| TIP: Click on subject to list as thread! | ANSI |
| echo: | |
|---|---|
| to: | |
| from: | |
| date: | |
| subject: | News, September 4 2005 |
[cut-n-paste from sophos.com]
Name W32/Lebreat-F
Type
* Worm
How it spreads
* Email messages
* Network shares
* Peer-to-peer
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 3
Description
W32/Lebreat-F is a mass-mailing worm and backdoor for the Windows
platform.
W32/Lebreat-F spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including LSASS (MS04-011) and PnP
(MS05-039).
W32/Lebreat-F also contains the functionality to act as an ftp server
allowing access to remote users.
W32/Lebreat-F will also attempt to download and execute a file from a
predefined URL. This file was not available at the time of analysis.
W32/Lebreat-F will also send itself to email addressed harvested from
the infected computer with the following attributes:
Subject line:
Changes..
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
Re: Incoming Msg
Re: Message Notify
Re: Msg reply
Re: Protected message
Re: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes
Update
Message text:
Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Encrypted document
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach.
See attach.
See the attached file for details.
Try this.
webmaster
Your document is attached.
Your file is attached.
The following patches for the operating system vulnerabilities
exploited by W32/Lebreat-F can be obtained from the Microsoft website:
MS04-011
MS05-039
Advanced
W32/Lebreat-F is a mass-mailing worm and backdoor for the Windows
platform.
W32/Lebreat-F spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including LSASS (MS04-011) and PnP
(MS05-039).
W32/Lebreat-F also contains the functionality to act as an ftp server
allowing access to remote users.
W32/Lebreat-F will also attempt to download and execute a file from a
predefined URL. This file was not available at the time of analysis.
W32/Lebreat-F will also send itself to email addressed harvested from
the infected computer with the following attributes:
Subject line:
Changes..
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
Re: Incoming Msg
Re: Message Notify
Re: Msg reply
Re: Protected message
Re: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes
Update
Message text:
Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Encrypted document
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach.
See attach.
See the attached file for details.
Try this.
webmaster
Your document is attached.
Your file is attached.
Emails will appear to come from the following domains:
aol.com
ca.com
f-secure.com
kaspersky.com
mcafee.com
microsoft.com
msn.com
sarc.com
security.com
securityfocus.com
sophos.com
symantec.com
trendmicro.com
yahoo.com
W32/Lebreat-F avoids sending to addresses containing the following
text:
{at}messagelab
{at}microsoft
anyone{at}
certific
contract{at}
f-secur
free-av
gold-certs{at}
google
icrosoft
listserv
nobody{at}
noone{at}
noreply
norton
postmaster{at}
rating{at}
samples
support
update
winrar
winzip
W32/Lebreat-F will move itself to the Windows system folder and
create the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winhost
\winhost.exe
W32/Lebreat-F will also copy itself to the following files located in
the Windows system folder:
.exe
e images.exe
e.doc.exe
Windows Sourcecode update.doc.exe
winhost.tmp
W32/Lebreat-F removes a large number of registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
W32/Lebreat-F copies itself to any folders with names containing
'shar' with the following filenames:
XXX hardcore images.exe
Windown Longhorn Beta Leak.exe
WinAmp 6 New!.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
New patch.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Office 2003 Crack, Working!.exe
Kaspersky Antivirus 5.0.exe
Ahead Nero 7.exe
W32/Lebreat-F will drop files to the following locations:
\beagle.exe (detected as W32/Bagle-BW)
\beagle.exe (detected as W32/Bagle-BW)
scan.exe (detected as W32/Lilbre-A)
\sgm32.dll (harmless can safely be removed)
\mcafee.exe (detected as W32/Lilbre-A)
W32/Lebreat-F will append the following to the HOSTS file in order to
block access to security related URLs:
127.0.0.1 ca.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mcafee.com
127.0.0.1 pandasoftware.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 us.mcafee.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.sarc.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.trendmicro.com
The following patches for the operating system vulnerabilities
exploited by W32/Lebreat-F can be obtained from the Microsoft website:
MS04-011
MS05-039
Name W32/Tilebot-B
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Deletes files off the computer
* Steals information
* Drops more malware
Aliases
* WORM_SDBOT.BVR
Prevalence (1-5) 2
Description
W32/Tilebot-B is a worm that attempts to spread to remote network
shares. It also contains backdoor functionality, allowing
unauthorized remote access to the infected computer via IRC channels.
W32/Tilebot-B spreads to network shares with weak passwords as a
result of the backdoor Trojan element receiving the appropriate
command from a remote user.
W32/Tilebot-B allows a remote user to perform a wide range of actions
on the infected computer including downloading further files, setting
registry entries and stealing information from the computer including
from protected storage areas.
W32/Tilebot-B attempts to interfere with and disable certain security
related processes.
Advanced
W32/Tilebot-B is a worm that attempts to spread to remote network
shares. It also contains backdoor functionality, allowing
unauthorized remote access to the infected computer via IRC channels.
W32/Tilebot-B spreads to network shares with weak passwords as a
result of the backdoor Trojan element receiving the appropriate
command from a remote user.
W32/Tilebot-B copies itself to the Windows folder with the filename
tsecure.exe and creates a service named "tsecure" in order to run
itself on system startup, to which it gives the fake description
"Terminal Security".
W32/Tilebot-B allows a remote user to perform a wide range of actions
on the infected computer including downloading further files, setting
registry entries and stealing information from the computer including
from protected storage areas.
W32/Tilebot-B attempts to terminate services with the following names
in order to disrupt various security processes including the Windows
firewall and Windows critical updates:
Tlntsvr
RemoteRegistry
Messenger
SharedAccess
wscsvc
W32/Tilebot-B attempts to set the following registry entries to
disrupt various security processes:
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\
AutoUpdate
AUOptions
1
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restictanonymous
1
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAlloxXPSP2
1
HKLM\SOFTWARE\Microsoft\OLE
EnableDCOM
"N"
W32/Tilebot-B may also set entries in the registry at the following
locations:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
MeltMe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Installed Time
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Record
HKLM\SYSTEM\CurrentControlSet\Control
WaitToKillServiceTimeout
W32/Tilebot-B attempts to remove network shares from the infected
computer, as well as changing the policy for SeNetworkLogonRight for
the computer.
W32/Tilebot-B may attempt to contact scripts hosted on the following
domains:
cgi14.plala.or.jp
hpcgi1.nifty.com
www.age.ne.jp
www.kinchan.net
www2.dokidoki.ne.jp
yia.s22.xrea.com
W32/Tilebot-B may attempt to drop the file RDRIV.SYS and set up a
service for it named RDRIV. This file is currently detected by
Sophos's anti-virus products as Troj/Rootkit-W.
Name Troj/Bardus-A
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Deletes files off the computer
* Steals information
* Records keystrokes
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Bardus-A is a backdoor and keylogging Trojan for the Windows
platform.
Troj/Bardus-A can also be registered as a service, steal product
registration keys, retrieve system information, and delete system
files
Advanced
Troj/Bardus-A is a backdoor and keylogging Trojan for the Windows
platform.
When first run Troj/Bardus-A copies itself to \msnmsgr.exe.
The following registry entry is created to run msnmsgr.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSN Messenger
\msnmsgr.exe
Troj/Bardus-A can also be registered as a service, steal product
registration keys, retrieve system information, and delete system
files.
