[cut-n-paste from sophos.com]
W32/Bobax-C
Aliases
TrojanProxy.Win32.Bobax.c, W32/Bobax.worm.c, Win32/Bobax.B, W32.Bobax.C
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Bobax-C is a Sasser-like worm that uses the MS04-011 (LSASS.exe)
vulnerability to propagate.
When run W32/Bobax-C creates a helper dll in the temp folder with a
random name. When the DLL is loaded the executable component copies
itself to the Windows system folder under a random name.
W32/Bobax-C sets the following registry entries in order to auto-start
on user logon:
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/RunServices/
=
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/
=
This DLL is injected into Explorer as a separate thread, so is not
visible as a separate process.
The worm listens on a randomly chosen tcp port in the range 2000-62000
which the worm then includes in outbound traffic so infected systems can
connect back.
W32/Bobax-C also carries an email relay module, allowing infected
computers to be used for transmission of unsolicited emails.
W32/Agobot-IY
Aliases
Gaobot, Nortonbot, Phatbot, Polybot.
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Agobot-IY is an IRC backdoor Trojan and network worm which
establishes an IRC channel to a remote server in order to grant an
intruder access to the compromised machine.
This worm will move itself into the Windows System32 folder under the
filename DVRCONF.EXE and may create the following registry entries so
that it can execute automatically on system restart:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
DriverConf = dvrconf.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
DriverConf = dvrconf.exe
W32/Agobot-IY may also attempt to collect email addresses from the
Windows Address Book and send itself to these email addresses using its
own SMTP engine with itself included as an executable attachment.
W32/Agobot-IY may attempt to terminate anti-virus and other
security-related processes, in addition to other viruses, worms or
Trojans.
For example:
_AVPM
_AVPCC
_AVP32
ZONEALARM
ZONALM2601
ZATUTOR
ZAPSETUP3001
ZAPRO
XPF202EN
WYVERNWORKSFIREWALL
WUPDT
WUPDATER
WSBGATE
WRCTRL
WRADMIN
WNT
WNAD
WKUFIND
WINUPDATE
WINTSK32
WINSTART001
WINSTART
WINSSK32
WINSERVN
WINRECON
WINPPR32
WINNET
WINMAIN
WINLOGIN
WININITX
WININIT
WININETD
WINDOWS
WINDOW
WINACTIVE
WIN32US
WIN32
WIN-BUGSFIX
WIMMUN32
WHOSWATCHINGME
WGFE95
WFINDV32
WEBTRAP
WEBSCANX
WEBDAV
WATCHDOG
W9X
W32DSM89
VSWINPERSE
VSWINNTSE
VSWIN9XE
VSSTAT
VSMON
VSMAIN
