[cut-n-paste from sophos.com]

W32/Sdbot-IH

Type
Win32 worm

Detection
At the time of writing, Sophos has received just one report of this worm 
from the wild.

Description
W32/Sdbot-IH is a network worm and backdoor Trojan. The worm spreads by 
copying itself to network shares that have weak passwords.

The worm creates a copy of itself named bot.exe in the Windows system 
folder and adds the following registry entries to ensure that the copy 
is run each time Windows starts:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Synchronization Manager = bot.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Synchronization Manager = bot.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Synchronization Manager = bot.exe

W32/Sdbot-IH maintains a log of the user's keystrokes in a file named 
keylog.txt in the Windows system folder.

The backdoor component of the worm attempts to connect to an IRC server 
and awaits commands from a remote attacker.





W32/Lovgate-V

Aliases
I-Worm.LovGate.w, W32.Lovgate.Gen{at}mm, WORM_LOVGATE.V

Type
Win32 worm

Detection
Sophos has received several reports of this worm from the wild.

Description
W32/Lovgate-V is a variant of the W32/Lovgate family of worms that 
spread via email, network shares and filesharing networks.

W32/Lovgate-V copies itself to the Windows system folder as the files 
WinHelp.exe, iexplore.exe, kernel66.dll and ravmond.exe and to the 
Windows folder as systra.exe.

The worm also drops the files msjdbc11.dll, mssign30.dll and odbc16.dll 
which provide unauthorised remote access to the computer over a network.

The worm drops ZIP files containing a copy of the worm onto accessible 
drives. The ZIP file may also carry a RAR extension. The name of the 
packed file is chosen from the following list:

WORK
setup
important
bak
letter
pass

The name of the contained unpacked file is either PassWord, email or 
book, with a file extension of EXE, SCR, PIF or COM.

In order to run automatically when Windows starts up W32/Lovgate-V 
creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Hardware Profile = \hxdef.exe
Microsoft NetMeeting Associates, Inc. = NetMeeting.exe
Protected Storage = RUNDLL32.EXE MSSIGN30.DLL ondll_reg
VFW Encoder/Decoder Settings = RUNDLL32.EXE MSSIGN30.DLL ondll_reg
WinHelp = \WinHelp.exe
Program In Windows = \IEXPLORE.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\SystemTra =
\SysTra.EXE

HKU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run = 
RAVMOND.exe

In addition W32/Lovgate-V copies itself to the file command.exe in the 
root folder and creates the file autorun.inf there containing an entry 
to run the dropped file upon system startup.

W32/Lovgate-V spreads by email. Email addresses are harvested from WAB, 
TXT, HTM, SHT, PHP, ASP, DBX, TBB, ADB and PL files found on the system.

Email have the following characteristics:

Subject line:

test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error

Message text:

It's the long-awaited film version of the Broadway hit. The message sent 
as a binary attachment.

The message contains Unicode characters and has been sent as a binary
attachment.

Mail failed. For further assistance, please contact!

Attached file:

document
readme
doc
text
file
data
test
message
body

followed by ZIP, EXE, PIF or SCR.

W32/Lovgate-V also enables sharing of the Windows media folder and 
copies itself there using various filenames.

The worm also attempts to reply to emails found in the user's inbox 
using the following filenames as attachments:

the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
How to Crack all gamez.exe
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
dreamweaver MX (crack).exe
StarWars2 - CloneAttack.rm.scr
Industry Giant II.exe
DSL Modem Uncapper.rar.exe
joke.pif
Britney spears nude.exe.txt.exe
I am For u.doc.exe

The worm attempts to spread by copying itself to mounted shares using 
one of the following filenames:

mmc.exe
xcopy.exe
winhlp32.exe
i386.exe
client.exe
findpass.exe
autoexec.bat
MSDN.ZIP.pif
Cain.pif
WindowsUpdate.pif
Support Tools.exe
Windows Media Player.zip.exe
Microsoft Office.exe
Documents and Settings.txt.exe
Internet Explorer.bat
WinRAR.exe

W32/Lovgate-V also attempts to spread via weakly protected remote shares 
by connecting using a password from an internal dictionary and copying 
itself as the file NetManager.exe to the system folder on the admin$ 
share.