Name W32/Dref-D
Type
* Worm
How it spreads
* Email attachments
* Chat programs
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Uses its own emailing engine
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Drefir.f
Prevalence (1-5) 2
Description
W32/Dref-D is a worm for the Windows platform that spreads via IRC
channels and by emailing itself to email addresses harvested from the
infected computer.
W32/Dref-D may arrive in the email message with the following
characteristics:
Subject line: chosen from
Resume
Your Files
Your Stuff
My Story
Re:
Message text: chosen from
here are the pictures you asked me to send you.
please read again what i have written to you !
here are the programms you asked me to mail you
for any help,mail me back
here are the porn screen saver you asked me to show you...
just read it,its fantastic
Attached file: chosen from
pictures.rar
info.rar
package1.rar
porn.rar
My Life.rar
pictures.JPG...pif
mail_READ.txt...scr
musicbox.MP3.pif
linda.scr
Story.scr
W32/Dref-D also attempts to establish a connection with the one of
the following IRC servers, using a nickname randomly chosen from a
predefined list:
us.undernet.org
eu.undernet.org
irc.dal.net
irc.rizon.net
irc.us.ircnet.net
random.ircd.de
irc.ircnet.ee
irc.fr.ircnet.net
irc.quakenet.org
If a connection is successfully established,, W32/Dref-D sends a
message with a link to a site that contains a copy of the worm with a
filename chosen from the following:
AsianPorno4Free.scr
DivXPorno.pif
DivXPorno.pif
DixPorno.scr
EuroSex4Free.pif
Extream-Hardcore-XXX.pif
Family_Sex.com
Family_Sex.com
Fix_Mirc.exe
FreeAmateurPorno.pif
Free-Hardcore-Sex.rar
Free-Porno-Gallery.exe
HardCore-XXX-Pictures.scr
Hardcore-XXX-Porno.rar
HiddenXXXPhotos.rar
Hot_Girls_Sucking_Dicks.scr
Hot-XXX-Pictures-Collection.rar
jenna_family.scr
JennaAndKelly.com
MircSecurity.exe
nude-gallery.com
porno.pif
PornPicturesCollection.rar
SecurityUpdate.exe
Sex4Free.pif
sex-cum-4free.pif
SEX-mirc-Access.rar
SystemFix.exe
SystemRepair.exe
Tiny_Woman_Swallows.pif
TrialXXXView.scr
Trojan-Remover.exe
Vivid_Sex_Trial.exe
Vivid-Sex.com
Webcam.com
Windows_Update.exe
WinXP_Mirc_Fix.exe
XXX-PORNO-LIBRARY.com
YoungFreshPussy.exe
The message sent is constructed from the following strings:
a full galery of
a full library of
and tell me what is your opinion
and tell me what you think,please
AsianPorno4Free
check out
check out -->
DivXPorno.pif
DixPorno
do you want to get yourself
download the free viewer at >
EuroSex4Free
ever wanted to have access to
excuse me,but its seems that
Extream-Hardcore-XXXFreeAmateurPorno
family
Family_Sex.com
for free porn galerys...
free europen porn ! get it now from ===>>>
free porno movies
Free-Hardcore-Sex
FreeMp3Downloader
gallery
good quality
hardcore porno
hardcore xxx porno for free !
HardCore-XXX-Pictures
Hardcore-XXX-Porno
hey,how you doing?
hey,i think that
hi,i can see that
HiddenXXXPhotos
high resolution
HomeWork
Hot-XXX-Pictures-Collection
how is my
hundred of
if so,just download the free trial viewer from ->
intersting in porno ?,wanna get free access,check out -->
its looking like that
jenna_family
JennaAndKelly
just double click on :
just download the free movie from
looking for
looking for some hot porn ?
LoveMe
Mp3B0x
need free porn ?
no need to wait,get the access now from ->
nude pictures
nude-gallery
Photos
please download a fix from ->
please download repair tool from ->
please install the new patch so you will be protected
please install this security update ->
please visit my
porn movie
porn pictures
PornPicturesCollection
searching for
Sex4Free
sex-cum-4free
SEX-mirc-Access
short porno movies
so get yourself ASAP this repair from
take a look at
take a look at ->
take a look at my
Tiny_Woman_Swallows
TrialXXXView
Vivid_Sex_Trial
Vivid-SexFree-Porno-Gallery
wanna have a free trial at porn sites all over the world ?,get this =>
wanna see hot girls for free ?
wants free 30 days trial at porn gallerys ?,check out >
wants to have access to free DVD porn download =>
web site
webcam pictures
WebcamHot_Girls_Sucking_Dicks
what do you think about my
whats up?
would you like to download
xxx movies
XXX-PORNO-LIBRARY
you are infected with a trojan...
you are using a vulnerable version of mirc
You can find DVD Quality Amateur Porn Movies here =>
YoungFreshPussy
your computer is vulnerable to the new mirc exploit
your mirc is sending spam
your windows is not patched...
Your_Search
Advanced
W32/Dref-D is a worm for the Windows platform that spreads via IRC
channels and by emailing itself to email addresses harvested from the
infected computer.
W32/Dref-D may arrive in the email message with the following
characteristics:
Subject line: chosen from
Resume
Your Files
Your Stuff
My Story
Re:
Message text: chosen from
here are the pictures you asked me to send you.
please read again what i have written to you !
here are the programms you asked me to mail you
for any help,mail me back
here are the porn screen saver you asked me to show you...
just read it,its fantastic
Attached file: chosen from
pictures.rar
info.rar
package1.rar
porn.rar
My Life.rar
pictures.JPG...pif
mail_READ.txt...scr
musicbox.MP3.pif
linda.scr
Story.scr
W32/Dref-D also attempts to establish a connection with the one of
the following IRC servers, using a nickname randomly chosen from a
predefined list:
us.undernet.org
eu.undernet.org
irc.dal.net
irc.rizon.net
irc.us.ircnet.net
random.ircd.de
irc.ircnet.ee
irc.fr.ircnet.net
irc.quakenet.org
If a connection is successfully established,, W32/Dref-D sends a
message with a link to a site that contains a copy of the worm with a
filename chosen from the following:
AsianPorno4Free.scr
DivXPorno.pif
DivXPorno.pif
DixPorno.scr
EuroSex4Free.pif
Extream-Hardcore-XXX.pif
Family_Sex.com
Family_Sex.com
Fix_Mirc.exe
FreeAmateurPorno.pif
Free-Hardcore-Sex.rar
Free-Porno-Gallery.exe
HardCore-XXX-Pictures.scr
Hardcore-XXX-Porno.rar
HiddenXXXPhotos.rar
Hot_Girls_Sucking_Dicks.scr
Hot-XXX-Pictures-Collection.rar
jenna_family.scr
JennaAndKelly.com
MircSecurity.exe
nude-gallery.com
porno.pif
PornPicturesCollection.rar
SecurityUpdate.exe
Sex4Free.pif
sex-cum-4free.pif
SEX-mirc-Access.rar
SystemFix.exe
SystemRepair.exe
Tiny_Woman_Swallows.pif
TrialXXXView.scr
Trojan-Remover.exe
Vivid_Sex_Trial.exe
Vivid-Sex.com
Webcam.com
Windows_Update.exe
WinXP_Mirc_Fix.exe
XXX-PORNO-LIBRARY.com
YoungFreshPussy.exe
The message sent is constructed from the following strings:
a full galery of
a full library of
and tell me what is your opinion
and tell me what you think,please
AsianPorno4Free
check out
check out -->
DivXPorno.pif
DixPorno
do you want to get yourself
download the free viewer at >
EuroSex4Free
ever wanted to have access to
excuse me,but its seems that
Extream-Hardcore-XXXFreeAmateurPorno
family
Family_Sex.com
for free porn galerys...
free europen porn ! get it now from ===>>>
free porno movies
Free-Hardcore-Sex
FreeMp3Downloader
gallery
good quality
hardcore porno
hardcore xxx porno for free !