VSISETUP
VSHWIN32
VSECOMR
VSCHED
VSCENU6.02D30
VSCAN40
VPTRAY
VPFW30S
VPC42
VPC32
VNPC3000
VNLAN300
VIRUSMDPERSONALFIREWALL
VIR-HELP
VFSETUP
VETTRAY
VET95
VET32
VCSETUP
VBWINNTW
VBWIN9X
VBUST
VBCONS
VBCMSERV
UTPOST
UPGRAD
UPDAT
UNDOBOOT
TVTMD
TVMD
TSADBOT
TROJANTRAP3
TRJSETUP
TRJSCAN
TRICKLER
TRACERT
TITANINXP
TITANIN
TGBOB
TFAK5
TFAK
TEEKIDS
TDS2-NT
TDS2-98
TDS-3
TCM
TCA
TC
TBSCAN
TAUMON
TASKMON
TASKMO
TASKMG
SYSUPD
SYSTEM32
SYSTEM
SYSEDIT
SYMTRAY
SYMPROXYSVC
SWEEPNET.SWEEPSRV.SYS.SWNETSUP
SWEEP95
SVSHOST
SVCHOSTS
SVCHOSTC
SVC
SUPPORTER5
SUPPORT
SUPFTRL
STCLOADER
START
ST2
SSGRATE
SS3EDIT
SRNG
SREXE
SPYXX
SPOOLSV32
SPOOLCV
SPOLER
SPHINX
SPF
SPERM
SOFI
SOAP
SMSS32
SMS
SMC
SHOWBEHIND
SHN
UPDATE
SHELLSPYINSTALL
SH
SGSSFW32
SFC
SETUP_FLOWPROTECTOR_US
SETUPVAMEEVAL
SERVLCES
SERVLCE
SERVICE
SERV95
SD
SCVHOST
SCRSVR
SCRSCAN
SCANPM
SCAN95
SCAN32
SCAM32
SC
SBSERV
SAVENOW
SAVE
SAHAGENT
SAFEWEB
RUXDLL32
RUNDLL16
RUNDLL
RUN32DLL
RULAUNCH
RTVSCN95
RTVSCAN
RSHELL
RRGUARD
RESCUE32
RESCUE
REGEDT32
REGEDIT
REGED
REALMON
RCSYNC
RB32
RAY
RAV8WIN32ENG
RAV7WIN
RAV7
RAPAPP
QSERVER
QCONSOLE
PVIEW95
PUSSY
PURGE
PSPF
PROTECTX
PROPORT
PROGRAMAUDITOR
PROCEXPLORERV1.0
PROCESSMONITOR
PROCDUMP
PRMVR
PRMT
PRIZESURFER
PPVSTOP
PPTBC
PPINUPDT
POWERSCAN
PORTMONITOR
PORTDETECTIVE
POPSCAN
POPROXY
POP3TRAP
PLATIN
PINGSCAN
PGMONITR
PFWADMIN
PF2
PERSWF
PERSFW
PERISCOPE
PENIS
PDSETUP
PCSCAN
PCFWALLICON
PCDSETUP
PCCWIN98
PCCWIN97
PCCNTMON
PCCIOMON
PAVW
PAVSCHED
PAVPROXY
PAVCL
PATCH
PANIXK
PADMIN
OUTPOSTPROINSTALL
OUTPOSTINSTALL
OTFIX
OSTRONET
OPTIMIZE
ONSRVR
OLLYDBG
NWTOOL16
NWSERVICE
NWINST4
NVSVC32
NVC95
NVARCH16
NUI
NTXconfig
NTVDM
NTRTSCAN
NT
NSUPDATE
NSTASK32
NSSYS32
NSCHED32
NPSSVC
NPSCHECK
NPROTECT
NPFMESSENGER
NPF40_TW_98_NT_ME_2K
NOTSTART
NORTON_INTERNET_SECU_3.0_407
NORMIST
NOD32
NMAIN
NISUM
NISSERV
NETUTILS
NETSTAT
NETSPYHUNTER-1.2
NETSCANPRO
NETMON
NETINFO
NETD32
NETARMOR
NEOWATCHLOG
NEOMONITOR
NDD32
NCINST4
NAVWNT
NAVW32
NAVSTUB
NAVNT
NAVLU32
NAVENGNAVEX15.NAVLU32
NAVDX
NAVAPW32
NAVAPSVC
NAVAP.NAVAPSVC
AUTO-PROTECT.NAV80TRY
NAV
OUTPOST
NUPGRADE
N32SCANW
MWATCH
MU0311AD
MSVXD
MSSYS
MSSMMC32
MSMSGRI32
MSMGT
MSLAUGH
MSINFO32
MSIEXEC16
MSDOS
MSDM
MSCONFIG
MSCMAN
MSCCN32
MSCACHE
MSBLAST
MSBB
MSAPP
MRFLUX
MPFTRAY
MPFSERVICE
MPFAGENT
MOSTAT
MOOLIVE
MONITOR
MMOD
MINILOG
MGUI
MGHTML
MGAVRTE
MGAVRTCL
MFWENG3.02D30
MFW2EN
MFIN32
MD
MCVSSHLD
MCVSRTE
MCTOOL
MCSHIELD
MCMNHDLR
MCAGENT
MAPISVC32
LUSPT
LUINIT
LUCOMSERVER
LUAU
LSETUP
LORDPE
LOOKOUT
LOCKDOWN2000
LOCKDOWN
LOCALNET
LOADER
LNETINFO
