH terminates the following security-related processes: ACKWIN32.EXE ADAWARE.EXE ADVXDWIN.EXE AGENTSVR.EXE AGENTW.EXE ALERTSVC.EXE ALEVIR.EXE ALOGSERV.EXE AMON9X.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ARR.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATUPDATER.EXE ATWATCH.EXE AU.EXE AUPDATE.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AVCONSOL.EXE AVE32.EXE AVGCC32.EXE AVGCTRL.EXE AVGNT.EXE AVGSERV.EXE AVGSERV9.EXE AVGUARD.EXE AVGW.EXE AVKPOP.EXE AVKSERV.EXE AVKSERVICE.EXE AVKWCTl9.EXE AVLTMAIN.EXE AVNT.EXE AVP.EXE AVP32.EXE AVPCC.EXE AVPDOS32.EXE AVPM.EXE AVPTC32.EXE AVPUPD.EXE AVSCHED32.EXE AVSYNMGR.EXE AVWINNT.EXE AVWUPD.EXE AVWUPD32.EXE AVWUPSRV.EXE AVXMONITOR9X.EXE AVXMONITORNT.EXE AVXQUAR.EXE BACKWEB.EXE BARGAINS.EXE BD_PROFESSIONAL.EXE BEAGLE.EXE BELT.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BLSS.EXE BOOTCONF.EXE BOOTWARN.EXE BORG2.EXE BPC.EXE BRASIL.EXE BS120.EXE BUNDLE.EXE BVT.EXE CCAPP.EXE CCEVTMGR.EXE CCPXYSVC.EXE CDP.EXE CFD.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE CFINET.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CLICK.EXE CMD32.EXE CMESYS.EXE CMGRDIAN.EXE CMON016.EXE CONNECTIONMONITOR.EXE CPD.EXE CPF9X206.EXE CPFNT206.EXE CTRL.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE CLAW95CF.EXE DATEMANAGER.EXE DCOMX.EXE DEFALERT.EXE DEFSCANGUI.EXE DEFWATCH.EXE DEPUTY.EXE DIVX.EXE DLLCACHE.EXE DLLREG.EXE DOORS.EXE DPF.EXE DPFSETUP.EXE DPPS2.EXE DRWATSON.EXE DRWEB32.EXE DRWEBUPW.EXE DSSAGENT.EXE DVP95.EXE DVP95_0.EXE ECENGINE.EXE EFPEADM.EXE EMSW.EXE ENT.EXE ESAFE.EXE ESCANHNT.EXE ESCANV95.EXE ESPWATCH.EXE ETHEREAL.EXE ETRUSTCIPE.EXE EVPN.EXE EXANTIVIRUS-CNET.EXE EXE.AVXW.EXE EXPERT.EXE EXPLORE.EXE F-PROT.EXE F-PROT95.EXE F-STOPW.EXE FAMEH32.EXE FAST.EXE FCH32.EXE FIH32.EXE FINDVIRU.EXE FIREWALL.EXE FNRB32.EXE FP-WIN.EXE FP-WIN_TRIAL.EXE FPROT.EXE FRW.EXE FSAA.EXE FSAV.EXE FSAV32.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE FSGK32.EXE FSM32.EXE FSMA32.EXE FSMB32.EXE GATOR.EXE GBMENU.EXE GBPOLL.EXE GENERICS.EXE GMT.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HBINST.EXE HBSRV.EXE HOTACTIO.EXE HOTPATCH.EXE HTLOG.EXE HTPATCH.EXE HWPE.EXE HXDL.EXE HXIUL.EXE IAMAPP.EXE IAMSERV.EXE IAMSTATS.EXE IBMASN.EXE IBMAVSP.EXE ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPPNT.EXE IDLE.EXE IEDLL.EXE IEDRIVER.EXE IEXPLORER.EXE IFACE.EXE IFW2000.EXE INETLNFO.EXE INFUS.EXE INFWIN.EXE INIT.EXE INTDEL.EXE INTREN.EXE IOMON98.EXE ISTSVC.EXE JAMMER.EXE JDBGMRG.EXE JEDI.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KAVPF.EXE KAZZA.EXE KEENVALUE.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-WRP-421-EN-WIN.EXE KERNEL32.EXE KILLPROCESSSETUP161.EXE LAUNCHER.EXE LDNETMON.EXE LDPRO.EXE LDPROMENU.EXE LDSCAN.EXE LNETINFO.EXE LOADER.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LOOKOUT.EXE LORDPE.EXE LSETUP.EXE LUALL.EXE LUAU.EXE LUCOMSERVER.EXE LUINIT.EXE LUSPT.EXE MAPISVC32.EXE MCAGENT.EXE MCMNHDLR.EXE MCSHIELD.EXE MCTOOL.EXE MCUPDATE.EXE MCVSRTE.EXE MCVSSHLD.EXE MD.EXE MFIN32.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGAVRTCL.EXE MGAVRTE.EXE MGHTML.EXE MGUI.EXE MINILOG.EXE MMOD.EXE MONITOR.EXE MOOLIVE.EXE MOSTAT.EXE MPFAGENT.EXE MPFSERVICE.EXE MPFTRAY.EXE MRFLUX.EXE MSAPP.EXE MSBB.EXE MSBLAST.EXE MSCACHE.EXE MSCCN32.EXE MSCMAN.EXE MSCONFIG.EXE MSDM.EXE MSDOS.EXE MSIEXEC16.EXE MSINFO32.EXE MSLAUGH.EXE MSMGT.EXE MSMSGRI32.EXE MSSMMC32.EXE MSSYS.EXE MSVXD.EXE MU0311AD.EXE MWATCH.EXE N32SCANW.EXE NAV.EXE AUTO-PROTECT.NAV80TRY.EXE NAVAP.NAVAPSVC.EXE NAVAPSVC.EXE NAVAPW32.EXE NAVDX.EXE NAVLU32.EXE NAVNT.EXE NAVSTUB.EXE NAVW32.EXE NAVWNT.EXE NC2000.EXE NCINST4.EXE NDD32.EXE NEOMONITOR.EXE NEOWATCHLOG.EXE NETARMOR.EXE NETD32.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NETUTILS.EXE NISSERV.EXE NISUM.EXE NMAIN.EXE NOD32.EXE NORMIST.EXE NORTON_INTERNET_SECU_3.0_407.EXE NOTSTART.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NPSCHECK.EXE NPSSVC.EXE NSCHED32.EXE NSSYS32.EXE NSTASK32.EXE NSUPDATE.EXE NT.EXE NTRTSCAN.EXE NTVDM.EXE NTXconfig.EXE NUI.EXE NUPGRADE.EXE NVARCH16.EXE NVC95.EXE NVSVC32.EXE NWINST4.EXE NWSERVICE.EXE NWTOOL16.EXE OLLYDBG.EXE ONSRVR.EXE OPTIMIZE.EXE OSTRONET.EXE OTFIX.EXE OUTPOST.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PATCH.EXE PAVCL.EXE PAVPROXY.EXE PAVSCHED.EXE PAVW.EXE PCFWALLICON.EXE PCIP10117_0.EXE PCSCAN.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PERSWF.EXE PF2.EXE PFWADMIN.EXE PGMONITR.EXE PINGSCAN.EXE PLATIN.EXE POP3TRAP.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PORTMONITOR.EXE POWERSCAN.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PRIZESURFER.EXE PRMT.EXE PRMVR.EXE PROCDUMP.EXE PROCESSMONITOR.EXE PROCEXPLORERV1.0.EXE PROGRAMAUDITOR.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE PURGE.EXE QCONSOLE.EXE QSERVER.EXE RAPAPP.EXE RAV7.EXE RAV7WIN.EXE RAV8WIN32ENG.EXE RAY.EXE RB32.EXE RCSYNC.EXE REALMON.EXE REGED.EXE REGEDIT.EXE REGEDT32.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCAN.EXE RTVSCN95.EXE RULAUNCH.EXE RUN32DLL.EXE RUNDLL.EXE RUNDLL16.EXE RUXDLL32.EXE SAFEWEB.EXE SAHAGENT.EXE SAVE.EXE SAVENOW.EXE SBSERV.EXE SC.EXE SCAM32.EXE SCAN32.EXE SCAN95.EXE SCANPM.EXE SCRSCAN.EXE SETUPVAMEEVAL.EXE SETUP_FLOWPROTECTOR_US.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SHOWBEHIND.EXE SMC.EXE SMS.EXE SMSS32.EXE SOAP.EXE SOFI.EXE SPERM.EXE SPF.EXE SPHINX.EXE SPOLER.EXE SPOOLCV.EXE SPOOLSV32.EXE SPYXX.EXE SREXE.EXE SRNG.EXE SS3EDIT.EXE SSGRATE.EXE SSG_4104.EXE ST2.EXE START.EXE STCLOADER.EXE SUPFTRL.EXE SUPPORT.EXE SUPPORTER5.EXE SVC.EXE SVCHOSTC.EXE SVCHOSTS.EXE SVSHOST.EXE SWEEP95.EXE SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE SYMPROXYSVC.EXE SYMTRAY.EXE SYSEDIT.EXE SYSTEM.EXE SYSTEM32.EXE SYSUPD.EXE TASKMG.EXE TASKMO.EXE TASKMON.EXE TAUMON.EXE TBSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS-3.EXE TDS2-NT.EXE TEEKIDS.EXE TFAK.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRICKLER.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE TSADBOT.EXE TVMD.EXE TVTMD.EXE UNDOBOOT.EXE UPDAT.EXE UPDATE.EXE UPGRAD.EXE UTPOST.