HardCore-XXX-Pictures
Hardcore-XXX-Porno
hey,how you doing?
hey,i think that
hi,i can see that
HiddenXXXPhotos
high resolution
HomeWork
Hot-XXX-Pictures-Collection
how is my
hundred of
if so,just download the free trial viewer from ->
intersting in porno ?,wanna get free access,check out -->
its looking like that
jenna_family
JennaAndKelly
just double click on :
just download the free movie from
looking for
looking for some hot porn ?
LoveMe
Mp3B0x
need free porn ?
no need to wait,get the access now from ->
nude pictures
nude-gallery
Photos
please download a fix from ->
please download repair tool from ->
please install the new patch so you will be protected
please install this security update ->
please visit my
porn movie
porn pictures
PornPicturesCollection
searching for
Sex4Free
sex-cum-4free
SEX-mirc-Access
short porno movies
so get yourself ASAP this repair from
take a look at
take a look at ->
take a look at my
Tiny_Woman_Swallows
TrialXXXView
Vivid_Sex_Trial
Vivid-SexFree-Porno-Gallery
wanna have a free trial at porn sites all over the world ?,get this =>
wanna see hot girls for free ?
wants free 30 days trial at porn gallerys ?,check out >
wants to have access to free DVD porn download =>
web site
webcam pictures
WebcamHot_Girls_Sucking_Dicks
what do you think about my
whats up?
would you like to download
xxx movies
XXX-PORNO-LIBRARY
you are infected with a trojan...
you are using a vulnerable version of mirc
You can find DVD Quality Amateur Porn Movies here =>
YoungFreshPussy
your computer is vulnerable to the new mirc exploit
your mirc is sending spam
your windows is not patched...
Your_Search
W32/Dref-D chooses a nickname from the following list:
Aretina
Amorita
Alysia
Aldora
Barbra
Briana
Bridget
Blenda
Bettina
Caitlin
Chelsea
Clarissa
Carmen
Camille
Damita
Danielle
Evelyn
Gloria
Isabel
Juliet
Joanna
Katrina
Kassia
Lolita
Melody
Natalie
Nicole
Olivia
Pamela
Rachel
Silver
Sharon
Vanessa
Valora
Violet
Vivian
Xandra
When first run W32/Dref-D copies itself to \SysDref.exe.
The following registry entries are created to run SysDref.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
DrefIW
\SysDref.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DrefIW
\SysDref.exe
W32/Dref-D sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
W32/Dref-D terminates a number of anti-virus and security-related
applications.
Name Troj/Keylog-AM
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
Aliases
* Trojan.PWS.QQPass
* Spy-Agent.dll
Prevalence (1-5) 2
Description
Troj/Keylog-AM is a Trojan DLL that provides keylogging functionality.
Troj/Keylog-AM may in particular attempt to steal passwords and
monitor internet usage.
Advanced
Troj/Keylog-AM is a Trojan DLL that provides keylogging functionality.
Troj/Keylog-AM may in particular attempt to steal passwords and
monitor internet usage.
Stolen information may be stored in the following files:
\sys32me.ini
\sys32bin.ini
Name W32/Rbot-ALG
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* W32.Spybot.UOL
Prevalence (1-5) 2
Description
W32/Rbot-ALG is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-ALG spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: PNP (MS05-039), LSASS
(MS04-011) and RPC-DCOM (MS04-012) and by copying itself to network
shares protected by weak passwords.
W32/Rbot-ALG runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
The following patches for the operating system vulnerabilities
exploited by W32/Rbot-ALG can be obtained from the Microsoft website:
MS04-011
MS04-012
MS05-039
Advanced
W32/Rbot-ALG is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-ALG spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: PNP (MS05-039), LSASS
(MS04-011) and RPC-DCOM (MS04-012) and by copying itself to network
shares protected by weak passwords.
W32/Rbot-ALG runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Rbot-ALG copies itself to \qsecue.exe.
The following registry entries are created to run qsecue.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Quantifier Security
qsecue.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Quantifier Security
qsecue.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\OLE
Quantifier Security
qsecue.exe
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Once installed, W32/Rbot-ALG will attempt to perform the following
actions when instructed to do so by a remote attacker:
capture keystrokes
terminate threads and processes
perform port scanning on IP addresses
steal computer system hardware information
copy itself to network shared folders
download files from the Internet and run them
participate in denial of service (DoS) attacks
perform DCC file transfers over IRC channels
act as a HTTP proxy
setup a SOCKS4 server
The following patches for the operating system vulnerabilities
exploited by W32/Rbot-ALG can be obtained from the Microsoft website:
MS04-011
MS04-012
MS05-039
Name Troj/PurScan-W
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Drops more malware
Aliases
* Trojan-Dropper.Win32.PurityScan.l
Prevalence (1-5) 2
Description
Troj/PurScan-W is a dropper Trojan for the Windows platform that also
changes the browser security settings and attempts to open predefined
URL.
Advanced
Troj/PurScan-W is a dropper Trojan for the Windows platform that also
changes the browser security settings and attempts to open predefined
URL.
Once executed Troj/PurScan-W drops to the Temp folder and runs
installer.exe and mt-uninstaller.exe which are adware related
installer and uninstaller.
Also Troj/PurScan-W changes the browser security settings by
modifying registry entries under the following entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\3
Troj/PurScan-W tries to establish an internet connection in attempt
to download files from the predefined web location.
Name Troj/Nailpol-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Nailpol-A is a Trojan for the Windows platform.
Troj/Nailpol-A contains functionality to download further malicious
code.
Troj/Nailpol-A may monitor the internet usage of an infected computer.
Advanced
Troj/Nailpol-A is a Trojan for the Windows platform.
When first run Troj/Nailpol-A copies itself to the Windows system
folder using randomly generated filenames.
Troj/Nailpol-A may inject code into other processes in order to stay
active. When a Trojan process is terminated, the Trojan may be
restarted under a new filename.
Troj/Nailpol-A contains functionality to download further malicious
code.
Troj/Nailpol-A may monitor the internet usage of an infected computer.
Troj/Nailpol-A creates a randomly named registry entry in the
following location in order to run itself on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name Troj/Litebot-D
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Litebot-D is a Trojan for the Windows platform.
Troj/Litebot-D runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
Troj/Litebot-D is a Trojan for the Windows platform.
Troj/Litebot-D runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run Troj/Litebot-D copies itself to the Windows system
folder and creates the file \%CurrentFolder%\uninst.bat.