LDSCAN
LDPROMENU
LDPRO
LDNETMON
LAUNCHER
KILLPROCESSSETUP161
KERNEL32
KERIO-WRP-421-EN-WIN
KERIO-WRL-421-EN-WIN
KERIO-PF-213-EN-WIN
KEENVALUE
KAZZA
KAVPF
KAVPERS40ENG
KAVLITE40ENG
JEDI
JDBGMRG
JAMMER
ISTSVC
MCUPDATE
LUALL
ISRV95
ISASS
IRIS
IPARMOR
IOMON98
INTREN
INTDEL
INIT
INFWIN
INFUS
INETLNFO
IFW2000
IFACE
IEXPLORER
IEDRIVER
IEDLL
IDLE
ICSUPPNT
ICMON
ICLOADNT
ICLOAD95
IBMAVSP
IBMASN
IAMSTATS
IAMSERV
IAMAPP
HXIUL
HXDL
HWPE
HTPATCH
HTLOG
HOTPATCH
HOTACTIO
HBSRV
HBINST
HACKTRACERSETUP
GUARDDOG
GUARD
GMT
GENERICS
GBPOLL
GBMENU
GATOR
FSMB32
FSMA32
FSM32
FSGK32
FSAV95
FSAV530WTBYB
FSAV530STBYB
FSAV32
FSAV
FSAA
FRW
FPROT
FP-WIN_TRIAL
FP-WIN
FNRB32
FLOWPROTECTOR
FIREWALL
FINDVIRU
FIH32
FCH32
FAST
FAMEH32
F-STOPW
F-PROT95
F-PROT
F-AGNT95
EXPLORE
EXPERT
EXE.AVXW
EXANTIVIRUS-CNET
EVPN
ETRUSTCIPE
ETHEREAL
ESPWATCH
ESCANV95
ICSUPP95
ESCANHNT
ESCANH95
ESAFE
ENT
EMSW
EFPEADM
ECENGINE
DVP95_0
DVP95
DSSAGENT
DRWEBUPW
DRWEB32
DRWATSON
DPPS2
DPFSETUP
DPF
DOORS
DLLREG
DLLCACHE
DIVX
DEPUTY
DEFWATCH
DEFSCANGUI
DEFALERT
DCOMX
DATEMANAGER
Claw95
CWNTDWMO
CWNB181
CV
CTRL
CPFNT206
CPF9X206
CPD
CONNECTIONMONITOR
CMON016
CMGRDIAN
CMESYS
CMD32
CLICK
CLEANPC
CLEANER3
CLEANER
CLEAN
CFINET32
CFINET
CFIADMIN
CFGWIZ
CFD
CDP
CCPXYSVC
CCEVTMGR
CCAPP
BVT
BUNDLE
BS120
BRASIL
BPC
BORG2
BOOTWARN
BOOTCONF
BLSS
BLACKICE
BLACKD
BISP
BIPCPEVALSETUP
BIPCP
BIDSERVER
BIDEF
BELT
BEAGLE
BD_PROFESSIONAL
BARGAINS
BACKWEB
CLAW95CF
CFIAUDIT
AVXMONITORNT
AVXMONITOR9X
AVWUPSRV
AVWUPD
AVWINNT
AVWIN95
AVSYNMGR
AVSCHED32
AVPTC32
AVPM
AVPDOS32
AVPCC
AVP32
AVP
AVNT
AVLTMAIN
AVKWCTl9
AVKSERVICE
AVKSERV
AVKPOP
AVGW
AVGUARD
AVGSERV9
AVGSERV
AVGNT
AVGCTRL
AVGCC32
AVE32
AVCONSOL
AU
ATWATCH
ATRO55EN
ATGUARD
ATCON
ARR
APVXDWIN
APLICA32
APIMONITOR
ANTS
ANTIVIRUS
ANTI-TROJAN
AMON9X
ALOGSERV
ALEVIR
ALERTSVC
AGENTW
AGENTSVR
ADVXDWIN
ADAWARE
AVXQUAR
ACKWIN32
AVWUPD32
AVPUPD
AUTOUPDATE
AUTOTRACE
AUTODOWN
AUPDATE
ATUPDATER
W32/Agobot-IY may also be used to terminate the following services on
remote computers:
Themes
srservice
wuauserv
WZCSVC
winmgmt
WebClient
W32Time
upnphost
uploadmgr
TrkWks
TermService
TapiSrv
stisvc
SSDPSRV
Spooler
ShellHWDetection
SENS
seclogon
Schedule
SamSs
RpcSs
RasMan
ProtectedStorage
PolicyAgent
PlugPlay
Nla
Netman
Messenger
MDM
LmHosts
lanmanworkstation
lanmanserver
helpsvc
FastUserSwitchingCompatibility
EventSystem
Eventlog
ERSvc
Dnscache
dmserver
Dhcp
CryptSvc
Browser
AudioSrv
Ati HotKey Poller
W32/Agobot-IY may search for shared folders on the internet with weak
passwords and copy itself into them.