After successfully copying the file W32/Lovgate-V attempts to start it 
as the service "Windows Managment Network Service Extensions" on the 
remote computer.

W32/Lovgate-V starts a logging thread that listens on port 6000, sends a 
notification email to an external address and logs received data to the 
file C:\Netlog.txt.

W32/Lovgate-V attempts to terminate processes containing the following 
strings:

rising
SkyNet
Symantec
McAfee
Gate
Rfw.exe
RavMon.exe
kill
Nav
Duba
KAV
KV

W32/Lovgate-V also overwrites EXE files on the system with copies of 
itself. The original files are saved with a ZMX extension.





W32/Bagle-AA

Aliases
Win32/Bagle.AB, WORM_BAGLE.Z, I-Worm.Bagle.z

Type
Win32 worm

Detection
Sophos has received many reports of this worm from the wild.

Description
W32/Bagle-AA is a member of the W32/Bagle family of worms.

When first run W32/Bagle-AA will display a fake error message containing 
the text "Can't find a viewer associated with the file".

W32/Bagle-AA copies itself to the Windows system folder with the 
filename drvddll.exe and then runs the worm from that location.

The email sent by the worm may use one of the following subject lines:

Re: Msg reply
Re: Hello
Re: Yahoo!
Re: Thank you!
Re: Thanks :)
RE: Text message
Re: Document
Incoming message
Re: Incoming Message
RE: Incoming Msg
RE: Message Notify
Notification
Changes..
New changes
Hidden message
Fax Message Received
Protected message
RE: Protected message
Forum notify
Site changes
Re: Hi
Encrypted document

The following registry entry is created so that the worm is run when a 
user logs on to Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\drvddll.exe = 
drvddll.exe

W32/Bagle-AA scans all fixed drives recursively for WAB, TXT, MSG, HTM, 
SHTM, STM, XML, DBX, MBX, MDX, EML, NCH, MMF, ODS, CFG, ASP, PHP, PL, 
WSH, ADB, TBB, SHT, XLS, OFT, UIN, CGI, MHT, DHTM and JSP files, 
extracts email addresses from them and uses those addresses for the mass 
mailing component of the worm.

The worm will create copies of itself with the following filenames in 
folders that contain the string "shar" in their name:

ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Kaspersky Antivirus 5.0
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
Porno, sex, oral, anal cool, awesome!!.exe
Serials.txt.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe

W32/Bagle-AA attempts to terminate the following processes:

