[cut-n-paste from sophos.com]

Name   Troj/Danmec-F

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * MultiDropper-PH
    * Trojan.Danmec

Prevalence (1-5) 3

Description
Troj/Danmec-F is a Trojan for the Windows platform.

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files.

Troj/Danmec-F displays a fake error message with the title
"Component not found"
and the message text
"Application can not run because vbrun64.dll not found"

Advanced
Troj/Danmec-F is a Trojan for the Windows platform.

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files.

Troj/Danmec-F displays a fake error message with the title
"Component not found"
and the message text
"Application can not run because vbrun64.dll not found".

When Troj/Danmec-F is installed the following files are created:

\_uninsep.bat - may be safely deleted
\checkreg.exe - Troj/Danmec-F
\iisload.dll - Troj/Danmec-F
\s32l.txt - may be safely deleted
\ws386l.ini - may be safely deleted
\wsl6530.dll - Troj/Danmec-F

The following registry entry is created to run checkreg.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
\checkreg.exe





Name   Troj/Brepbot-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Breplibot.m
    * Backdoor.Ryknos
    * W32/Brepibot

Prevalence (1-5) 2

Description
Troj/Brepbot-B is a backdoor Trojan for the Windows platform.

Advanced
Troj/Brepbot-B is a backdoor Trojan for the Windows platform.

When first run Troj/Brepbot-B copies itself to \csrcmd.exe 
and creates the following files:

\466.bat
\755.bat

These files can be safely deleted.

The following registry entries are created to run csrcmd.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WindowsTaskStat
csrcmd.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WindowsTaskStat
csrcmd.exe

Troj/Brepbot-B includes functionality to:
- terminate and disable anti-virus and security related processes
- download files from the internet and run them





Name   Troj/Danmec-E

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * MultiDropper-PH
    * Trojan.Danmec

Prevalence (1-5) 2

Description
Troj/Danmec-E is a Trojan for the Windows platform.

Troj/Danmec-E displays a fake error message with the title "Component 
not found" and the message text "Application can not run because 
vbreun64.dll not found".

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files.

Advanced
Troj/Danmec-E is a Trojan for the Windows platform.

Troj/Danmec-E displays a fake error message with the title "Component 
not found" and the message text "Application can not run because 
vbreun64.dll not found".

When Troj/Danmec-E is installed the following files are created:

\checkreg.exe
\wsl.dll
\iisload.dll
\s32l.txt
\ws386l.ini
\_uninsep.bat

The files checkreg.exe, wsl.dll and iisload.dll are 
also detected as Troj/Danmec-E. The files s32l.txt and ws386l.ini are 
clean data files, and the file _uninsep.bat is a clean file used to 
delete components of Troj/Danmec-E.

The following registry entry is created to run checkreg.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
\checkreg.exe

Troj/Danmec-E displays a fake error message with the title "Component 
not found" and the message text "Application can not run because 
vbreun64.dll not found".

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files.





Name   Troj/Stinx-H

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Stinx-H is a Trojan for the Windows platform.

Advanced
Troj/Stinx-H is a Trojan for the Windows platform.

When first run Troj/Stinx-H copies itself to \smszac32.exe 
and creates the following files:

\442.bat
\952.bat

442.bat and 952.bat may both be deleted.

The following registry entries are created to run smszac32.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
DiskEventChk
smszac32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DiskEventChk
smszac32.exe

Troj/Stinx-H can be instructed to delete, execute, and download and 
execute files.

Troj/Stinx-H will also try and circumvent the Windows Firewall if it 
is present.





Name   Troj/Bancban-KB

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Banbra.df

Prevalence (1-5) 2

Description
Troj/Bancban-KB is a password stealing Trojan targeted at customers 
of Brazilian banks.

Troj/Bancban-KB includes functionality to access the internet and 
communicate with a remote server via HTTP.

The Trojan attempts to log keypresses entered into certain websites 
and online banking applications. The Trojan may display fake user 
interfaces in order to persuade the user to enter confidential 
details. Stolen information is sent by email to a remote user.

Advanced
Troj/Bancban-KB is a password stealing Trojan targeted at customers 
of Brazilian banks.