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VET32.EXE VET95.EXE VETTRAY.EXE VFSETUP.EXE VIR-HELP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC32.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCAN40.EXE VSCENU6.02D30.EXE VSCHED.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBDAV.EXE WEBSCANX.EXE WEBTRAP.EXE WFINDV32.EXE WHOSWATCHINGME.EXE WIMMUN32.EXE WIN-BUGSFIX.EXE WIN32.EXE WIN32US.EXE WINACTIVE.EXE WINDOW.EXE WINDOWS.EXE WININETD.EXE WININIT.EXE WININITX.EXE WINLOGIN.EXE WINMAIN.EXE WINNET.EXE WINPPR32.EXE WINRECON.EXE WINSERVN.EXE WINSSK32.EXE WINSTART.EXE WINSTART001.EXE WINTSK32.EXE WINUPDATE.EXE WKUFIND.EXE WNAD.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WUPDATER.EXE WUPDT.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE ZONALM2601.EXE ZONEALARM.EXE W32/Mytob-GH appends entries to the Windows HOSTS file in order to prevent access to several computer security websites. Name W32/Fanbot-H Type * Worm How it spreads * Email attachments * Peer-to-peer Affected operating systems * Windows Side effects * Turns off anti-virus applications * Allows others to access the computer * Sends itself to email addresses found on the infected computer * Forges the sender's email address Aliases * Email-Worm.Win32.Fanbot.h * W32/Generic.b.worm * Worm.Mytob.IS Prevalence (1-5) 3 Description W32/Fanbot-H is a mass-mailing and P2P worm and IRC backdoor Trojan for the Windows platform. W32/Fanbot-H spreads by mailing itself to email addresses found on the local computer, copying itself to P2P folders and exploiting the PNP (MS05-039) vulnerability. Messages sent by the worm have the following characteristics: Subject: chosen at random from a list including Share Skype. What is Skype? Skype for Windows 1.4 - Have you got the new Skype? Hello. We're Skype and we've got something we would like to share with you. Your Account is Suspended. Attachment name: chosen at random from a list including Skype-document.zip readme.zip Skype.zip Skype-details.zip Skype-info.zip W32/Fanbot-H forges its sender address, using the same domain as the recipient. Advanced W32/Fanbot-H is a mass-mailing and P2P worm and IRC backdoor Trojan for the Windows platform. W32/Fanbot-H spreads by mailing itself to email addresses found on the local computer, copying itself to P2P folders and exploiting the PNP (MS05-039) vulnerability. Messages sent by the worm have the following characteristics: Subject: one of Share Skype. What is Skype? Skype for Windows 1.4 - Have you got the new Skype? Hello. We're Skype and we've got something we would like to share with you. Your Account is Suspended. DETECTED Online User Violation. Your Account is Suspended For Security Reasons. Warning Message: Your services near to be closed. Important Notification! Members Support. Security measures. Email Account Suspension. Notice of account limitation. Attachment name: one of Skype-document.zip readme.zip Skype.zip Skype-details.zip Skype-info.zip Skype-stuffs.zip important-details.zip account-details.zip email-details.zip account-info.zip document.zip account-report.zip or a few randomly-chosen letters followed by the ZIP extension. The ZIP file contains a copy of W32/Fanbot-H with the same basename and a double extension. W32/Fanbot-H forges its sender address, using the same domain as the recipient and a username chosen from the following: support administrator mail service admin info register webmaster noreply W32/Fanbot-H will not spread to email addresses containing any of the following strings: -._!{at} -._! syma icrosof msn. hotmail panda sopho borlan inpris example mydomai nodomai ruslis messagelabs support .gov gov. .mil foo. antivi f-pro freeav f-secur kaspersky mcafee norman norton symantec viruslis jiangmin rising duba berkeley unix math mit.e fsf. ibm.com google kernel linux fido usenet iana ietf rfc-ed sendmail arin. ripe. isi.e isc.o secur acketst tanford.e utgers.ed mozilla sourceforge slashdot sdbot be_loyal: root info samples postmaster webmaster noone nobody nothing anyone someone your bugs rating site contact soft somebody privacy service help submit feste gold-certs the.bat page admin icrosoft ntivi listserv certific accoun master fcnz abuse .edu When first run W32/Fanbot-H copies itself to \remote.exe and installs itself as a service with the display name "Remote Procedure Call (RPC) Remote". W32/Fanbot-H makes copies of itself in folders whose names contain any of the following strings: share sharing incoming download bear donkey htdocs http kazaa lime morpheus mule upload soft The copies will have the following names: 'K.jpg.pif 1001 Sex and more.rtf.exe 3D Studio Max 6 3dsmax.exe angels.pif activation_crack.exe AcrobatReader_New.exe ACDSee 10.exe Adobe Photoshop 10 crack.exe Adobe Photoshop 10 full.exe Adobe Premiere 10.exe Ahead Nero 8.exe Altkins Diet.doc.exe American Idol.doc.exe Arnold Schwarzenegger.jpg.exe Bifrost.scr Butterfly.scr BlackIce_Firewall_Enterpriseactivation_Crack.exe Best Matrix Screensaver new.scr Britney sex xxx.jpg.exe Britney Spears and Eminem porn.jpg.exe Britney Spears blowjob.jpg.exe Britney Spears cumshot.jpg.exe Britney Spears fuck.jpg.exe Britney Spears full album.mp3.exe Britney Spears porn.jpg.exe Britney Spears Sexy archive.doc.exe Britney Spears Song text archive.doc.exe Britney Spears.jpg.exe Britney Spears.mp3.exe cool screensaver.scr Clone DVD 6.exe Cloning.doc.exe Cracks & Warez Archiv.exe doom2.doc.pif dcom_patches.exe dictionary.doc.exe dolly_buster.jpg.pif Dark Angels new.pif Dictionary English 2004 - France.doc.exe DivX 8.0 final.exe Doom 3 release 2.exe e.book.doc.exe e-book.archive.doc.exe eminem - lick my pussy.mp3.pif E-Book Archive2.rtf.exe Eminem blowjob.jpg.exe Eminem full album.mp3.exe Eminem Poster.jpg.exe Eminem sex xxx.jpg.exe Eminem Sexy archive.doc.exe Eminem Song text archive.doc.exe Eminem Spears porn.jpg.exe Eminem.mp3.exe firefox-1.6a1.en-US.win32.installer.exe Full album all.mp3.pif Gimp 1.8 Full with Key.exe how to hack.doc.exe Harry Potter 1-6 book.txt.exe Harry Potter 5.mpg.exe Harry Potter all e.book.doc.exe Harry Potter e book.doc.exe Harry Potter game.exe Harry