AGENTSVR.EXE
ANTI-TROJAN.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATWATCH.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVGSERV9.EXE
AVLTMAIN.EXE
AVprotect9x.exe
AVPUPD.EXE
AVSYNMGR.EXE
AVWUPD32.EXE
AVXQUAR.EXE
BD_PROFESSIONAL.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BOOTWARN.EXE
BORG2.EXE
BS120.EXE
CDP.EXE
CFGWIZ.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFIAUDIT.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET.EXE
CFINET32.EXE
CFINET32.EXE
CLEAN.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLEANPC.EXE
CMGRDIAN.EXE
CMGRDIAN.EXE
CMON016.EXE
CMON016.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
DEFWATCH.EXE
DEPUTY.EXE
DPF.EXE
DPFSETUP.EXE
drvsys.exe
DRWATSON.EXE
DRWEBUPW.EXE
ENT.EXE
ESCANH95.EXE
ESCANHNT.EXE
ESCANV95.EXE
EXANTIVIRUS-CNET.EXE
FAST.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FP-WIN_TRIAL.EXE
FRW.EXE
FSAV.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
GBMENU.EXE
GBPOLL.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HTLOG.EXE
HWPE.EXE
IAMAPP.EXE
IAMAPP.EXE
IAMSERV.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFW2000.EXE
IPARMOR.EXE
IRIS.EXE
JAMMER.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KILLPROCESSSETUP161.EXE
LDPRO.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LSETUP.EXE
LUALL.EXE
LUCOMSERVER.EXE
LUINIT.EXE
MCAGENT.EXE
MCUPDATE.EXE
MCUPDATE.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGUI.EXE
MINILOG.EXE
MOOLIVE.EXE
MRFLUX.EXE
MSCONFIG.EXE
MSINFO32.EXE
MSSMMC32.EXE
MU0311AD.EXE
NAV80TRY.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVSTUB.EXE
NAVW32.EXE
NC2000.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NETARMOR.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NSCHED32.EXE
NTVDM.EXE
NUPGRADE.EXE
NVARCH16.EXE
NWINST4.EXE
NWTOOL16.EXE
OSTRONET.EXE
OUTPOST.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PAVPROXY.EXE
PCC2002S902.EXE
PCC2K_76_1436.EXE
PCCIOMON.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCFWALLICON.EXE
PCIP10117_0.EXE
PDSETUP.EXE
PERISCOPE.EXE
PERSFW.EXE
PF2.EXE
PFWADMIN.EXE
PINGSCAN.EXE
PLATIN.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PROCEXPLORERV1.0.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAV8WIN32ENG.EXE
REGEDIT.EXE
REGEDT32.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCN95.EXE
RULAUNCH.EXE
SAFEWEB.EXE
SBSERV.EXE
SD.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SMC.EXE
SOFI.EXE
SPF.EXE
SPHINX.EXE
SPYXX.EXE
SS3EDIT.EXE
ST2.EXE
SUPFTRL.EXE
SUPPORTER5.EXE
SYMPROXYSVC.EXE
SYSEDIT.EXE
TASKMON.EXE
TAUMON.EXE
TAUSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS2-98.EXE
TDS2-NT.EXE
TDS-3.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
UNDOBOOT.EXE
UPDATE.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VFSETUP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCENU6.02D30.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBSCANX.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
WHOSWATCHINGME.EXE
WINRECON.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZAUINST.EXE
ZONALM2601.EXE
ZONEALARM.EXE





W32/Famus-C

Aliases
W32/Misodene.gen{at}MM virus, Win32/Liber.A worm

Type
Win32 worm

Detection
Sophos has received several reports of this worm from the wild.

Description
W32/Famus-C will make an additional copy of itself as Red7324.exe in the 
Temp folder along with other files which are used for mailing the worm. 
Among these will be the file SMTP.OCX which is a freeware SMTP engine 
used in the mailing of W32/Famus-C to email addresses found on the 
computer. Other dropped files include:

    * c:/En Cuba no hay libertad de expresion - an empty file

    * /temp/Casper9247.exe - used by the worm

    * /temp/att1.att1 - contains the email's file attchment name

    * /temp/msg.msg - contains the email's message text

    * /temp/sub.sub - contains the email's subject line

The email sent by the worm will have the following characteristics:

Subject line:
Famous / Famosos

Message Text:
?Sabes por que los famosos son famosos?
?Do you know why the famous are famous?

Password: "123"

Attachment:
Famous.exe

Another email may also be sent out without a copy of the worm with the 
following characteristics:

Subject line:
Virus Infected!!!!

Message Text:
Su computadora ha sido infectada por el virus Libertad
pero no tema, este virus no causa daño
su unico objetivo es prostestar por la falta de
liebertad de expresión en Cuba.
Disculpe la molestia.
El Hobbit.

W32/Famus-C will also display a message box displaying the text above on 
the infected computer.





Troj/Agobot-IB

Aliases
Backdoor.Agobot.gen, W32/Gaobot.worm.gen.j, W32.Gaobot.AFJ, 
WORM_AGOBOT.JH

Type
Trojan

Detection
At the time of writing, Sophos has received just one report of this 
Trojan from the wild.

Description
Troj/Agobot-IB is a backdoor Trojan for the Windows platform.

Troj/Agobot-IB allows a malicious user remote access to an infected 
computer.