Troj/Bancban-KB includes functionality to access the internet and 
communicate with a remote server via HTTP.

The Trojan attempts to log keypresses entered into certain websites 
and online banking applications. The Trojan may display fake user 
interfaces in order to persuade the user to enter confidential 
details. Stolen information is sent by email to a remote user.

When Troj/Bancban-KB is installed it creates the file 
\imgrt.txt which is an image file and can be safely deleted.

Troj/Bancban-KB is usually located as the \imgrt.scr file.

The following registry entry is created to run the Trojan on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
dark
\imgrt.scr

Troj/Bancban-KB may create registry entries under the following entry:

HKCU\dark\





Name   W32/Tilebot-BY

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Aimbot.bc
    * W32/Sdbot.worm.gen.bh

Prevalence (1-5) 2

Description
W32/Tilebot-BY is a Trojan for the Windows platform.

W32/Tilebot-BY spreads:

- to other network computers by exploiting common buffer overflow 
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), 
PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Tilebot-BY runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Tilebot-BY is a Trojan for the Windows platform.

W32/Tilebot-BY spreads:

- to other network computers by exploiting common buffer overflow 
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), 
PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords

W32/Tilebot-BY runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-BY includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-BY copies itself to the Windows system 
folder.

W32/Tilebot-BY is registered as a new system driver service named 
"winmngr", with a display name of "WinMan" and a startup type of 
automatic, so that it is started automatically during system startup. 
Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\winmngr\

W32/Tilebot-BY sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Graybrd-AU

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.GrayBird.bh

Prevalence (1-5) 2

Description
Troj/GrayBrd-AU is a Trojan for the Windows platform.

Troj/GrayBrd-AU includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/GrayBrd-AU is a Trojan for the Windows platform.

Troj/GrayBrd-AU includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/GrayBrd-AU copies itself to \oyhskycn.scr.

The file oyhskycn.scr is registered as a new system driver service 
named "nServersnhsgg", with a display name of
"Serverckyysh" and a 
startup type of automatic, so that it is started automatically during 
system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\nServersnhsgg\





Name   Troj/Danmec-G

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * MultiDropper-PH

Prevalence (1-5) 2

Description
Troj/Danmec-G is a Trojan for the Windows platform.

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files and retrieve information about 
an infected system, including network details, and send these to a 
remote intruder.

Troj/Danmec-G displays a fake error message with the title "Component 
not found" and the message text "Application can not run because 
vbrun64.dll not found".

Advanced
Troj/Danmec-G is a Trojan for the Windows platform.

The Trojan opens a port and offers remote attackers the ability to 
route HTTP traffic through the infected computer. The Trojan may also 
download and install additional files and retrieve information about 
an infected system, including network details, and send these to a 
remote intruder.

Troj/Danmec-G displays a fake error message with the title "Component 
not found" and the message text "Application can not run because 
vbrun64.dll not found".

When Troj/Danmec-G is installed the following files are created:

\checkreg.exe - Troj/Danmec-G
\iisload.dll - Troj/Danmec-G
\s32l.txt - safe to delete
\ws386l.ini - safe to delete
\wsl6530.dll - Troj/Danmec-G

The following registry entry is created to run checkreg.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
\checkreg.exe





Name   W32/Mytob-GC

Type  
    * Worm

Affected operating systems  
    * Windows

Aliases  
    * Net-Worm.Win32.Mytob.gen
    * W32/Mytob.gen{at}MM

Prevalence (1-5) 2

Description
W32/Mytob-GC is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-GC runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels, including the ability to 
download and execute files on the infected computer.

W32/Mytob-GC processes the emails it has harvested by splitting them 
into name and domain, avoiding sending emails to addresses containing 
certain strings in them. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested 
domains. W32/Mytob-GC spoofs the sender, sending emails as if from 
the name "security" at the same domain as the recipient.