Potter.doc.exe How to hack new.doc.exe icq2005-final.exe Internet Explorer 9 setup.exe 'K.jpg.pif Kula.scr Kula.jpg.pif Kazaa Lite 4.0 new.exe Kazaa new.exe Keygen 4 all new.exe Learn Programming 2004.doc.exe Lightwave 9 Update.exe matrix.scr MSN7-final.exe Maxthon_New.exe max payne 2.crack.exe Magix Video Deluxe 5 beta.exe Matrix.mpg.exe Microsoft Office 2003 Crack best.exe Microsoft WinXP Crack full.exe MS Service Pack 6.exe nuke2004.exe netsky source code.scr Norton Antivirus 2005 beta.exe Office_Crack.exe Opera 11.exe porno.scr programming basics.doc.exe Partitionsmagic 10 beta.exe Porno Screensaver britney.scr Rain.scr rfc compilation.doc.exe RealPlayer_New.exe RFC compilation.doc.exe Ringtones.doc.exe Ringtones.mp3.exe Serial.txt.exe strippoker.exe Super Dollfie.pif Strip-Girl-2.0b.exe Serials 2005_New.exe Saddam Hussein.jpg.exe Screensaver2.scr Serials edition.txt.exe Smashing the stack full.rtf.exe Star Office 9.exe TouchNet Browser 1.29b.exe Teen Porn 15.jpg.pif The Sims 4 beta.exe UltraEdit-32 12.01 + Cracker.exe Ulead Keygen 2004.exe virii.scr Visual Studio Net Crack all.exe Winamp5.exe Winxp_Crack.exe Win Longhorn.doc.exe Win Longhorn re.exe WinAmp 13 full.exe Windows 2000 Sourcecode.doc.exe Windows 2003 crack.exe Windows XP crack.exe WinXP eBook newest.doc.exe XXX hardcore pics.jpg.exe W32/Fanbot-H terminates the following processes: PFW.exe Rfw.exe rfwsrv.exe RfwMain.exe KAVPFW.exe KAVPFW.EXE Zonealarm.exe Iparmor.exe system.exe adam.exe EGhost.exe Blackd.exe Blackice.exe fint2005.exe Trojanwall.exe pm.exe knlps.exe knlsc13.exe IceSword.exe KillBox.exe HijackThis.exe a2hijackfree.exe rkdetector.exe RootkitRevealer.exe ProcessExplorer.exe aports.exe KATMain.EXE KAV32.EXE KAVDX.EXE KAVLog2.EXE KAVStart.EXE KMailMon.EXE KPFWSvc.EXE KRecycle.EXE KShrMgr.EXE KAVStart.exe KWatch.EXE KWatch9x.EXE Rescue.EXE SetupWiz.EXE TrojanDetector.EXE Update.EXE LRSend.exe CfgWiz.exe HNetWiz.exe ccEmFlSv.exe iamstats.exe ISSVC.exe ALEScan.exe AlertAst.exe ALEUpdat.exe navustub.exe DWHWizrd.exe DefWatch.exe VPTray.exe LDVPREG.exe SymClnUp.exe SavRoam.exe Rtvscan.exe VPDN_LU.exe VPC32.exe LuaWrap.exe ALUNOTIFY.EXE AUPDATE.EXE LSETUP.EXE LUALL.EXE LuComServer.EXE LUInit.exe NDETECT.EXE SymantecRootInstaller.exe CCenter.exe RavXP.exe RavTimer.exe LangSet.exe UpGrade.exe SmartUp.exe Rav.exe RsConfig.exe MDAC.EXE RavMon.exe RavMonD.exe RavStore.exe InBuild.exe ScanBD.exe RavHDBak.exe WriteCan.exe BackRav.exe RavPatch.exe MakeBoot.exe SMARTDRV.EXE RAVDOS.EXE RegGuide.exe RegClean.exe MsAgent.exe AgtX0404.exe AgtX0411.exe AgtX0804.exe RsAgent.exe rssms.exe RavStub.exe KRegEx.exe kvdetech.exe KvDetect.exe KVDOS.exe KVOL.exe kvolself.exe KVSrvXP.exe kvupload.exe kvwsc.exe KVCenter.kxp kvdisk.kxp KVMonXP.kxp KvReport.kxp KVScan.kxp KVStory.kxp KVStub.kxp KvXP.kxp TrojDie.kxp UnInstall.kxp VirusBox.kxp Cleanup.exe CmdAgent.exe FrameworkService.exe FrmInst.exe McScript.exe naPrdMgr.exe UpdaterUI.exe McScript_InUse.exe mcupdate.exe scan32.exe shstat.exe mcconsol.exe shcfg32.exe VsTskMgr.exe logparser.exe csscan.exe ScnCfg32.Exe pireg.exe Patch.exe PCCBrows.exe pccguide.exe pcclient.exe PccLog.exe pccmain.exe PcCmdCom.exe Pccspyui.exe PcCtlCom.exe PCCTool.exe PCCVScan.exe REGSVR32.EXE Tmntsrv.exe TMOAgent.exe TmPfw.exe tmproxy.exe TRA.EXE TRIALMSG.exe TSC.EXE kavsend.exe kavsvc.exe kav.exe botzor.exe csm.exe per.exe wintbp.exe mousebm.exe wpa.exe mousemm.exe mousesync.exe hpmanager.exe Phantom.exe scrigz.exe picx.exe servce.exe hellmsn.scr msnmsgs.exe taskgmr.exe coolbot.exe antivirus_update.exe bronstab.exe smss.exe eksplorasi.pif IDTemplate.exe CVT.exe winhost.exe winldr.exe java.exe McAffeAv.exe nvchip4.exe MSTask.exe realsched.exe rundll32.exe SOUNDMAN.exe W32/Fanbot-H appends entries to the Windows HOSTS file in order to prevent access to several computer security websites. W32/Fanbot-H runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. Name W32/Mytob-FA Type * Worm How it spreads * Email attachments Affected operating systems * Windows Side effects * Turns off anti-virus applications * Allows others to access the computer * Uses its own emailing engine * Installs itself in the Registry Aliases * Net-Worm.Win32.Mytob.bi Prevalence (1-5) 2 Description W32/Mytob-FA is a mass-mailing worm and backdoor Trojan that can be controlled through the Internet Relay Chat (IRC) network. W32/Mytob-FA spreads through email. W32/Mytob-FA harvests email addresses from files on the infected computer and from the Windows address book. Email sent by W32/Mytob-FA has the following properties: Subject line: DETECTED Online User Violation Email Account Suspension Important Notification Members Support Security measures Warning Message: Your services near to be closed. You have successfully updated your password Your Account is Suspended Your Account is Suspended For Security Reasons Your new account password is approved Your password has been successfully updated Your password has been updated Message text: Dear user , You have successfully updated the password of your account. If you did not authorize this change or if you need assistance with your account, please contact customer service at: Thank you for using ! The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear user , It has come to our attention that your User Profile ( x ) records are out of date. For further details see the attached document. Thank you for using ! The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear Member, We have temporarily suspended your email account . This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors. See the details to reactivate your account. Sincerely,The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear Member, Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service. If you choose to ignore our request, you leave us no choice but to cancel your membership. Virtually yours, The Support Team +++ Attachment: No Virus found +++ Antivirus - www. In the above message text samples would be replaced with text aquired from the harvested email addresses. The attached file consists of a base name