In order to run automatically when Windows starts up Troj/Agobot-IB 
creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft
Update=Microsoft.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Microsoft
Update=Microsoft.exe.





Troj/Agobot-HZ

Aliases
W32.Gaobot.AFJ, W32/Gaobot.worm.gen.j virus, 
INFECTED Backdoor.Agobot.gen

Type
Trojan

Detection
At the time of writing, Sophos has received just one report of this 
Trojan from the wild.

Description
Troj/Agobot-HZ is a backdoor Trojan for the Windows platform.

Troj/Agobot-HZ allows a malicious user remote access to an infected 
computer.

In order to run automatically when Windows starts up Troj/Agobot-HZ 
creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\File System
Service=wmiprvsc.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\File System
Service=wmiprvsc.exe.





W32/Famus-A

Aliases
W32/Misodene.a{at}MM virus

Type
Win32 worm

Detection
Sophos has received several reports of this worm from the wild.

Description
W32/Famus-A is a mass mailing worm for the Windows platform that copies
itself to the system folder as the file PentagonSecret.xls.exe where the 
second extension is several whitespace characters after the first in an 
attempt to disguise itself as a Microsoft Excel spreadsheet file. Copies 
of the worm will also have a crude Excel icon.

W32/Famus-A will make additional copies of itself as Casper9247.exe and
Red7324.exe in the Temp folder along with other non malicious files 
related to the sent emails. Among these will be the file SMTP.OCX which 
is a freeware SMTP engine used in the mailing of W32/Famus-A to members 
of the user's address book.

W32/Famus-A will send itself to members of the user's Outlook address 
book attached to an email with the following characteristics:

Subject:

Que sabe el Pentagono sobreusted (What the Pentagon knows about you)

Body:

?Crees que estas a salvo del Pentagono de los E.U? Mira estos datos y te
asombraras.

Do you believe you are safe from the Pentagon of the E.U? Just look 
these data and you will be surprised

Password: 123

Attachment:

PentagonSecret.xls.exe

Another email will also be sent to the address segurmatic{at}yahoo.es with 
the subject line of Reporte. This is likely to be a notification message 
sent to the worm author.





W32/Bugbear-G

Aliases
W32.Bugbear.E{at}mm, W32/Bugbear.gen{at}MM virus

Type
Win32 worm

Detection
At the time of writing, Sophos has received just one report of this worm 
from the wild.

Description
W32/Bugbear-G is a worm which spreads via email. The subject line and 
attached file of the email sent by the worm are variable and may be 
taken from information on the infected computer. The attached file has 
an extension of PIF.

W32/Bugbear-G creates a copy of itself with a randomly generated name in 
the Windows system folder. To ensure that the copy of the worm is run 
each time Windows is started the worm adds a randomly named value to the 
registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

The worm creates several other files with random names in the Windows 
system folder. One of the files is a DLL used to monitor the user's 
keystrokes. This DLL will be detected by Sophos Anti-Virus as 
W32/Bugbear-B.

W32/Bugbear-G terminates the following anti-virus and security related
processes:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ANTI-TROJAN.EXE
APVXDWIN.EXE
AUTODOWN.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCTRL.EXE
AVKSERV.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVWIN95.EXE
AVWUPD32.EXE
BLACKD.EXE
BLACKICE.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
CLAW95.EXE
CLAW95CF.EXE
CLEANER.EXE
CLEANER3.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
ESAFE.EXE
ESPWATCH.EXE
F-AGNT95.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FINDVIRU.EXE
FP-WIN.EXE
FPROT.EXE
FRW.EXE
IAMAPP.EXE
IAMSERV.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFACE.EXE
IOMON98.EXE
JEDI.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LUALL.EXE
MOOLIVE.EXE
MPFTRAY.EXE
N32SCANW.EXE
NAVAPW32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVW32.EXE
NAVWNT.EXE
NISUM.EXE
NMAIN.EXE
NORMIST.EXE
NUPGRADE.EXE
NVC95.EXE
OUTPOST.EXE
PADMIN.EXE
PAVCL.EXE
PAVSCHED.EXE
PAVW.EXE
PCCWIN98.EXE
PCFWALLICON.EXE
PERSFW.EXE
RAV7.EXE
RAV7WIN.EXE
RESCUE.EXE
SAFEWEB.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SERV95.EXE
SMC.EXE
SPHINX.EXE
SWEEP95.EXE
TBSCAN.EXE
TCA.EXE
TDS2-98.EXE
TDS2-NT.EXE
VET95.EXE
VETTRAY.EXE
VSCAN40.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSSTAT.EXE
WEBSCANX.EXE
WFINDV32.EXE
ZONEALARM.EXE