A text file named HOSTS in C:\\drivers\etc\ may be
created or overwritten with a list of anti-virus and other
security-related websites, each bound to the IP loopback address of
127.0.0.1 which would effectively prevent access to these sites.
For example:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
W32/Agobot-IY can sniff HTTP, VULN, ICMP, FTP and IRC network traffic
and steal data from them.
The following vulnerabilities can also be exploited to aid propagation
on unpatched systems and manipulate registry keys:
Remote Procedure Call (RPC) vulnerability.
Distributed Component Object Model (DCOM) vulnerability.
RPC Locator vulnerability.
IIS5/WEBDAV Buffer Overflow vulnerability.
For more information about these Windows vulnerabilities, please refer
to the following Microsoft Security Bulletins:
Microsoft Security Bulletin MS03-001
Microsoft Security Bulletin MS03-007
Microsoft Security Bulletin MS03-039
W32/Agobot-IY can also polymorph on installation in order to evade
detection and share / delete the admin$, ipc$ etc drives.
It can also test the available bandwidth by attempting to GET or POST
data to the following websites:
yahoo.co.jp
www.nifty.com
www.d1asia.com
www.st.lib.keio.ac.jp
www.lib.nthu.edu.tw
www.above.net
www.level3.com
nitro.ucsc.edu
www.burst.net
www.cogentco.com
www.rit.edu
www.nocster.com
www.verio.com
www.stanford.edu
www.xo.net
de.yahoo.com
www.belwue.de
www.switch.ch
www.1und1.de
verio.fr
www.utwente.nl
www.schlund.net
W32/Agobot-IY can also be used to initiate denial-of-service (DoS) and
distributed denial-of-service (DDoS) synflood / httpflood / fraggle /
smurf etc attacks against remote systems.
This worm can steal the Windows Product ID and keys from several
computer applications or games including:
AOL Instant Messenger
Battlefield 1942
Battlefield 1942: Secret Weapons Of WWII
Battlefield 1942: The Road To Rome
Battlefield 1942: Vietnam
Black and White
Call of Duty
Command and Conquer: Generals
Command and Conquer: Generals: Zero Hour
Command and Conquer: Red Alert2
Command and Conquer: Tiberian Sun
Counter-Strike
FIFA 2002
FIFA 2003
Freedom Force
Global Operations
Gunman Chronicles
Half-Life
Hidden and Dangerous 2
Industry Giant 2
IGI2: Covert Strike
James Bond 007: Nightfire
Medal of Honor: Allied Assault
Medal of Honor: Allied Assault: Breakthrough
Medal of Honor: Allied Assault: Spearhead
Nascar Racing 2002
Nascar Racing 2003
NHL 2002
NHL 2003
Need For Speed: Hot Pursuit 2
Need For Speed: Underground
Neverwinter Nights
Ravenshield
Shogun Total War - Warlord Edition
Soldiers Of Anarchy
Soldier of Fortune II - Double Helix
The Gladiators
Unreal Tournament 2003
Unreal Tournament 2004
Windows Messenger
W32/Agobot-IY will delete all files named 'sound*.*'.
OF97/Exedrop-C
Type
Office 97 macro virus
Detection
At the time of writing, Sophos has received just one report of this
virus from the wild.
Description
OF97/ExeDrop-C is a macro that drops and runs a backdoor program.
W32/Agobot-IX
Aliases
WORM_AGOBOT.GEN, W32.HLLW.Gaobot.gen, W32/Gaobot.worm.gen.d
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Agobot-IX is an IRC backdoor Trojan and network worm.
W32/Agobot-IX copies itself to network shares protected by weak
passwords.
When first run W32/Agobot-IX copies itself to the Windows system folder
as winlogin.exe and sets the following registry entries to ensure it is
run at system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinLogin = winlogin.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WinLogin = winlogin.exe
On NT-based version of Windows the worm creates a new service named
"winlogin" with the startup property set to automatic, so that the
service starts automatically each time Windows is started.
Each time W32/Agobot-IX is run it attempts to connect to a remote IRC
server and join a specific channel. The worm then runs in the background
allowing a remote intruder to issue commands which control the computer.
W32/Agobot-IX can be instructed to download and install other programs
on the system as well as to flood other computers with network packets.
W32/Agobot-IX will terminate and disable various anti-virus and security
related programs.
W32/Agobot-IX will write to the hosts file so that various security
related internet sites can no longer be accessed.