followed by the extensions CMD, PIF, SCR, EXE or ZIP. The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are randomly chosen from: accepted-password account-details account-info account-password account-report approved-password document email-details email-password important-details new-password password readme updated-password Advanced W32/Mytob-FA is a mass-mailing worm and backdoor Trojan that can be controlled through the Internet Relay Chat (IRC) network. W32/Mytob-FA spreads through email. W32/Mytob-FA harvests email addresses from files on the infected computer and from the Windows address book. Email sent by W32/Mytob-FA has the following properties: Subject line: DETECTED Online User Violation Email Account Suspension Important Notification Members Support Security measures Warning Message: Your services near to be closed. You have successfully updated your password Your Account is Suspended Your Account is Suspended For Security Reasons Your new account password is approved Your password has been successfully updated Your password has been updated Message text: Dear user , You have successfully updated the password of your account. If you did not authorize this change or if you need assistance with your account, please contact customer service at: Thank you for using ! The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear user , It has come to our attention that your User Profile ( x ) records are out of date. For further details see the attached document. Thank you for using ! The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear Member, We have temporarily suspended your email account . This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors. See the details to reactivate your account. Sincerely,The Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www. Dear Member, Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service. If you choose to ignore our request, you leave us no choice but to cancel your membership. Virtually yours, The Support Team +++ Attachment: No Virus found +++ Antivirus - www. In the above message text samples would be replaced with text aquired from the harvested email addresses. The attached file consists of a base name followed by the extensions CMD, PIF, SCR, EXE or ZIP. The worm may optionally create double extensions where the first extension is DOC, TXT or HTM and the final extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are randomly chosen from: accepted-password account-details account-info account-password account-report approved-password document email-details email-password important-details new-password password readme updated-password The worm avoids sending email to addresses that contain the following: .gov .mil accoun acketst admin anyone arin. avp berkeley borlan bsd bsd bugs ca certific contact example feste fido foo. fsf. gnu gold-certs google google gov. help iana ibm.com icrosof icrosoft ietf info inpris isc.o isi.e kernel linux linux listserv math me mit.e mozilla mydomai no nobody nodomai noone not nothing ntivi page panda pgp postmaster privacy rating rfc-ed ripe. root ruslis samples secur sendmail service site soft somebody someone sopho submit support syma tanford.e the.bat unix unix usenet utgers.ed webmaster you your When run, W32/Mytob-FA copies itself to the Windows system folder as wID32.exe and sets the following registry entries in order to run each time a user logs on: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS ID SYSTEM "wID32.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices WINDOWS ID SYSTEM "wID32.exe" W32/Mytob-FA sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess Start 4 W32/Mytob-FA modifies the HOSTS file, changing the URL-to-IP mappings for selected websites, therefore preventing normal access to these sites: 127.0.0.1 www.symantec.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 symantec.com 127.0.0.1 www.sophos.com 127.0.0.1 sophos.com 127.0.0.1 www.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 www.viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 f-secure.com 127.0.0.1 www.f-secure.com 127.0.0.1 kaspersky.com 127.0.0.1 kaspersky-labs.com 127.0.0.1 www.avp.com 127.0.0.1 www.kaspersky.com 127.0.0.1 avp.com 127.0.0.1 www.networkassociates.com 127.0.0.1 networkassociates.com 127.0.0.1 www.ca.com 127.0.0.1 ca.com 127.0.0.1 mast.mcafee.com 127.0.0.1 my-etrust.com 127.0.0.1 www.my-etrust.com 127.0.0.1 download.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 nai.com 127.0.0.1 www.nai.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 us.mcafee.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 customer.symantec.com 127.0.0.1 rads.mcafee.com 127.0.0.1 trendmicro.com 127.0.0.1 www.trendmicro.com 127.0.0.1 www.grisoft.com 127.0.0.1 www.microsoft.com 127.0.0.1 microsoft.com 127.0.0.1 www.msn.com 127.0.0.1 www.virustotal.com 127.0.0.1 virustotal.com 127.0.0.1 www.oxyd.fr 127.0.0.1 oxyd.fr 127.0.0.1 www.t35.com 127.0.0.1 t35.com 127.0.0.1 www.t35.net 127.0.0.1 t35.net W32/Mytob-FA terminates the following applications and security-related processes: ACKWIN32.EXE ADAWARE.EXE ADVXDWIN.EXE AGENTSVR.EXE AGENTW.EXE ALERTSVC.EXE ALEVIR.EXE ALOGSERV.EXE AMON9X.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ARR.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATUPDATER.EXE ATUPDATER.EXE ATWATCH.EXE AU.EXE AUPDATE.EXE AUPDATE.EXE AUTO-PROTECT.NAV80TRY.EXE AUTODOWN.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AUTOUPDATE.EXE AVCONSOL.EXE AVE32.EXE AVGCC32.EXE AVGCTRL.EXE AVGNT.EXE AVGSERV.EXE AVGSERV9.EXE AVGUARD.EXE AVGW.EXE AVKPOP.EXE AVKSERV.EXE AVKSERVICE.EXE AVKWCTl9.EXE AVLTMAIN.EXE AVNT.EXE AVP.EXE AVP32.EXE AVPCC.EXE AVPDOS32.EXE AVPM.EXE AVPTC32.EXE AVPUPD.EXE AVPUPD.EXE AVSCHED32.EXE AVSYNMGR.EXE AVWINNT.EXE AVWUPD.EXE AVWUPD32.EXE AVWUPD32.EXE AVWUPSRV.EXE AVXMONITOR9X.EXE AVXMONITORNT.EXE AVXQUAR.EXE AVXQUAR.EXE BACKWEB.EXE BARGAINS.EXE BD_PROFESSIONAL.EXE BEAGLE.EXE BELT.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BLSS.EXE BOOTCONF.EXE BOOTWARN.EXE BORG2.EXE BPC.EXE BRASIL.EXE BS120.EXE BUNDLE.EXE BVT.EXE CCAPP.EXE CCEVTMGR.EXE CCPXYSVC.EXE CDP.EXE CFD.