The following registry entry is created to run Troj/Litebot-D on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
support-reverse-smileys
\
Name W32/Tilebot-M
Type
* Worm
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Aimbot.ae
* W32.Spybot.Worm
Prevalence (1-5) 2
Description
W32/Tilebot-M is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-M spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including PNP (MS05-039).
W32/Tilebot-M runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-M includes functionality to access the internet and
communicate with a remote server via HTTP.
W32/Tilebot-M drops a file detected as Troj/Rootkit-W.
The following patch for the operating system vulnerability exploited
by W32/Tilebot-M can be obtained from the Microsoft website:
MS05-039
Advanced
W32/Tilebot-M is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-M spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including PNP (MS05-039).
W32/Tilebot-M runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-M includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-M copies itself to
\msdnupdate32 and creates the file
\rdriv.sys.
The file rdriv.sys is detected as Troj/Rootkit-W.
The file rdriv.sys is registered as a new system driver service named
"rdriv", with a display name of "rdriv". Registry
entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
The file msdnupdate32 is registered as a new system driver service
named "msdnupdate32", with a display name of "Msdn Update
32" and a
startup type of automatic, so that it is started automatically during
system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\msdnupdate32\
W32/Tilebot-M sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
The following patch for the operating system vulnerability exploited
by W32/Tilebot-M can be obtained from the Microsoft website:
MS05-039
Name Troj/Dloader-SK
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Pechkin.a
* Downloader-AAP
Prevalence (1-5) 2
Description
Troj/Dloader-SK is a Trojan for the Windows platform.
Troj/Dloader-SK includes functionality to download, install and run
new software.
Advanced
Troj/Dloader-SK is a Trojan for the Windows platform.
Troj/Dloader-SK includes functionality to download, install and run
new software.
When first run Troj/Dloader-SK copies itself to the Windows folder
and creates the file \dllsys.dll(harmless).
The following registry entry is created to run Troj/Dloader-SK on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SVCHOST
\
Name W32/PrsKey-A
Type
* Spyware Worm
Affected operating systems
* Windows
Side effects
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
W32/PrsKey-A is a password stealing and keylogging worm aimed at the
Priston Tale game and Yahoo! web email accounts.
The worm silently monitors keyboard activity waiting for the user to
either play Priston Tale or access Yahoo! email accounts and begins
keylogging information once access is found.
W32/PrsKey-A includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location
Advanced
W32/PrsKey-A is a password stealing and keylogging worm aimed at the
Priston Tale game and Yahoo! web email accounts.
The worm silently monitors keyboard activity waiting for the user to
either play Priston Tale or access Yahoo! email accounts and begins
keylogging information once access is found.
When run W32/PrsKey-A attempts to copy itself to the location:
\Common Files\Winllogo.exe
\Common Files\Win.exe
W32/PrsKey-A creates the registry entry to run Winllogo.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SpyEx
\Common Files\Winllogo.exe
Once installed, W32/PrsKey-A will begin keylogging information and
store the logged information to the file C:\text.txt. This file is
harmless and can be deleted.
W32/PrsKey-A includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location
W32/PrsKey-A spreads by attempting to copy itself to network shared
folders at the following location:
\Documents and Settings\All Users\Start
Menu\Programs\Startup\winllogo.exe
Name Troj/Whistler-F
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Deletes files off the computer
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Trojan.Win32.Dire.c
* QDel247
* Win32/Dire.C
* TROJ_QDEL247.A
Prevalence (1-5) 2
Description
Troj/Whistler-F is a destructive Trojan for the Windows platform.
Troj/Whistler-F will attempt to delete files on the user's computer.
The Trojan will also create a file at C:\WXP and copy it over other
files. The file contains the message "You did a piracy, you deserve
it."
Advanced
Troj/Whistler-F is a destructive Trojan for the Windows platform.
Troj/Whistler-F will attempt to delete files on the user's computer.
The Trojan will also create a file at C:\WXP and copy it over other
files. The file contains the message "You did a piracy, you deserve
it."
When first run the Trojan copies itself to \whismng.exe.
The following registry entry is created to run whismng.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Whistler
\whismng.exe -n
Name Troj/SDM-C
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
Prevalence (1-5) 2
Description
Troj/SDM-C is a Trojan for the Windows platform.
The Trojan exploits a vulnerability in Microsoft Access (JET) files.
The Trojan creates the file ms.exe and then runs it. Sophos's
anti-virus products detect the ms.exe file as Troj/Bdoor-CSY.
Name Troj/Sacrep-A
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Uses its own emailing engine
* Records keystrokes
* Installs itself in the Registry
Aliases
* Spy-Agent.p
* Trojan.Sacrep
* TROJ_DELF.MZ
Prevalence (1-5) 2
Description
Troj/Sacrep-A is a keylogger Trojan.
Troj/Sacrep-A saves recorded keystrokes to a preconfigured filename.
The contents of this file are periodically submitted to the author by
email, FTP or posting to a website.
Advanced
Troj/Sacrep-A is a keylogger Trojan.
Troj/Sacrep-A saves recorded keystrokes to a preconfigured filename.
The contents of this file are periodically submitted to the author by
email, FTP or posting to a website.
Troj/Sacrep-A includes functionality to prevent itself being
terminated and prevent itself being deleted.
The following registry entry is created to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry entries are also created under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\drv32
Name Troj/Deld-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/Deld-A is a Trojan for the Windows platform.
When run, the Trojan attempts to download files from a remote site
and then run them.
Advanced
Troj/Deld-A is a Trojan for the Windows platform.
When run, the Trojan attempts to download files from a remote site
and then run them. The files are downloaded to the following locations:
C:\Windows\svchost.exe
C:\Windows\lsass.exe
At the time of writing, Sophos's anti-virus products detect the
svchost.exe file as Troj/Bancban-ES and the lsass.exe file as
Troj/Mdrop-AW.
Name Troj/Nethief-P
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Agent.fx
Prevalence (1-5) 2
Description
Troj/Nethief-P is a backdoor Trojan for the Windows platform that
provides unauthorized remote access to the infected computer.
Troj/Nethief-P includes functionality to:
- silently download, install and run new software
- steal and capture information
Advanced
Troj/Nethief-P is a backdoor Trojan for the Windows platform that
provides unauthorized remote access to the infected computer.
When first run Troj/Nethief-P copies itself to
\ShellExt\EXPLORER.exe.
The following registry entry is created to run EXPLORER.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EXPLORER
\SHELLEXT\EXPLORER.exe
Troj/Nethief-P includes functionality to:
- silently download, install and run new software
- steal and capture information
Troj/Nethief-P is also capable of logging keystrokes entered into Web
forms on the predefined website.
Troj/Nethief-P sends stolen data to the configurable predefined email
address.
Registry entries are created under:
HKCR\.key\
Name W32/Dumaru-AK
Type
* Worm
Aliases
* TrojanDropper.Win32.Mudrop.h
* Worm.Win32.Plexus.a
* W32.Explet.A{at}mm
* I-Worm.Plexus.a
Prevalence (1-5) 2
Description
W32/Dumaru-AK consists of a dropper and a number of dropped files.
The dropper copies itself to the filename UPU.EXE in the Windows
system folder. The dropper also drops the files SETUPEX.EXE to the
same folder and SVCHOST.EXE to the Windows folder, running them both.
The dropper may display one of the following fake error messages:
CRC checksum failed.