These sites include:
www.sophos.com
sophos.com
www.symantec.com
securityresponse.symantec.com
symantec.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
www.trendmicro.com
W32/Rbot-M
Aliases
W32.Randex.gen, IRC/SdBot.ARP trojan, Backdoor.Spyboter.cf,
BKDR_SPYBOTER.CF, W32/Sdbot.worm.gen.g virus
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Rbot-M is a worm which attempts to spread to remote network shares.
W32/Rbot-M contains backdoor Trojan functionality, allowing unauthorised
remote access to the infected computer via IRC channels while running in
the background as a service process.
W32/Rbot-M spreads to network shares with weak passwords as a result of
the backdoor Trojan element receiving the appropriate command from a
remote user.
When W32/Rbot-M is run it copies itself to the Windows system folder
with the filename wuam.exe and deletes the original copy if that
filename was wuam.exe.
In order to run automatically when Windows starts up W32/Rbot-M creates
the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Time=wuam.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Update Time=wuam.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Time=wuam.exe.
W32/Rbot-M attempts to contact the host babe.thekiller.biz.
Troj/Iyus-A
Aliases
PWSteal.Trojan
Type
Trojan
Detection
At the time of writing, Sophos has received just one report of this
Trojan from the wild.
Description
Troj/Iyus-A is a password-stealing Trojan.
Troj/Iyus-A copies itself either to a subfolder of the Windows system
folder called IYUS or to a subfolder of the folder given in the registry
entry
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
Shell Folders\AppData
called Microsoft\IYUS, copying itself with a filename consisting of
eight random lowercase characters and an EXE extension. Troj/Iyus-A then
sets the following registry entry so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\iyus
Troj/Iyus-A drops a file in the same folder as itself called IYUS.DLL,
also detected as Troj/Iyus-A, which monitors whether the user accesses
certain specific websites. In particular the DLL monitors access to a
large number of banking-related websites, logging keystrokes and data
transfer to files with a PST or HTM extension, as well as one called
HTM.TXT, to this same IYUS subfolder.
Troj/Iyus-A runs in the background as a service process and periodically
collates the gathered information to a file called RESF.INI and then
sends it to a remote location by FTP. RESF.INI contains the following
sections, relating to information gathered from the corresponding
banking websites:
cbonline
barclays
halifax
natwest
hsbc
lloydstsb
westpac
netpay
cahoot
hsbcau
evocash
egold
bullion
bankcardservices
anz
abbey
Troj/Iyus-A sets the following time-related registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\iyus
Troj/Iyus-A also sets the following registry entry when it attempts an
FTP upload:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\iyus
Troj/Iyus-A may create an empty file in the Windows system folder called
XTEMPXXX.XXX.
Troj/Iyus-A may download and run a file from a remote location,
currently detected as Troj/Iyus-E.
Troj/Iyus-A attempts to terminate a large number of processes relating
to security and anti-virus products.
Troj/Iyus-A also provides stealthing by way of the dropped DLL in order
to make its presence difficult to detect.
W32/Agobot-IK
Aliases
W32.HLLW.Gaobot.gen, Backdoor.Agobot.gen, W32/Gaobot.worm.gen.d virus.
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Agobot-IK is a backdoor trojan.
W32/Agobot-IK allows a malicious user remote access to an infected
computer.
In order to run automatically when Windows starts up W32/Agobot-IK
creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\System Service Manager= lsmas.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\
RunServices\System Service Manager=lsmas.exe.
W32/Agobot-IK changes the file C/windows/system32/drivers/etc/hosts
W32/Agobot-IK listens out on ports 1043, 123, 1050, 1046, 1053, 1049 and
1042.
W32/Cycle-A
Type
Win32 worm
Detection
At the time of writing, Sophos has received just one report of this worm
from the wild.
Description
W32/Cycle-A is a network worm which searches for unpatched computers on
the Internet using randomly generated IP addresses.
These computers are vulnerable to the LSASS buffer overrun exploit which
can permit a remote attacker to gain administrator privileges on the
local computer.
For more information about this Windows vulnerability, please refer to
the following Microsoft Security Bulletin:
Microsoft Security Bulletin MS04-011.
W32/Cycle-A will copy itself into the Windows System folder under the
filename SVCHOST.EXE and create the following registry branches:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOST_SERVICE\
HKLM\SYSTEM\CurrentControlSet\Services\Host Service\
The second branch will contain the entry:
ImagePath = C:\ * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
SEEN-BY: 633/267 270
@PATH: 123/140 500 106/2000 633/267
|