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE CFIAUDIT.EXE CFINET.EXE CFINET32.EXE CLAW95CF.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CLICK.EXE CMD.EXE CMD32.EXE CMESYS.EXE CMGRDIAN.EXE CMON016.EXE CONNECTIONMONITOR.EXE CPD.EXE CPF9X206.EXE CPFNT206.EXE CTRL.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE DATEMANAGER.EXE DCOMX.EXE DEFALERT.EXE DEFSCANGUI.EXE DEFWATCH.EXE DEPUTY.EXE DIVX.EXE DLLCACHE.EXE DLLREG.EXE DOORS.EXE DPF.EXE DPFSETUP.EXE DPPS2.EXE DRWATSON.EXE DRWEB32.EXE DRWEBUPW.EXE DSSAGENT.EXE DVP95.EXE DVP95_0.EXE ECENGINE.EXE EFPEADM.EXE EMSW.EXE ENT.EXE ESAFE.EXE ESCANHNT.EXE ESCANV95.EXE ESPWATCH.EXE ETHEREAL.EXE ETRUSTCIPE.EXE EVPN.EXE EXANTIVIRUS-CNET.EXE EXE.AVXW.EXE EXPERT.EXE EXPLORE.EXE F-PROT.EXE F-PROT95.EXE F-STOPW.EXE FAMEH32.EXE FAST.EXE FCH32.EXE FIH32.EXE FINDVIRU.EXE FIREWALL.EXE FNRB32.EXE FP-WIN.EXE FP-WIN_TRIAL.EXE FPROT.EXE FRW.EXE FSAA.EXE FSAV.EXE FSAV32.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE FSGK32.EXE FSM32.EXE FSMA32.EXE FSMB32.EXE GATOR.EXE GBMENU.EXE GBPOLL.EXE GENERICS.EXE GMT.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HBINST.EXE HBSRV.EXE HOTACTIO.EXE HOTPATCH.EXE HTLOG.EXE HTPATCH.EXE HWPE.EXE HXDL.EXE HXIUL.EXE IAMAPP.EXE IAMSERV.EXE IAMSTATS.EXE IBMASN.EXE IBMAVSP.EXE ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPPNT.EXE IDLE.EXE IEDLL.EXE IEDRIVER.EXE IEXPLORER.EXE IFACE.EXE IFW2000.EXE INETLNFO.EXE INFUS.EXE INFWIN.EXE INIT.EXE INTDEL.EXE INTREN.EXE IOMON98.EXE ISTSVC.EXE JAMMER.EXE JDBGMRG.EXE JEDI.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KAVPF.EXE KAZZA.EXE KEENVALUE.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-WRP-421-EN-WIN.EXE KERNEL32.EXE KILLPROCESSSETUP161.EXE LAUNCHER.EXE LDNETMON.EXE LDPRO.EXE LDPROMENU.EXE LDSCAN.EXE LNETINFO.EXE LOADER.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LOOKOUT.EXE LORDPE.EXE LSETUP.EXE LUALL.EXE LUALL.EXE LUAU.EXE LUCOMSERVER.EXE LUINIT.EXE LUSPT.EXE MAPISVC32.EXE MCAGENT.EXE MCMNHDLR.EXE MCSHIELD.EXE MCTOOL.EXE MCUPDATE.EXE MCUPDATE.EXE MCVSRTE.EXE MCVSSHLD.EXE MD.EXE MFIN32.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGAVRTCL.EXE MGAVRTE.EXE MGHTML.EXE MGUI.EXE MINILOG.EXE MMOD.EXE MONITOR.EXE MOOLIVE.EXE MOSTAT.EXE MPFAGENT.EXE MPFSERVICE.EXE MPFTRAY.EXE MRFLUX.EXE MSAPP.EXE MSBB.EXE MSBLAST.EXE MSCACHE.EXE MSCCN32.EXE MSCMAN.EXE MSCONFIG.EXE MSDM.EXE MSDOS.EXE MSIEXEC16.EXE MSINFO32.EXE MSLAUGH.EXE MSMGT.EXE MSMSGRI32.EXE MSSMMC32.EXE MSSYS.EXE MSVXD.EXE MU0311AD.EXE MWATCH.EXE N32SCANW.EXE NAV.EXE NAVAP.NAVAPSVC.EXE NAVAPSVC.EXE NAVAPW32.EXE NAVDX.EXE NAVLU32.EXE NAVNT.EXE NAVSTUB.EXE NAVW32.EXE NAVWNT.EXE NC2000.EXE NCINST4.EXE NDD32.EXE NEOMONITOR.EXE NEOWATCHLOG.EXE NETARMOR.EXE NETD32.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NETUTILS.EXE NISSERV.EXE NISUM.EXE NMAIN.EXE NOD32.EXE NORMIST.EXE NORTON_INTERNET_SECU_3.0_407.EXE NOTSTART.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NPSCHECK.EXE NPSSVC.EXE NSCHED32.EXE NSSYS32.EXE NSTASK32.EXE NSUPDATE.EXE NT.EXE NTRTSCAN.EXE NTVDM.EXE NTXconfig.EXE NUI.EXE NUPGRADE.EXE NUPGRADE.EXE NVARCH16.EXE NVC95.EXE NVSVC32.EXE NWINST4.EXE NWSERVICE.EXE NWTOOL16.EXE OLLYDBG.EXE ONSRVR.EXE OPTIMIZE.EXE OSTRONET.EXE OTFIX.EXE OUTPOST.EXE OUTPOST.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PATCH.EXE PAVCL.EXE PAVPROXY.EXE PAVSCHED.EXE PAVW.EXE PCFWALLICON.EXE PCIP10117_0.EXE PCSCAN.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PERSWF.EXE PF2.EXE PFWADMIN.EXE PGMONITR.EXE PINGSCAN.EXE PLATIN.EXE POP3TRAP.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PORTMONITOR.EXE POWERSCAN.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PRIZESURFER.EXE PRMT.EXE PRMVR.EXE PROCDUMP.EXE PROCESSMONITOR.EXE PROCEXPLORERV1.0.EXE PROGRAMAUDITOR.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE PURGE.EXE QCONSOLE.EXE QSERVER.EXE RAPAPP.EXE RAV7.EXE RAV7WIN.EXE RAV8WIN32ENG.EXE RAY.EXE RB32.EXE RCSYNC.EXE REALMON.EXE REGED.EXE REGEDIT.EXE REGEDT32.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCAN.EXE RTVSCN95.EXE RULAUNCH.EXE RUN32DLL.EXE RUNDLL.EXE RUNDLL16.EXE RUXDLL32.EXE SAFEWEB.EXE SAHAGENT.EXE SAVE.EXE SAVENOW.EXE SBSERV.EXE SC.EXE SCAM32.EXE SCAN32.EXE SCAN95.EXE SCANPM.EXE SCRSCAN.EXE SETUPVAMEEVAL.EXE SETUP_FLOWPROTECTOR_US.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SHOWBEHIND.EXE SMC.EXE SMS.EXE SMSS32.EXE SOAP.EXE SOFI.EXE SPERM.EXE SPF.EXE SPHINX.EXE SPOLER.EXE SPOOLCV.EXE SPOOLSV32.EXE SPYXX.EXE SREXE.EXE SRNG.EXE SS3EDIT.EXE SSGRATE.EXE SSG_4104.EXE ST2.EXE START.EXE STCLOADER.EXE SUPFTRL.EXE SUPPORT.EXE SUPPORTER5.EXE SVC.EXE SVCHOSTC.EXE SVCHOSTS.EXE SVSHOST.EXE SWEEP95.EXE SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE SYMPROXYSVC.EXE SYMTRAY.EXE SYSEDIT.EXE SYSTEM.EXE SYSTEM32.EXE SYSUPD.EXE TASKMG.EXE TASKMGR.EXE TASKMO.EXE TASKMON.EXE TAUMON.EXE TBSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS-3.EXE TDS2-NT.EXE TEEKIDS.EXE TFAK.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRICKLER.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE TSADBOT.EXE TVMD.EXE TVTMD.EXE UNDOBOOT.EXE UPDAT.EXE UPDATE.EXE UPDATE.EXE UPGRAD.EXE UTPOST.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VET32.EXE VET95.EXE VETTRAY.EXE VFSETUP.EXE VIR-HELP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC32.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCAN40.EXE VSCENU6.02D30.EXE VSCHED.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBDAV.EXE WEBSCANX.EXE WEBTRAP.EXE WFINDV32.EXE WHOSWATCHINGME.EXE WIMMUN32.EXE WIN-BUGSFIX.EXE WIN32.EXE WIN32US.EXE WINACTIVE.EXE WINDOW.EXE WINDOWS.EXE WININETD.EXE WININIT.EXE WININITX.EXE WINLOGIN.EXE WINMAIN.EXE WINNET.EXE WINPPR32.EXE WINRECON.EXE WINSERVN.EXE WINSSK32.EXE WINSTART.EXE WINSTART001.EXE WINTSK32.EXE WINUPDATE.EXE WKUFIND.EXE WNAD.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WUPDATER.EXE WUPDT.