W32/Sasser-D

Type
Win32 worm

Detection
Sophos has received several reports of this worm from the wild.

Description
W32/Sasser-D is a network worm which spreads by exploiting the Microsoft 
LSASS vulnerability on port 445.

For further information on this vulnerability see Microsoft Security 
Bulletin MS04-011.

When first run W32/Sasser-D copies itself to the Windows folder with the 
filename skynetave.exe and creates the following registry entry, so the 
worm is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
skynetave.exe = %WINDOWS%\skynetave.exe

A harmless text file is created in the C:\ root folder named win2.log.





W32/Netsky-AC

Type
Win32 worm

Detection
Sophos has received many reports of this worm from the wild.

Description
W32/Netsky-AC is a mass mailing worm. The worm copies itself to the 
Windows folder as comp.cpl and creates a helper component wserver.exe 
in the same folder. W32/Netsky-AC sets the following registry entry to 
ensure it is run on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
wserver = wserver.exe

Emails sent by W32/Netsky-AC have the following characteristics:

Subject line:

Escalation

Message text:

Dear user of 

We have received several abuses:

- Hundreds of infected e-Mails have been sent
from your mail account by the new worm 
- Spam email has been relayed by the backdoor
that the virus has created

The malicious file uses your mail account to distribute
itself. The backdoor that the worm opens allows remote attackers
to gain the control of your computer. This new worm
is spreading rapidly around the world now
and it is a serios new threat that hits users.

Due to this, we are providing you to remove the
infection on your computer and to
stop the spreading of the malware with a
special desinfection tool attached to this mail.

If you have problems with the virus removal file,
please contact our support team at

support{at}

Note that we do not accept html email messages.

 AntiVirus Research Team
Attach: Fix__.cpl

Note:

 is selected from the following:

Sophos
MCAfee
Norman
Norton

 is selected from the following:

sophos.com
symantec.com
nai.com
norman.com

 is selected from the following:

NetSky.AB
Sasser.B
Bagle.AB
Mydoom.F
MSBlast.B

Attachment Name:

Fix__.cpl

Sophos researchers have also discovered that hidden inside the code of 
Netsky-AC is the following text, directed towards anti-virus companies:

Hey, av firms, do you know that we have programmed the sasser virus?!?. 
Yeah thats true! Why do you have named it sasser? A Tip: Compare the 
FTP-Server code with the one from Skynet.V!!! LooL! We are the Skynet...





W32/Sasser-B

Aliases
Win32.Worm.Sasser.C, WORM_SASSER.B, WORM_SASSER.C, W32/Sasser-C

Type
Win32 worm

Detection
Sophos has received many reports of this worm from the wild.

Description
Please note: Sophos detects both the B and C variants of the Sasser worm 
as W32/Sasser-B.

W32/Sasser-B is a network worm which spreads by exploiting the Microsoft 
LSASS vulnerability on port 445.

For further information on this vulnerability see Microsoft Security 
Bulletin MS04-011.

When first run W32/Sasser-B copies itself to the Windows folder as 
avserve2.exe and creates the following registry entry, so that 
avserve2.exe is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
avserve2.exe = %WINDOWS%\avserve2.exe

A harmless text file is created in the C:\ root folder named win2.log.

Further reading:
Sasser internet worm attacks unpatched PCs, Sophos advises of virus 
threat

 
--- MultiMail/Win32 v0.43