For example if sending itself to name{at}example.com, W32/Mytob-GC would 
send the email as if from security{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:

Account Alert
ACCOUNT ALERT

Message text - a formatted version of the following:

Dear Valued Member,

According to our terms of services, you will have to confirm your 
e-mail by the following link, or your account will be suspended 
within 24 hours for security reasons.

http://www. full 
address>/confirm.php?account=

After following the instructions in the sheet, your account will not 
be interrupted and will continue as normal.

Thanks for your attention to this request. We apologize for any 
inconvenience.

Sincerely,  Security Department

NB the link in the email actually points to a file 
Confirmation_Sheet.pif at a remote location. If sending itself to 
name{at}example.com, W32/Mytob-GC would format the fake link to appear 
to be pointing at 
http://www.name{at}example.com/confirm.php?account=example.com.

Advanced
W32/Mytob-GC is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-GC runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels, including the ability to 
download and execute files on the infected computer.

When first run W32/Mytob-GC attempts to copy itself to 
\netsvc.exe, although it is usually unsuccessful.

The following registry entries are created to run netsvc.exe on 
startup, regardless of whether it was able to copy itself there 
successfully:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Internet Services
netsvc.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Internet Services
netsvc.exe

W32/Mytob-GC sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).

W32/Mytob-GC can spread by sending a link to a file at a remote 
website to email addresses it harvests from the infected computer. 
This remote file may be a copy of W32/Mytob-GC.

W32/Mytob-GC processes the emails it has harvested by splitting them 
into name and domain, avoiding sending emails to addresses containing 
certain strings in them. Once it has sent itself to the emails it has 
harvested, it uses a predefined list of names with the harvested 
domains. W32/Mytob-GC spoofs the sender, sending emails as if from 
the name "security" at the same domain as the recipient.

For example if sending itself to name{at}example.com, W32/Mytob-GC would 
send the email as if from security{at}example.com.

Emails sent by the worm have characteristics from the following:

Subject line:

Account Alert
ACCOUNT ALERT

Message text - a formatted version of the following:

Dear Valued Member,

According to our terms of services, you will have to confirm your 
e-mail by the following link, or your account will be suspended 
within 24 hours for security reasons.

http://www. full 
address>/confirm.php?account=

After following the instructions in the sheet, your account will not 
be interrupted and will continue as normal.

Thanks for your attention to this request. We apologize for any 
inconvenience.

Sincerely,  Security Department

NB the link in the email actually points to a file 
Confirmation_Sheet.pif at a remote location. If sending itself to 
name{at}example.com, W32/Mytob-GC would format the fake link to appear 
to be pointing at 
http://www.name{at}example.com/confirm.php?account=example.com.

W32/Mytob-GC attempts to terminate a large number of processes 
related to security and anti-virus programs including REGEDIT.EXE, 
MSCONFIG.EXE and NETSTAT.EXE.

W32/Mytob-GC modifies the Windows hosts file in order to block access 
to the following security-related websites:

127.0.0.1 www.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.norton.com
127.0.0.1 norton.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.drweb.com
127.0.0.1 drweb.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 www.avira.com
127.0.0.1 avira.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.bitdefender.com
127.0.0.1 bitdefender.com
127.0.0.1 www.cert.org
127.0.0.1 cert.org
127.0.0.1 www.nod32.com
127.0.0.1 nod32.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 www.clamav.net
127.0.0.1 clamav.net
127.0.0.1 www.quickheal.com
127.0.0.1 quickheal.com
127.0.0.1 www.avp.com
127.0.0.1 avp.com
127.0.0.1 www.avg.com
127.0.0.1 avg.com
127.0.0.1 www.fortinet.com
127.0.0.1 fortinet.com
127.0.0.1 www.fortinet.net
127.0.0.1 fortinet.net
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.sarc.com
127.0.0.1 sarc.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 www.free-av.com
127.0.0.1 free-av.com
127.0.0.1 www.f-prot.com
127.0.0.1 f-prot.com
127.0.0.1 www.ravantivirus.com
127.0.0.1 ravantivirus.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.avast.com
127.0.0.1 avast.com
127.0.0.1 www.antivir.com
127.0.0.1 antivir.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 vil.nai.com
127.0.0.1 us.mcafee.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 housecall.trendmicro.com
127.0.0.1 grisoft.com
127.0.0.1 www.grisoft.com
127.0.0.1 free.grisoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com





Name   W32/Sdbot-AGC

Type  
    * Spyware Worm

How it spreads  
    * Network shares
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Installs itself in the Registry
    * Used in DOS attacks

Aliases  
    * Backdoor.Win32.SdBot.aad

Prevalence (1-5) 2

Description
W32/Sdbot-AGC is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Sdbot-AGC spreads to other network computers by Instant messaging 
programmes and by exploiting common buffer overflow vulnerabilities, 
including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 
(MS04-007).