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE ZONALM2601.EXE ZONEALARM.EXE _AVP32.EXE _AVPCC.EXE _AVPM.EXE Name Troj/Bancban-AN Type * Spyware Trojan Affected operating systems * Windows Side effects * Steals information * Records keystrokes * Installs itself in the Registry Aliases * Trojan-Spy.Win32.Banbra.ad * PWS-Bancban.gen.b Prevalence (1-5) 2 Description Troj/Bancban-AN is a data stealing Trojan which attempts to capture confidential information related to internet banking, such as usernames and logon passwords. Troj/Bancban-AN will then attempt to email the stolen information to a pre-defined email address. Advanced Troj/Bancban-AN is a data stealing Trojan which attempts to capture confidential information related to internet banking, such as usernames and logon passwords. Troj/Bancban-AN will copy itself to a folder named Systens that it creates under the Windows system folder as smss.exe Troj/Bancban-AN creates the following registry entry to run itself on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KernellApps32 smss.exe Troj/Bancban-AN will then attempt to email the stolen information to a pre-defined email address. Name W32/Leebad-A Type * Spyware Worm How it spreads * Network shares Affected operating systems * Windows Side effects * Reduces system security * Records keystrokes Aliases * Worm.Win32.Leebad.a * W32/Sautor.worm * TROJ_ADDUSER.F Prevalence (1-5) 2 Description W32/Leebad-A is a worm for the Windows platform that copies files to the root folder of all functional drives, including network drives. Advanced W32/Leebad-A is a worm for the Windows platform that will copy the following files to the root folder of all functional drives, including network drives: * admin.bat, which sets a new administrator account with the password abcd1234!{at}# * autorun.inf, which runs system32.exe when opened * System32.exe, the main worm component * system32dll.dll, which includes keylogger functionality Name W32/Rbot-ASH Type * Spyware Worm How it spreads * Network shares Affected operating systems * Windows Side effects * Turns off anti-virus applications * Allows others to access the computer * Steals information * Drops more malware * Uses its own emailing engine Aliases * Backdoor.Win32.IRCBot.hp Prevalence (1-5) 2 Description W32/Rbot-ASH is a network worm with backdoor Trojan functionality for the Windows platform. Advanced W32/Rbot-ASH is a network worm with backdoor Trojan functionality for the Windows platform. The worm copies itself to a file named lockx.exe in the Windows system folder and creates the following registry entries: HKCU\Software\Microsoft\Windows\CurrentVersion\Run stratas lockx.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run stratas lockx.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices stratas lockx.exe W32/Rbot-ASH creates the file msdirectx.sys (detected by Sophos's Anti-Virus products as Troj/NtRootK-F) and registers the file as a service process. The following registry entries are created: HKLM\SYSTEM\CurrentControlSet\Services\msdirectx W32/Rbot-ASH can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-ASH can be instructed by a remote user to perform the following functions: start an FTP server start a Proxy server start a web server take part in distributed denial of service (DDoS) attacks log keypresses capture screen/webcam images packet sniffing port scanning download/execute arbitrary files start a remote shell (RLOGIN) steal product registration information from certain software W32/Rbot-ASH spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers and using backdoors opened by other worms or Trojans. Name W32/Rbot-ASI Type * Worm Affected operating systems * Windows Side effects * Allows others to access the computer * Installs itself in the Registry * Exploits system or software vulnerabilities Aliases * Backdoor.Win32.Rbot.agb * WORM_SDBOT.CLP Prevalence (1-5) 2 Description W32/Rbot-ASI is a worm and IRC backdoor Trojan for the Windows platform. W32/Rbot-ASI can spread to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), PNP (MS05-039), and ASN.1 (MS04-007). W32/Rbot-ASI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. Advanced W32/Rbot-ASI is a worm and IRC backdoor Trojan for the Windows platform. W32/Rbot-ASI can spread to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), PNP (MS05-039), and ASN.1 (MS04-007). W32/Rbot-ASI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. When first run W32/Rbot-ASI copies itself to \winsrvc.exe. The following registry entries are created to run winsrvc.exe on startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Service Utitity winsrvc.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Service Utitity winsrvc.exe HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices Windows Service Utitity winsrvc.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Windows Service Utitity winsrvc.exe Registry entries are set as follows: HKCU\SYSTEM\CurrentControlSet\Control\Lsa Windows Service Utitity winsrvc.exe HKLM\SYSTEM\CurrentControlSet\Control\Lsa Windows Service Utitity winsrvc.exe HKCU\Software\Microsoft\OLE Windows Service Utitity winsrvc.exe HKLM\SOFTWARE\Microsoft\Ole Windows Service Utitity winsrvc.exe Name Troj/Taladra-F Type * Trojan Affected operating systems * Windows Side effects * Allows others to access the computer * Installs itself in the Registry Aliases * Trojan.Win32.Zapchast Prevalence (1-5) 2 Description Troj/Taladra-F is a backdoor Trojan for the Windows platform. Advanced Troj/Taladra-F is a backdoor Trojan for the Windows platform. When Troj/Taladra-F is installed it creates the clean file \ntsvc.ocx. Troj/Taladra-F is registered as a new system driver service named "NTAuth", with a display name of "NTAuth" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under: HKLM\SYSTEM\CurrentControlSet\Services\NTAuth\ The file ntsvc.ocx is registered as a COM object, creating registry entries under: HKCR\CLSID\(E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C) HKCR\Interface\(E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C) HKCR\Interface\(E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C) HKCR\NTService.Control.1\ HKCR\TypeLib\(E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C) Name