Pace method not implemented.
Could not initialize installation. File size expected=26523, size
returned=26344
File is corrupted.
SETUPEX.EXE runs as a service process, copying itself to SWCHOST.EXE
and SVOHOST.EXE in the Windows system folder. It sets the following
registry entry so as to run the SWCHOST.EXE copy on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32
SETUPEX.EXE sets an entry in the BOOT section of SYSTEM.INI with the
key name SHELL in order to run the SWCHOST.EXE copy on system startup.
SETUPEX.EXE copies itself as SVCHOST.EXE to the folder found in the
following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
Folders\Startup
and writes loopback values to the HOSTS file to block access to
various anti-virus websites.
SETUPEX.EXE sets the following registry entries:
HKCU\Software\SARS\SocksPort
HKLM\System\CurrentControlSet\Services\SharedAccess\Start = 3
HKCU\Software\Microsoft\Internet Explorer\Main\AllowWindowReuse = 0
SETUPEX.EXE logs key strokes and window titles to a file in the
Windows folder called PRNTK.LOG and logs information about certain
files to RUNDLLN.SYS in the Windows folder.
SETUPEX.EXE drops PRNTSVR.DLL in the Windows folder. PRNTSVR.DLL is a
backdoor program detected by Sophos Anti-Virus as Troj/Dumaru-B.
The SVCHOST.EXE file dropped by the dropper is an email and network
share worm which also spreads by exploiting the RPC and LSASS
vulnerabilities. For more information about these vulnerabilities see
MS040-011 and MS03-026.
The email sent by the worm to the email addresses harvested from the
PHP, TXT, TBB, HTML and HTM files, has characteristics chosen from
the following lists.
Subject line :
RE: order
For you
Hi, Mike
Good offer.
RE:
Message text :
Hi.
Here is the archive with those information, you asked me.
And don't forget, it is strongly confidencial!!!
Seya, man.
P.S. Don't forget my fee ;)
Hi, my darling :)
Look at my new screensaver. I hope you will enjoy...
Your Liza
My friend gave me this account generator for http://www.pantyola.com I
wanna share it with you :)
And please do not distribute it. It's private.
Greets! I offer you full base of accounts with passwords of mail
server yahoo.com. Here is archive with small part of it . You can see
that all information is real. If you want to b uy full base, please
reply me..
Hi, Nick. In this archive you can find all those things, you asked me.
See you. Steve
Attached file :
release.exe
demo.exe
AGen1.03.exe
AtlantI.exe
SecUNCE.exe
The worm copies itself into the KaZaA transfer folder and available
shared folders with the following filenames:
AVP5.xcrack.exe
InternetOptimizer1.05b.exe
Shrek_2.exe
UnNukeit9xNTICQ04noimageCrk.exe
YahooDBMails.exe
hx00def.exe
ICQBomber.exe
The worm adds the following registry entry so that it is run each
time Windows starts:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NvClipRsv
The worm also modifies the HOSTS files in an attempt to prevent
anti-virus updates.
The worm listens on port 1250 for incoming connections which may
contain updated copies of the worm or other files to install on the
infected computer.
Name W32/Tilebot-N
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aei
* W32/Sdbot.worm.gen.g
Prevalence (1-5) 2
Description
W32/Tilebot-N is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-N spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including LSASS (MS04-011) and
RPC-DCOM (MS04-012) and by copying itself to network shares protected
by weak passwords.
W32/Tilebot-N runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-N includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Tilebot-N is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-N spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including LSASS (MS04-011) and
RPC-DCOM (MS04-012) and by copying itself to network shares protected
by weak passwords.
W32/Tilebot-N runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-N includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-N copies itself to <Windows>\csrs.exe
and creates the file <System>\rdriv.sys.
The file rdriv.sys is detected as Troj/Rootkit-W.
The file rdriv.sys is registered as a new system driver service named
"rdriv", with a display name of "rdriv". Registry
entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\rdriv\
The file csrs.exe is registered as a new system driver service named
"wservtime", with a display name of "Windows Time Sync"
and a startup
type of automatic, so that it is started automatically during system
startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\wservtime\
W32/Tilebot-N sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are modified or created or under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name W32/Mytob-EG
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
Aliases
* Trojan.Win32.Delf.if
Prevalence (1-5) 2
Description
W32/Mytob-EG is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
W32/Mytob-EG spreads by sending itself as an email attachment.
W32/Mytob-EG harvests email addresses from files on the infected
computer and from the Windows address book. Email sent by W32/Mytob-EG
have the following properties.
Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
Message text:
Dear user <str>,
You have successfully updated the password of your <str>
account.<BR>
If you did not authorize this change or if you need assistance with
your account, please contact <str> customer service at: <str>
Thank you for using <str>!
The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear user <str>,
It has come to our attention that your <str> User Profile ( x )
records are out of date. For further details see the attached document.
Thank you for using <str>!
The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear <str> Member,
We have temporarily suspended your email account <str>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our processors.
See the details to reactivate your <str> account.
Sincerely,The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear <str> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could please take 5-10
minutes out of your online experience and confirm the attached
document so you will not run into any future problems with the online
service.<BR>
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <str> Support Team
+++ Attachment: No Virus found
+++ <str> Antivirus - www.<str>
In the above text <str> would be replaced with either the domain or
username from user's email address.
The attached file consists of a base name followed by the extentions
CMD, PIF, SCR, EXE or ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are
randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
The worm avoids sending email to addresses that contain the following:
.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your
Advanced
W32/Mytob-EG is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC) network.
W32/Mytob-EG spreads by sending itself as an email attachment.
W32/Mytob-EG harvests email addresses from files on the infected
computer and from the Windows address book. Email sent by
W32/Mytob-EG have the following properties.
Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
Message text:
Dear user <str>,
You have successfully updated the password of your <str>
account.<BR>
If you did not authorize this change or if you need assistance with
your account, please contact <str> customer service at: <str>
Thank you for using <str>!
The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear user <str>,
It has come to our attention that your <str> User Profile ( x )
records are out of date. For further details see the attached document.
Thank you for using <str>!
The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear <str> Member,
We have temporarily suspended your email account <str>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our processors.
See the details to reactivate your <str> account.
Sincerely,The <str> Support Team
+++ Attachment: No Virus (Clean)
+++ <str> Antivirus - www.<str>
Dear <str> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could please take 5-10
minutes out of your online experience and confirm the attached
document so you will not run into any future problems with the online
service.<BR>
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <str> Support Team
+++ Attachment: No Virus found
+++ <str> Antivirus - www.<str>
In the above text <str> would be replaced with either the domain or
username from user's email address.
