Text 103, 1014 rader
Skriven 2006-02-18 13:16:00 av KURT WISMER (1:123/140)
Ärende: News, February 18 2006
==============================
[cut-n-paste from sophos.com]
Name W32/Bagle-CO
Type
* Worm
How it spreads
* Email attachments
* Peer-to-peer
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Bagle.ae
* W32/Bagle.gen@MM
* Worm.Bagle.Gen-dll
* WORM_Bagle.GEN
* W32/Sality
Prevalence (1-5) 3
Description
W32/Bagle-CO is a worm for the Windows platform.
W32/Bagle-CO spreads via file sharing on P2P networks and via email.
Messages sent by the worm have the following characteristics:
From: an address found on the infected computer
Subject: one of
Will You Be My Valentine?
Love you with all my heart!
See you tonight!
Come Be With Me, my Love!
My dream is coming true!
Message text:
The instruction "Click to attachment to load a movie" followed by
several lines of poetry, with a heart as the background image
Attachment name: one of
love_me.exe
love_me_now.exe
mplay.exe
Advanced
W32/Bagle-CO is a worm for the Windows platform.
W32/Bagle-CO spreads via file sharing on P2P networks and via email.
W32/Bagle-CO sends itself to email addresses found on the infected
computer. Emails sent by the worm have the following characteristics:
From: an address found on the infected computer
Subject: one of
Will You Be My Valentine?
Love you with all my heart!
See you tonight!
Come Be With Me, my Love!
My dream is coming true!
Message text:
The instruction "Click to attachment to load a movie" followed by
several lines of poetry, with a heart as the background image
Attachment name: one of
love_me.exe
love_me_now.exe
mplay.exe
W32/Bagle-CO runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Bagle-CO includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Bagle-CO copies itself to the following filenames
in any folders containing the letters "shar":
Adobe Photoshop 9 full.exe
Ahead Nero 10.exe
anna benson sex video.exe
barrett jackson nude photos, movies, porn video.exe
Britney Spears sex photos.exe
IE beta 7.exe
jenna elfman sex anal deepthroat
kate beckinsale nude pictures.exe
miss america Porno, sex, oral, anal cool, awesome!!.exe
paris hilton Porno pics arhive, xxx.exe
Porno Screensaver.scr
Serials 2005 database.exe
Serials.txt.exe
Windown Vista Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe
W32/Bagle-CO copies itself to the file lmovie.exe in the Windows
system folder and creates following registry entry to run itself on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MovieM
<Windows system folder>\lmovie.exe
W32/Bagle-CO creates the file vcaults32.exe in the Windows folder.
This file (also detected as W32/Bagle-CO) attempts to download and
execute files from preconfigured URLs.
When first run, W32/Bagle-CO displays the following fake error message:
Title: Error!
Message: Can't find a viewer associated with the file.
Name Troj/Cimuz-U
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Trojan-PSW.Win32.Agent.eo
Prevalence (1-5) 2
Description
Troj/Cimuz-U is a password stealing Trojan for the Windows platform.
Advanced
Troj/Cimuz-U is a password stealing Trojan for the Windows platform.
Once installed Troj/Cimuz-U attempts to harvest passwords from the
infected computer.
When Troj/Cimuz-U is installed the following files are created:
<System>\msnscps.dll - detected as Troj/Cimuz-U
<System>\text.txt - this file may be safely deleted
The file msnscps.dll is registered as a COM object and Browser Helper
Object (BHO) for Microsoft Internet Explorer, creating registry
entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Browser Helper Objects\(random CLSID)
HKCR\CLSID\(random CLSID)
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List\<Program Files>\Internet Explorer
IEXPLORE.EXE
<Program Files>\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet
Explorer
The following registry entry is set:
HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
yes
Name W32/Sality-I
Type
* Virus
How it spreads
* Infected files
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
Aliases
* W32/Sality.n
Prevalence (1-5) 2
Description
W32/Sality-I is a prepending virus that also acts as a keylogger.
W32/Sality-I has been seen using an infected copy of W32/Bagle-CK to
spread via email.
Advanced
W32/Sality-I is a prepending virus that also acts as a keylogger.
W32/Sality-I drops a file <System>\wmimgr32.dll, also detected as
W32/Sality-I, which it uses to log keystrokes to certain windows, as
well as information about the infected computer. This logged data is
periodically sent by email to a remote website.
W32/Sality-I has been seen using an infected copy of W32/Bagle-CK to
spread via email.
Name Troj/Teros-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/Teros-A is a Trojan for the Windows platform.
When executed Troj/Teros-A attempts to download, install and run new
software.