Troj/Squado-A Type * Trojan Affected operating systems * Windows Side effects * Downloads code from the internet * Dropped by malware Aliases * Trojan-Downloader.JS.Small.bz * VBS/Psyme Prevalence (1-5) 2 Description Troj/Squado-A is a downloader Trojan for the Windows platform. Advanced Troj/Squado-A is a downloader Trojan for the Windows platform. Troj/Squado-A attempts to download a remote file to the following location so as to run on system startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MS Office.hta This file is currently detected as Troj/Psyme-CK. Name Troj/Tompai-B Type * Trojan Affected operating systems * Windows Side effects * Allows others to access the computer * Reduces system security * Installs itself in the Registry Aliases * Backdoor.Win32.Tompai.b * W32.Tombai.worm * Backdoor.Trojan * BKDR_TOMBAI.B Prevalence (1-5) 2 Description Troj/Tompai-B is a backdoor Trojan for the Windows platform. Advanced Troj/Tompai-B is a backdoor Trojan for the Windows platform. When first run Troj/Tompai-B copies itself to mapserver.exe in the Windows folder and creates three copies of itself in the folder. One of these copies will be called mainsv.exe and the others are chosen randomly from the following pairs of names: cmpku.exe and cmpkunt.exe netcompt.exe and netcomptnt.exe ptsnopt.exe and ptsnoptnt.exe ntdllf.exe and ntdllfnt.exe The following registry entries are created to run the copies of the Trojan. HKCU\Software\Microsoft\Windows\CurrentVersion\Run Ntcheck \mapserver.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cmpnt \.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce Cmpnt \mainsv.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Shell \mainsv.exe Troj/Tompai-B changes settings for Microsoft Internet Explorer by modifying values under: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ The Trojan also changes the following registry values: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ Hidden 0x00000000 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ HideFileExt 0x00000001 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ ShowSuperHidden 0x00000000 Troj/Tompai-B will open a backdoor on the infected system and report the infection by contacting a predefined URL and via email. Troj/Tompai-B gives the following options to a remote user: Access folder. Access parent folder. Change attribute of file/folder. Change drive. Delete any file. Execute any file. Force PC to Shut Down. Get IP WAN. Get the date/time of the server. Get the list of commands supported by the server Get the list of the directories. Get the list of the files. Logoff PC. Logout from the server. Reboot the PC. Show the User. Name W32/Rbot-ASS Type * Worm How it spreads * Network shares Affected operating systems * Windows Side effects * Allows others to access the computer * Installs itself in the Registry * Exploits system or software vulnerabilities Aliases * Backdoor.Win32.Rbot.gen * W32/Sdbot.worm.gen.bj Prevalence (1-5) 2 Description W32/Rbot-ASS is a worm and IRC backdoor Trojan for the Windows platform. W32/Rbot-ASS spreads: * to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix * to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007) * by copying itself to network shares protected by weak passwords W32/Rbot-ASS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. Advanced W32/Rbot-ASS is a worm and IRC backdoor Trojan for the Windows platform. W32/Rbot-ASS spreads: * to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix * to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007) * by copying itself to network shares protected by weak passwords W32/Rbot-ASS runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. When first run W32/Rbot-ASS copies itself to \psecure.exe. The following registry entries are created to run psecure.exe on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Provan Security psecure.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Provan Security psecure.exe Registry entries are set as follows: HKCU\Software\Microsoft\OLE Provan Security psecure.exe HKLM\SOFTWARE\Microsoft\Ole EnableDCOM N HKLM\SYSTEM\CurrentControlSet\Control\Lsa restrictanonymous 1 Name W32/Rbot-AST Type * Worm How it spreads * Network shares Affected operating systems * Windows Side effects * Allows others to access the computer * Reduces system security * Installs itself in the Registry * Exploits system or software vulnerabilities Prevalence (1-5) 2 Description W32/Rbot-AST is a worm and backdoor Trojan for the Windows platform. W32/Rbot-AST spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords. W32/Rbot-AST may attempt to terminate or disable various security applications. Advanced W32/Rbot-AST is a worm and backdoor Trojan for the Windows platform. W32/Rbot-AST spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812) and ASN.1 (MS04-007) and by copying itself to network shares protected by weak passwords. W32/Rbot-AST may attempt to terminate or disable various security applications. When first run W32/Rbot-AST copies itself to \wininit32.exe. The following registry entries are created to run wininit32.exe on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Update 64 BIT wininit32.