The attached file consists of a base name followed by the extentions
CMD, PIF, SCR, EXE or ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are
randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
The worm avoids sending email to addresses that contain the following:
.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your
W32/Mytob-EG copies itself to the Windows system folder as TWUNK_65.EXE
and sets the following registry entries in order to run each time a
user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM
twunk_65.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM
twunk_65.exe
W32/Mytob-EG sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
W32/Mytob-EG modifies the HOSTS file in order to prevent access to
the following websites:
avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
ebay.com
f-secure.com
kaspersky-labs.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
microsoft.com
moneybookers.com
my-etrust.com
nai.com
networkassociates.com
pandasoftware.com
paypal.com
rads.mcafee.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
trendmicro.com
update.symantec.com
updates.symantec.com
us.mcafee.com
viruslist.com
viruslist.com
virustotal.com
www.amazon.ca
www.amazon.co.uk
www.amazon.com
www.amazon.fr
www.avp.com
www.ca.com
www.ebay.com
www.f-secure.com
www.grisoft.com
www.kaspersky.com
www.mcafee.com
www.microsoft.com
www.moneybookers.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.pandasoftware.com
www.paypal.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.com
www.virustotal.com
W32/Mytob-EG terminates the following applications and security-related
processes:
ACKWIN32.EXE
ADAWARE.EXE
ADVXDWIN.EXE
AGENTSVR.EXE
AGENTW.EXE
ALERTSVC.EXE
ALEVIR.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ARR.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATUPDATER.EXE
ATWATCH.EXE
AU.EXE
AUPDATE.EXE
AUPDATE.EXE
AUTO-PROTECT.NAV80TRY.EXE
AUTODOWN.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGNT.EXE
AVGSERV.EXE
AVGSERV9.EXE
AVGUARD.EXE
AVGW.EXE
AVKPOP.EXE
AVKSERV.EXE
AVKSERVICE.EXE
AVKWCTl9.EXE
AVLTMAIN.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVSYNMGR.EXE
AVWINNT.EXE
AVWUPD.EXE
AVWUPD32.EXE
AVWUPD32.EXE
AVWUPSRV.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
AVXQUAR.EXE
BACKWEB.EXE
BARGAINS.EXE
BD_PROFESSIONAL.EXE
BEAGLE.EXE
BELT.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BLSS.EXE
BOOTCONF.EXE
BOOTWARN.EXE
BORG2.EXE
BPC.EXE
BRASIL.EXE
BS120.EXE
BUNDLE.EXE
BVT.EXE
CCAPP.EXE
CCEVTMGR.EXE
CCPXYSVC.EXE
CDP.EXE
CFD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
CLAW95CF.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLICK.EXE
CMD.EXE
CMD32.EXE
CMESYS.EXE
CMGRDIAN.EXE
CMON016.EXE
CONNECTIONMONITOR.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CTRL.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
DATEMANAGER.EXE
DCOMX.EXE
DEFALERT.EXE
DEFSCANGUI.EXE
DEFWATCH.EXE
DEPUTY.EXE
DIVX.EXE
DLLCACHE.EXE
DLLREG.EXE
DOORS.EXE
DPF.EXE
DPFSETUP.EXE
DPPS2.EXE
DRWATSON.EXE
DRWEB32.EXE
DRWEBUPW.EXE
DSSAGENT.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
EFPEADM.EXE
EMSW.EXE
ENT.EXE
ESAFE.EXE
ESCANHNT.EXE
ESCANV95.EXE
ESPWATCH.EXE
ETHEREAL.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXANTIVIRUS-CNET.EXE
EXE.AVXW.EXE
EXPERT.EXE
EXPLORE.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FAMEH32.EXE
FAST.EXE
FCH32.EXE
FIH32.EXE
FINDVIRU.EXE
FIREWALL.EXE
FNRB32.EXE
FP-WIN.EXE
FP-WIN_TRIAL.EXE
FPROT.EXE
FRW.EXE
FSAA.EXE
FSAV.EXE
FSAV32.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
FSGK32.EXE
FSM32.EXE
FSMA32.EXE
FSMB32.EXE
GATOR.EXE
GBMENU.EXE
GBPOLL.EXE
GENERICS.EXE
GMT.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HBINST.EXE
HBSRV.EXE
HOTACTIO.EXE
HOTPATCH.EXE
HTLOG.EXE
HTPATCH.EXE
HWPE.EXE
HXDL.EXE
HXIUL.EXE
IAMAPP.EXE
IAMSERV.EXE
IAMSTATS.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IDLE.EXE
IEDLL.EXE
IEDRIVER.EXE
IEXPLORER.EXE
IFACE.EXE
IFW2000.EXE
INETLNFO.EXE
INFUS.EXE
INFWIN.EXE
INIT.EXE
INTDEL.EXE
INTREN.EXE
IOMON98.EXE
ISTSVC.EXE
JAMMER.EXE
JDBGMRG.EXE
JEDI.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KAVPF.EXE
KAZZA.EXE
KEENVALUE.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KERNEL32.EXE
KILLPROCESSSETUP161.EXE
LAUNCHER.EXE
LDNETMON.EXE
LDPRO.EXE
LDPROMENU.EXE
LDSCAN.EXE
LNETINFO.EXE
LOADER.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LORDPE.EXE
LSETUP.EXE
LUALL.EXE
LUALL.EXE
LUAU.EXE
LUCOMSERVER.EXE
LUINIT.EXE
LUSPT.EXE
MAPISVC32.EXE
MCAGENT.EXE
MCMNHDLR.EXE
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MD.EXE
MFIN32.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MGUI.EXE
MINILOG.EXE
MMOD.EXE
MONITOR.EXE
MOOLIVE.EXE
MOSTAT.EXE
MPFAGENT.EXE
MPFSERVICE.EXE
MPFTRAY.EXE
MRFLUX.EXE
MSAPP.EXE
MSBB.EXE
MSBLAST.EXE
MSCACHE.EXE
MSCCN32.EXE
MSCMAN.EXE
MSCONFIG.EXE
MSDM.EXE
MSDOS.EXE
MSIEXEC16.EXE
MSINFO32.EXE
MSLAUGH.EXE
MSMGT.EXE
MSMSGRI32.EXE
MSSMMC32.EXE
MSSYS.EXE
MSVXD.EXE
MU0311AD.EXE
MWATCH.EXE
N32SCANW.EXE
NAV.EXE
NAVAP.NAVAPSVC.EXE
NAVAPSVC.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVLU32.EXE
NAVNT.EXE
NAVSTUB.EXE
NAVW32.EXE
NAVWNT.EXE
NC2000.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NEOWATCHLOG.EXE
NETARMOR.EXE
NETD32.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NETUTILS.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NOD32.EXE
NORMIST.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NOTSTART.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NPSCHECK.EXE
NPSSVC.EXE
NSCHED32.EXE
NSSYS32.EXE
NSTASK32.EXE
NSUPDATE.EXE
NT.EXE
NTRTSCAN.EXE
NTVDM.EXE
NTXconfig.EXE
NUI.EXE
NUPGRADE.EXE
NUPGRADE.EXE
NVARCH16.EXE
NVC95.EXE
NVSVC32.EXE
NWINST4.EXE
NWSERVICE.EXE
NWTOOL16.EXE
OLLYDBG.EXE
ONSRVR.EXE
OPTIMIZE.EXE
OSTRONET.EXE
OTFIX.EXE
OUTPOST.EXE
OUTPOST.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PATCH.EXE
PAVCL.EXE
PAVPROXY.EXE
PAVSCHED.EXE
PAVW.EXE
PCFWALLICON.EXE
PCIP10117_0.EXE
PCSCAN.EXE
PDSETUP.EXE
PERISCOPE.EXE
PERSFW.EXE
PERSWF.EXE
PF2.EXE
PFWADMIN.EXE
PGMONITR.EXE
PINGSCAN.EXE
PLATIN.EXE
POP3TRAP.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
POWERSCAN.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PRIZESURFER.EXE
PRMT.EXE
PRMVR.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
PROCEXPLORERV1.0.EXE
PROGRAMAUDITOR.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
QCONSOLE.EXE
QSERVER.EXE
RAPAPP.EXE
RAV7.EXE
RAV7WIN.EXE
RAV8WIN32ENG.EXE
RAY.EXE
RB32.EXE
RCSYNC.EXE
REALMON.EXE
REGED.EXE
REGEDIT.EXE
REGEDT32.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCAN.EXE
RTVSCN95.EXE
RULAUNCH.EXE
RUN32DLL.EXE
RUNDLL.EXE
RUNDLL16.EXE
RUXDLL32.EXE
SAFEWEB.EXE
SAHAGENT.EXE
SAVE.EXE
SAVENOW.EXE
SBSERV.EXE
SC.EXE
SCAM32.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SETUPVAMEEVAL.EXE