At the time of writing, Troj/Teros-A is being spammed aggressively in
emails with messages such as the following:
Subject: New act of terrorism in London
Message Body:
Today the Scotland Yard has informed new act of terrorism in London.
Look details in an applied file.
Advanced
Troj/Teros-A is a Trojan for the Windows platform.
When executed Troj/Teros-A attempts to download, install and run new
software. Should these downloads be succesful, the following files
will be created:
<Temp>\svclocal.exe
<Temp>\svclocal2.exe
At the time of writing, these downloaded files are samples of
Troj/Flecsip-B and Troj/QHosts-S.
At the time of writing, Troj/Teros-A is being spammed aggressively in
emails with messages such as the following:
Subject: New act of terrorism in London
Message Body:
Today the Scotland Yard has informed new act of terrorism in London.
Look details in an applied file.
Name Troj/Haxdoor-AT
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
Aliases
* Trojan-Dropper.Win32.Microjoin.aj
* MultiDropper-PO
Prevalence (1-5) 2
Description
Troj/Haxdoor-AT is a backdoor Trojan for the Windows platform.
The Trojan drops a stealthing component detected as Troj/Haxdor-Gen.
The Trojan may arrive in a CAB file also containing a configuration
file detected as Troj/Iyus-G.
Advanced
Troj/Haxdoor-AT is a backdoor Trojan for the Windows platform.
When Troj/Haxdoor-AT is installed the following files are created:
<Windows temp folder>\server.exe
<Windows temp folder>\.bat
<Windows folder>\refresh.html
<Windows system folder>\kednl6.sys
The file kednl6.sys is a stealthing component detected as
Troj/Haxdor-Gen. The BAT file is used to delete the original Trojan
file. The file refresh.html is a harmless HTML file.
The Trojan may arrive in a CAB file also containing a configuration
file detected as Troj/Iyus-G.
The file kednl6.sys is registered as a new system driver service
named "kednl6", with a display name of "AVSearch service". Registry
entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\kednl6\
Name Troj/Spammit-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Agent.tk
Prevalence (1-5) 2
Description
Troj/Spammit-A is a backdoor Trojan which allows an infected computer
to send
emails as specified by a remote intruder.
Advanced
Troj/Spammit-A is a backdoor Trojan which allows an infected computer
to send
emails as specified by a remote intruder.
The following registry entry is created to run Troj/Spammit-A on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Anti-Virus Update Scheduler
<pathname of the Trojan executable>
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy
DomainProfile\AuthorizedApplications\List
<pathname of the Trojan executable>
C:\NvRun\<original filename>:*:Enabled:Server
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy
StandardProfile\AuthorizedApplications\List
<pathname of the Trojan executable>
C:\NvRun\<original filename>:*:Enabled:Server
Name Troj/Bancban-OE
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Bancban-OE is an information stealing Trojan for the Windows
platform.
Troj/Bancban-OE includes functionality to send notification messages
to remote locations.
Troj/Bancban-OE monitors a user's internet activity and steals
information entered into certain banking websites. The stolen
information is emailed to a remote address.
Advanced
Troj/Bancban-OE is an information stealing Trojan for the Windows
platform.
Troj/Bancban-OE includes functionality to send notification messages
to remote locations.
Troj/Bancban-OE monitors a user's internet activity and steals
information entered into certain banking websites. The stolen
information is emailed to a remote address.
When first run Troj/Bancban-OE copies itself to:
<Startup>\winzip32.exe
<System>\winzip32.exe
The following registry entry is created to run winzip32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winzip32
<System>\winzip32.exe
Name Troj/BagleDl-BI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/BagleDl-BI is a downloader and backdoor Trojan for the Windows
platform.
Troj/BagleDl-BI runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/BagleDl-BI includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/BagleDl-BI is a downloader and backdoor Trojan for the Windows
platform.
Troj/BagleDl-BI runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/BagleDl-BI includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/BagleDl-BI copies itself to <System>\wintems.exe.
The following registry entry is created to run wintems.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
german.exe
<System>\wintems.exe
Troj/BagleDl-BI sets the following registry entries, disabling the
automatic
startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft
Internet Connection Firewall (ICF).
Registry entries are created under:
HKCU\Software\DateTime4\
Name Troj/Dloadr-LM
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.VB.ws
Prevalence (1-5) 2
Description
Troj/Dloadr-LM is a Trojan for the Windows platform.
Troj/Dloadr-LM has the functionality to silently download, install
and run new
software.
Name Troj/Hookie-B
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
Prevalence (1-5) 2
Description
Troj/Hookie-B is a Trojan used to created worms for the Windows
platform.
Worms created by Troj/Hookie-B are detected by Sophos's anti-virus
products as W32/Hookie-A.