W32/Sdbot-AGC runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-AGC disables some security related software.

Advanced
W32/Sdbot-AGC is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Sdbot-AGC spreads to other network computers by Instant messaging 
programmes and by exploiting common buffer overflow vulnerabilities, 
including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 
(MS04-007).

W32/Sdbot-AGC runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Sdbot-AGC copies itself to \taskmgr.exe.

The file \taskmgr.exe is registered as a new system driver 
service named "Microsoft Update Service", with a display name of 
"Microsoft Update Service" and a startup type of automatic, so that 
it is started automatically during system startup. Registry entries 
are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Update Service\

W32/Sdbot-AGC sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are also created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Banker-IK

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Banker.aem
    * W32/Banker.EVV

Prevalence (1-5) 2

Description
Troj/Banker-IK is a Trojan for the Windows platform.

Advanced
Troj/Banker-IK is a Trojan for the Windows platform.

The following registry entry is created to run Troj/Banker-IK on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Redirect






Name   W32/Tilebot-CB

Type  
    * Spyware Worm

How it spreads  
    * Network shares
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aad
    * W32/Sdbot.worm.gen.l
    * W32.Spybot.Worm
    * WORM_AIMDES.E

Prevalence (1-5) 2

Description
W32/Tilebot-CB is a worm with backdoor functionality for the Windows 
platform.

W32/Tilebot-CB spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: WKS (MS03-049) 
(CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007). The worm also 
spreads via network shares protected by weak passwords and AOL 
Instant Messenger.

W32/Tilebot-CB runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-CB includes functionality to:

- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard

Advanced
W32/Tilebot-CB is a worm with backdoor functionality for the Windows 
platform.

W32/Tilebot-CB spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: WKS (MS03-049) 
(CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007). The worm also 
spreads via network shares protected by weak passwords and AOL 
Instant Messenger.

W32/Tilebot-CB runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-CB includes functionality to:

- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard

When first run W32/Tilebot-CB copies itself to \lsass.exe.

The file lsass.exe is registered as a new system driver service named 
"lsass", with a display name of "Local Security Authority Subsystem 
Service" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\lsass\

W32/Tilebot-CB sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4

Additional registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto 
Update
AUOptions
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto 
Update
AUState
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

The following patches for the operating system vulnerabilities 
exploited by W32/Tilebot-CB can be obtained from the Microsoft website:

http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx
http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx





Name   Troj/Perda-I

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Trojan-Proxy.Win32.Agent.id
    * BKDR_AGENT.FO

Prevalence (1-5) 2

Description
Troj/Perda-I is a backdoor Trojan which allows a remote intruder to 
gain access and control over the computer.

Advanced
Troj/Perda-I is a backdoor Trojan which allows a remote intruder to 
gain access and control over the computer.

The following registry entry is created to run Troj/Perda-I on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
taskbar






Name   Troj/Mipbot-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * SpamTool.Win32.Mailbot.d

Prevalence (1-5) 2

Description
Troj/Mipbot-A is a Trojan for the Windows platform.

Troj/Mipbot-A attempts to connect to one of several pre-specified 
servers from where it can receive further information.

Troj/Mipbot-A is used to send unsolicited emails from an infected 
computer.

Advanced
Troj/Mipbot-A is a Trojan for the Windows platform.

Troj/Mipbot-A attempts to connect to one of several pre-specified 
servers from where it can receive further information.

Troj/Mipbot-A is used to send unsolicited emails from an infected 
computer.