SETUP_FLOWPROTECTOR_US.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SHOWBEHIND.EXE
SMC.EXE
SMS.EXE
SMSS32.EXE
SOAP.EXE
SOFI.EXE
SPERM.EXE
SPF.EXE
SPHINX.EXE
SPOLER.EXE
SPOOLCV.EXE
SPOOLSV32.EXE
SPYXX.EXE
SREXE.EXE
SRNG.EXE
SS3EDIT.EXE
SSGRATE.EXE
SSG_4104.EXE
ST2.EXE
START.EXE
STCLOADER.EXE
SUPFTRL.EXE
SUPPORT.EXE
SUPPORTER5.EXE
SVC.EXE
SVCHOSTC.EXE
SVCHOSTS.EXE
SVSHOST.EXE
SWEEP95.EXE
SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
SYMPROXYSVC.EXE
SYMTRAY.EXE
SYSEDIT.EXE
SYSTEM.EXE
SYSTEM32.EXE
SYSUPD.EXE
TASKMG.EXE
TASKMGR.EXE
TASKMO.EXE
TASKMON.EXE
TAUMON.EXE
TBSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TDS2-NT.EXE
TEEKIDS.EXE
TFAK.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRICKLER.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
TSADBOT.EXE
TVMD.EXE
TVTMD.EXE
UNDOBOOT.EXE
UPDAT.EXE
UPDATE.EXE
UPDATE.EXE
UPGRAD.EXE
UTPOST.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VET32.EXE
VET95.EXE
VETTRAY.EXE
VFSETUP.EXE
VIR-HELP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC32.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCAN40.EXE
VSCENU6.02D30.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBDAV.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WFINDV32.EXE
WHOSWATCHINGME.EXE
WIMMUN32.EXE
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINNET.EXE
WINPPR32.EXE
WINRECON.EXE
WINSERVN.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
WINTSK32.EXE
WINUPDATE.EXE
WKUFIND.EXE
WNAD.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE
_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
Name Troj/Haxdoor-AI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Trojan-PSW.Win32.Goldun.bo
Prevalence (1-5) 2
Description
Troj/Haxdoor-AI is a backdoor Trojan incorporating stealth
functionality which allows a remote intruder to gain access and
control over the computer.
Advanced
Troj/Haxdoor-AI is a backdoor Trojan which allows a remote intruder
to gain access and control over the computer.
Troj/Haxdoor-AI includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security
related applications
When Troj/Haxdoor-AI is installed the following files are created:
<System>\msftcpip.sys
<System>\tcpGDC.dll
The following registry entries are created to run code exported by
tcpGDC.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
DllName
tcpGDC.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
Startup
tcpGDC
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tcpGDC
Impersonate
1
The file msftcpip.sys is registered as a new system driver service
named "msftcpip", with a display name of "TCPservice". Registry
entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\msftcpip\
Troj/Haxdoor-AI may modify the HOSTS file, mapping the URLs of
selected anti-virus and security related websites to a loopback IP
address, in an attempt to prevent access to these sites.
Name W32/Chode-G
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Landis.l
Prevalence (1-5) 2
Description
W32/Chode-G is a worm with IRC backdoor Trojan functionality.
W32/Chode-G attempts to spread via MSN Instant Messenger and AOL
Instant Messenger, by sending users a link to a copy of the worm.
W32/Chode-G includes functionality to:
- carry out DDoS flooder attacks
- provide a proxy server
- silently download, install and run new software
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security
related applications
The worm also creates the files csrss.dat and csrss.ini in the same
folder. W32/Chode-G also creates the file csrss.lnk to the
folder. These files may be deleted.
Advanced
W32/Chode-G is a worm with IRC backdoor Trojan functionality.
W32/Chode-G attempts to spread via MSN Instant Messenger and AOL
Instant Messenger, by sending users a link to a copy of the worm.
W32/Chode-G includes functionality to:
- carry out DDoS flooder attacks
- provide a proxy server
- silently download, install and run new software
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security
related applications
When first run W32/Chode-G copies itself to a randomly named
subfolder of the Windows system folder as csrss.exe.
The worm also creates the files csrss.dat and csrss.ini in the same
folder. W32/Chode-G also creates the file csrss.lnk to the
folder. These files may be deleted.
W32/Chode-G creates the following registry entries in order to run
itself on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
csrss
\csrss.exe
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
\\csrss.exe
W32/Chode-G also inserts the following entry into [Windows] section
of \win.ini:
load=\\csrss.exe
The worm creates the following further registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
DisableSR
1
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4
W32/Chode-G modifies the HOSTS file, changing the URL-to-IP mappings
for selected websites, therefore preventing normal access to these
sites. The new HOSTS file will typically contain the following:
127.0.0.1 avp.com
127.0.0.1 www.avp.com
127.0.0.1 ca.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 fastclick.net
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www3.ca.com
127.0.0.1 www.grisoft.com
127.0.0.1 grisoft.com
127.0.0.1 housecall.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 pandasoftware.com
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.zonelabs.com
127.0.0.1 zonelabs.com
127.0.0.1 www.spywareinfo.com
127.0.0.1 spywareinfo.com
127.0.0.1 www.merijn.org
127.0.0.1 merijn.org
W32/Chode-G attempts to disable the following processes:
MCUpdateExe
VirusScan Online
VSOCheckTask
Symantec NetDriver Monitor
Outpost Firewall
gcasServ
pccguide.exe
KAVPersonal50
Zone Labs Client
microsoft antispyware
hijackthis
msconfig.exe
kav.exe
kavsvc.exe
mcvsshld.exe
mcagent.exe
mcvsrte.exe
mcshield.exe
mcvsftsn.exe
mcdash.exe
mcvsescn.exe
mcinfo.exe
mpfagent.exe
mpftray.exe
mpfservice.exe
mskagent.exe
mcmnhdlr.exe
sndsrvc.exe
usrprmpt.exe
ccapp.exe
ccevtmgr.exe
spbbcsvc.exe
ccsetmgr.exe
symlcsvc.exe
npfmntor.exe
navapsvc.exe
issvc.exe
ccproxy.exe
navapw32.exe
navw32.exe
smc.exe
outpost.exe
zlclient.exe
vsmon.exe
isafe.exe
pandaavengine.exe
msblast.exe
penis32.exe
teekids.exe
bbeagle.exe
d3dupdate.exe
sysmonxp.exe
irun4.exe
mscvb32.exe
sysinfo.exe
mwincfg32.exe
wincfg32.exe
winsys.exe
zapro.exe
winupd.exe
enterprise.exe
regedit.exe
hijackthis.exe
gcasdtserv.exe
gcasserv.exe
pcctlcom.exe
tmntsrv.exe
tmproxy.exe
tmpfw.exe
pcclient.exe
Name Troj/Dloader-TB
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Small.ask
* Downloader-ZU
Prevalence (1-5) 2
Description
Troj/Dloader-TB is a Trojan for the Windows platform. The Trojan
installs a driver that monitors the user's internet usage and may
download further software.