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Microsoft Update 64 BIT wininit32.exe The following registry entry is set: HKCU\Software\Microsoft\OLE Microsoft Update 64 BIT wininit32.exe Name Troj/Dloader-WO Type * Trojan Affected operating systems * Windows Side effects * Turns off anti-virus applications * Downloads code from the internet * Installs itself in the Registry Prevalence (1-5) 2 Description Troj/Dloader-WO is a downloader Trojan for the Windows platform. The Trojan attempts to download and install further software and disable Microsoft Anti-Spyware. Troj/Dloader-WO may also monitor user activity. Advanced Troj/Dloader-WO is a downloader Trojan for the Windows platform. The Trojan attempts to download and install further software and disable Microsoft Anti-Spyware. Troj/Dloader-WO may also monitor user activity. When run Troj/Dloader-WO copies itself to the Windows system folder using a randomly generated filename with an extension of DLL and creates registry entries under : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ HKCR\CLSID\{00DBDAC8-4691-4797-8E6A-7C6AB89BC441}\InprocServer32 \.dll Name Troj/Perda-G Type * Spyware Trojan Affected operating systems * Windows Side effects * Allows others to access the computer * Steals information * Installs itself in the Registry Aliases * Trojan-Proxy.Win32.Agent.gt * Proxy-Agent.a Prevalence (1-5) 2 Description Troj/Perda-G is a backdoor Trojan which allows a remote intruder to gain access and control over the computer. Troj/Perda-G may attempt to steal confidential information and send it to a remote location via HTTP or email. Troj/Perda-G also includes functionality to open a random TCP port and act as a SOCKS4 proxy. Advanced Troj/Perda-G is a backdoor Trojan which allows a remote intruder to gain access and control over the computer. Troj/Perda-G may attempt to steal confidential information and send it to a remote location via HTTP or email. Troj/Perda-G also includes functionality to open a random TCP port and act as a SOCKS4 proxy. The following registry entry is created to run Troj/Perda-G on startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run filit Name Troj/Feutel-AD Type * Trojan Affected operating systems * Windows Side effects * Reduces system security * Installs itself in the Registry Aliases * BackDoor-AWQ.b Prevalence (1-5) 2 Description Troj/Feutel-AD is a backdoor Trojan for the Windows platform. Advanced Troj/Feutel-AD is a backdoor Trojan for the Windows platform. Troj/Feutel-AD copies itself to the Windows folder with the name G_Server2.0.exe. On Windows 95/98/ME, the Trojan creates the following registry entry in order to be run automatically at logon: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GrayPigeonServer2.0 G_Server2.0.exe On NT-based versions of Windows (including Windows NT, 2K and XP) the Trojan installs itself as a service with the following characteristics: servicename = GrayPigeonServer2.0 displayname = Gray_Pigeon_Server2.0 imagepath = C:\WINDOWS\G_Server2.0.exe The Trojan injects code into the Windows explorer process in order to prevent itself from being terminated. Name W32/Brontok-E Type * Worm How it spreads * Email messages * Email attachments Affected operating systems * Windows Side effects * Sends itself to email addresses found on the infected computer * Forges the sender's email address * Installs itself in the Registry * Used in DOS attacks Aliases * Email-Worm.Win32.Brontok.c * W32/Rontokbro.gen{at}MM * Worm.Mytob.GH Prevalence (1-5) 2 Description W32/Brontok-E is a worm that spreads by copying itself to network shares and by emailing itself to addresses harvested from files stored locally. W32/Brontok-E includes functionality to: - modify the HOSTS file in an attempt to prevent access to anti-virus and security related websites - carry out DDoS attacks on selected websites W32/Brontok-E may spoof the from field of emails that it sends using the addresses: Berita_???{at}kafegaul.com GaulNews_???{at}kafegaul.com Movie_???{at}playboy.com HotNews_???{at}playboy.com where ??? is variable. Advanced W32/Brontok-E is a worm that spreads by copying itself to network shares and by emailing itself to addresses harvested from files stored locally. W32/Brontok-E includes functionality to: - modify the HOSTS file in an attempt to prevent access to anti-virus and security related websites - carry out DDoS attacks on selected websites W32/Brontok-E copies itself to various folders with a filename that consists of the folder name plus an extension of ".EXE", for example W32/Brontok-E may copy itself to C:\BIN\BIN.EXE. The new copy will have a standard folder icon and when executed will open the default "My Document" folder. W32/Brontok-E collects email addresses from files that have extensions of: ASP, CFM, CSV, DOC, EML, HTM, HTML, PHP, TXT and WAB. W32/Brontok-E may spoof the from field of emails that it sends using the addresses: Berita_???{at}kafegaul.com GaulNews_???{at}kafegaul.com Movie_???{at}playboy.com HotNews_???{at}playboy.com where ??? is variable. When first run W32/Brontok-E copies itself to: \Local Settings\Application Data\csrss.exe \Local Settings\Application Data\inetinfo.exe \Local Settings\Application Data\lsass.exe \Local Settings\Application Data\services.exe \Local Settings\Application Data\smss.exe \Start Menu\Programs\Startup\empty.pif \ShellNew\sempalong.exe \eksplorasi.exe The following registry entries are created to run W32/Brontok-E on startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Tok-Cirrhatus \Local Settings\Application Data\smss.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Bron-Spizaetus \ShellNew\sempalong.exe The following registry entry is changed to run eksplorasi.exe on startup: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Explorer.exe "\eksplorasi.exe" (the default value for this registry entry is "Explorer.exe" which causes the Microsoft file \Explorer.exe to be run on startup). The following registry entry is set, disabling various Windows functions: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools 1 HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NoFolderOptions 1 HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableCMD 0 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden 0 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt 1 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowSuperHidden 0 W32/Brontok-E will restart the computer if it finds an active Window with a title containing any of the following strings: REGISTRY SYSTEM CONFIGURATION COMMAND PROMPT .EXE SHUT DOWN SCRIPT HOST LOG OFF WINDOWS KILLBOX TASKKILL TASK KILL HIJACK BLEEPING --- MultiMail/Win32 v0.43 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140) SEEN-BY: 633/267 270 @PATH: 123/140 500 106/2000 633/267
SOURCE: echomail via fidonet.ozzmosis.com

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.