The following registry entries are created to run code exported by 
the Trojan DLL on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\
DllName


HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\
Startup
Startup

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\
Impersonate
dword





Name   Troj/Dloadr-ABJ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Aliases  
    * Trojan-Dropper.Win32.Small.vv
    * Downloader-XB

Prevalence (1-5) 2

Description
Troj/Dloadr-ABJ is a Trojan for the Windows platform.

Advanced
Troj/Dloadr-ABJ is a Trojan for the Windows platform.

When Troj/Dloadr-ABJ is installed it creates the file \winloadhh.dll.

The file winloadhh.dll is detected as Troj/Dloader-NI.





Name   Troj/Funot-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer
    * Drops more malware
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
Troj/Funot-A is a Trojan for the Windows platform that includes the 
functionality to
replace existing files using the original filenames with the text 
file, rename existing files using names constructed from a predefined 
list, create text files, and to access the internet and communicate 
with a remote server via HTTP.

Advanced
Troj/Funot-A is a Trojan for the Windows platform that includes the 
following functionality:

-replaces existing files with a text file that contains the following 
message:

"Fun X27 .::{at}li-RNo.H.::.VasVase"

-renames existing files using names constructed from a predefined 
list similar to the following:

3k30
Baby Names hot
activex IT
amizesh.co
bank iran
bandar golpa
bbc
card
boot
carpet iran
...

-creates text files that contain the following message:

"Fun X27 .::{at}li-RNo.H.::.VasVase"

using names contructed from a predefined list similar to the following:

Vigen es.scf
bank.scf
business
com stories depot
farsi.scf
font
helper windows hedyeh
india islam iran.scf
iran information.scf
iran poem
iran sex
iran sites boobs
iran.scf
iraniansexyax iraniansexyaks
...

-attempts to access the internet and communicate with a remote server 
via HTTP

When first run Troj/Funot-A copies itself to the current folder with 
filenames similar to the following:

High hack rape.EXE
bank.exe
farsi sex Ebi.EXE
farsi.exe
ir3x.com salamiran word.EXE
iran picture iran666.EXE

where names of the copies may vary and are constructed from 
predefined lists.

In order to be able to run automatically at startup Troj/Funot-A sets 
a number of registry entries to the following:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run



where  may vary and  is one of the names of the 
Trojan copies.

Also Troj/Funot-A creates the file VASVASe.HTML in the current 
folder, containing the following message:

.\VASVASe.\

No Worm ; No Spy ; No Trojan ; This is Fun X27

http://www.vasvase27.blogfa.com





Name   Troj/Zapchas-AD

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
Troj/Zapchas-AD is a backdoor Trojan for the Windows platform.

Troj/Zapchas-AD runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Troj/Zapchas-AD includes functionality to access the internet and 
communicate with a remote server via HTTP.

The Trojan displays a pornographic image.

Advanced
Troj/Zapchas-AD is a backdoor Trojan for the Windows platform.

Troj/Zapchas-AD runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Troj/Zapchas-AD includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/Zapchas-AD is installed the following files are created:

\aliases.ini
\control.ini
\fullname.txt
\ident.txt
\mirc.ico
\mirc.ini
\nicks.txt
\poza.exe
\remote.ini
\script.ini
\servers.ini
\sup.bat
\sup.reg
\svchost.exe
\users.ini

The file svchost.exe is a version of the mIRC application.

The file poza.exe is an archive file containing a pornographic image. 
This is opened automatically when the Trojan is installed.

The following registry entries are set or modified, so that 
svchost.exe is run when files with extensions of CHA and IRC are 
opened/launched:

HKCR\ChatFile\Shell\open\command
(default)
\svchost.exe" -noconnect

HKCR\irc\Shell\open\command
(default)
\svchost.exe" -noconnect

Registry entries are set as follows:

HKCR\ChatFile\DefaultIcon
(default)
\svchost.exe

HKCR\irc\DefaultIcon
(default)
\svchost.exe

Registry entries are created under:

HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\

The file svchost.exe provides an uninstall option which can be 
accessed via the Add or Remove Programs dialog in the Windows Control 
Panel. The software is listed as "mIRC".

 
--- MultiMail/Win32 v0.43