Advanced
Troj/Dloader-TB is a Trojan for the Windows platform. The Trojan
installs a driver that monitors the user's internet usage and may
download further software.
When Troj/Dloader-TB is installed it creates the file
\drivers\wlan1934.sys.
The file wlan1934.sys is registered as a new system driver service
named "Wlan1934", with a display name of "Wlan1934" and
a startup
type of automatic, so that it is started automatically during system
startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Wlan1934\
Name Troj/Banker-FH
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Reduces system security
* Records keystrokes
Prevalence (1-5) 2
Description
Troj/Banker-FH is a Trojan for the Windows platform.
When first run Troj/Banker-FH copies itself to
\config\service.exe.
The Trojan monitors open windows for certain titles and logs
keypresses in an attempt to steal login details for various banking
sites.
Name Troj/Fumilo-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Deletes files off the computer
Prevalence (1-5) 2
Description
Troj/Fumilo-A is a Trojan for the Windows platform.
Troj/Fumilo-A blocks access to certain banking websites.
Advanced
Troj/Fumilo-A is a Trojan for the Windows platform.
Troj/Fumilo-A overwrites the Windows hosts file to block access to
certain banking websites.
Name W32/Bobax-R
Type
* Worm
How it spreads
* Email attachments
* Network shares
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Uses its own emailing engine
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Net-Worm.Win32.Bobic.k
* W32/Bobax.worm.gen
* W32.Bobax.Z{at}mm
* PE_BOBAX.AF
Prevalence (1-5) 2
Description
W32/Bobax-R is an email and network worm for the Windows platform.
W32/Bobax-R can send itself to email addresses harvested from the
infected computer and spread to other computers by exploiting the PNP
(MS05-039) vulnerability.
W32/Bobax-R attempts to contact a number of preconfigured internet
sites in order to report successful infection.
Emails sent by the worm have the following characteristics:
Subject line:
Cool
Message text taken from:
Saddam Hussein - Attempted Escape, Shot dead
Attached some pics that i found
Osama Bin Laden Captured.
Attached some pics that i found
Testing
Secret!
Hey,
Remember this?
Hello,
Long time! Check this out!
Hey,
I was going through my album, and look what I found..
Hey,
Check this out :-)
+++ Attachment: No Virus found
+++ Panda AntiVirus - You are protected
+++ www.pandasoftware.com
+++ Attachment: No Virus found
+++ Norman AntiVirus - You are protected
+++ www.norman.com
+++ Attachment: No Virus found
+++ F-Secure AntiVirus - You are protected
+++ www.f-secure.com
+++ Attachment: No Virus found
+++ Norton AntiVirus - You are protected
+++ www.symantec.com
Possible attachment filenames:
pics.1
funny.1
bush.1
joke.1
secret.2
Possible attachment extensions:
pif
exe
scr
zip
A patch for the vulnerability exploited by W32/Bobax-R is available
from :
MS05-039
Advanced
W32/Bobax-R is an email and network worm for the Windows platform.
W32/Bobax-R can send itself to email addresses harvested from the
infected computer and spread to other computers by exploiting the PNP
(MS05-039) vulnerability.
W32/Bobax-R attempts to contact a number of preconfigured internet
sites in order to report successful infection.
Emails sent by the worm have the following characteristics:
Subject line:
Cool
Message text taken from:
Saddam Hussein - Attempted Escape, Shot dead
Attached some pics that i found
Osama Bin Laden Captured.
Attached some pics that i found
Testing
Secret!
Hey,
Remember this?
Hello,
Long time! Check this out!
Hey,
I was going through my album, and look what I found..
Hey,
Check this out :-)
+++ Attachment: No Virus found
+++ Panda AntiVirus - You are protected
+++ www.pandasoftware.com
+++ Attachment: No Virus found
+++ Norman AntiVirus - You are protected
+++ www.norman.com
+++ Attachment: No Virus found
+++ F-Secure AntiVirus - You are protected
+++ www.f-secure.com
+++ Attachment: No Virus found
+++ Norton AntiVirus - You are protected
+++ www.symantec.com
Possible attachment filenames:
pics.1
funny.1
bush.1
joke.1
secret.2
Possible attachment extensions:
pif
exe
scr
zip
W32/Bobax-R copies itself to the Windows system folder with a random
filename and creates the following registry entry in order to run
automatically on computer login:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\
W32/Bobax-R blocks access to the following security-related websites
by modifying the Windows hosts file:
ar.atwola.com
atdmt.com
avp.ch
avp.com
avp.ru
awaps.net
ca.com
dispatch.mcafee.com
download.mcafee.com
download.microsoft.com
downloads.microsoft.com
engine.awaps.net
f-secure.com
ftp.f-secure.com
ftp.sophos.com
go.microsoft.com
liveupdate.symantec.com
mast.mcafee.com
mcafee.com
msdn.microsoft.com
my-etrust.com
nai.com
networkassociates.com
office.microsoft.com
phx.corporate-ir.net
secure.nai.com
securityresponse.symantec.com
service1.symantec.com
sophos.com
spd.atdmt.com
support.microsoft.com
symantec.com
update.symantec.com
updates.symantec.com
us.mcafee.com
vil.nai.com
viruslist.ru
windowsupdate.microsoft.com
www.avp.ch
www.avp.com
www.avp.ru
www.awaps.net
www.ca.com
www.f-secure.com
www.kaspersky.ru
www.mcafee.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.com
www.viruslist.ru
www3.ca.com
The worm attempts to reduce system security by disabling the Windows
firewall and anti-virus notification and creating the following
registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
A patch for the vulnerability exploited by W32/Bobax-R is available
from :
MS05-039
Name W32/Mytob-EH
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
Aliases
* Net-Worm.Win32.Mytob.ct
Prevalence (1-5) 2
Description
W32/Mytob-EH is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-EH runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels, including the ability to
download and execute files on the infected computer.
W32/Mytob-EH spreads by sending itself as an email attachment to
email addresses it harvests from the infected computer, as a zip file
containing a file with a double-extension. Emails sent have the
following properties.
The subject line is either a string of randomly chosen characters or
one of the following:
*DETECTED* Online User Violation
Email Account Suspension
Important Notification
Members Support
Notice of account limitation
Security measures
Warning Message: Your services near to be closed.
Your Account is Suspended
Your Account is Suspended For Security Reasons
The message text takes one of the following forms:
Dear user ,
You have successfully updated the password of your
account.
If you did not authorize this change or if you need assistance with
your account, please contact customer service
at: * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)SEEN-BY: 633/267 270 @PATH: 123/140 500 106/2000 633/267 |
|
| SOURCE: echomail via fidonet.ozzmosis.com | |
Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.