Advanced
Troj/Hookie-B is a Trojan used to created worms for the Windows
platform.
Worms created by Troj/Hookie-B are detected by Sophos's anti-virus
products as W32/Hookie-A.
Troj/Hookie-B creates and registers as a COM server a file named
actskn4.ocx in the Windows system folder. Actiskn4.ocx is not
malicious.
Name OSX/Leap-A
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Macintosh
Side effects
* Deletes files off the computer
* Leaves non-infected files on computer
Aliases
* CME-4
* MacOS/Leap
* MacOS/Leap!tgz
* OSX.Leap.A
* OSX/Leap
Prevalence (1-5) 2
Description
OSX/Leap-A is an instant-messaging worm for the Mac OS X platform.
The worm attempts to spread via the iChat instant messaging system,
sending itself to available contacts on the infected users' buddy
list in a file called latestpics.tgz.
OSX/Leap-A attempts to infect recently used applications.
Advanced
OSX/Leap-A is an instant-messaging worm for the Mac OS X platform.
The worm attempts to spread via the iChat instant messaging system,
sending itself to available contacts on the infected users' buddy
list in a file called latestpics.tgz. This file is an archive
consisting of:
latestpics: the worm executable
._latestpics: a hidden resource file designed to disguise the
executable as a JPEG image
OSX/Leap-A installs itself as an application hook by deleting the
"apphook" subdirectory of either the /Library/InputManagers/
directory (if run with root permissions) or the
~/Library/InputManagers/ directory (if run as a non-root user) and
replacing it with the following three files:
apphook/Info
apphook/apphook.bundle/Contents/Info.plist
apphook/apphook.bundle/Contents/MacOS/apphook
OSX/Leap-A attempts to infect recently used applications by
overwriting the original application with a copy of the worm, storing
the original application in the file's resource fork. Infected
application files have the following extended attribute:
name: oompa
value: loompa
OSX/Leap-A also creates the following temporary files:
/tmp/pic.gz
/tmp/pic
/tmp/latestpics
/tmp/lastespics.tar
/tmp/lastespics.tar.gz
/tmp/lastespics.tgz
and several files under
/tmp/apphook
Name W32/Sdbot-DJA
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Aliases
* WORM_SDBOT.DJA
* Backdoor.Win32.SdBot.ajs
Prevalence (1-5) 2
Description
W32/Sdbot-DJA is a worm for the Windows platform.
W32/Sdbot-DJA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Sdbot-DJA spreads
- to computers vulnerable to common exploits, including: LSASS
(http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx),
RPC-DCOM
(http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx),
PNP
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
and ASN.1
(http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx)
- to network shares
Advanced
W32/Sdbot-DJA is a worm for the Windows platform.
W32/Sdbot-DJA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Sdbot-DJA includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Sdbot-DJA copies itself to <System>\snddrv.exe.
The file snddrv.exe is registered as a new system driver service
named "SndDRV", with a display name of "SndDRV (MS Sound Driver)" and
a startup type of automatic, so that it is started automatically
during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\SndDRV\
W32/Sdbot-DJA sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
W32/Sdbot-DJA spreads
- to computers vulnerable to common exploits, including: LSASS
(http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx),
RPC-DCOM
(http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx),
PNP
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
and ASN.1
(http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx)
- to network shares
Name Troj/BagleDl-BL
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Bagle.y
* W32/Bagle.dv.dldr
Prevalence (1-5) 2
Description
Troj/BagleDl-BL is a Trojan for the Windows platform.
Troj/BagleDl-BL includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/BagleDl-BL is a Trojan for the Windows platform.
Troj/BagleDl-BL includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/BagleDl-BL copies itself to <Windows system
folder>\anti_troj.exe.
The following registry entries are created to run anti_troj.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe
The following registry entry is also created:
HKCU\Software\FirstRRRun
FirstRRRun
1
Name Troj/Dropper-EH
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Dropper-EH is a Trojan for the Windows platform.
When Troj/Dropper-EH is installed the following files are created:
<Temp>\Documentazione_riservata.pps
<System>\msx.dll
Advanced
Troj/Dropper-EH is a Trojan for the Windows platform.
When Troj/Dropper-EH is installed the following files are created:
<Temp>\Documentazione_riservata.pps
<System>\msx.dll
The file msx.dll is registered as a COM object and Browser Helper
Object (BHO) for Microsoft Internet Explorer, creating registry
entries under:
HKCR\CLSID\(521693AA-7453-47ED-9959-3BD47DAA1B1A)
HKCR\Interface\(A25166AB-84F1-4636-B8C2-1D0366E8BB7B)
HKCR\TypeLib\(613D5EB6-379E-4726-B568-1C4F996A78EB)
HKCR\xsmx.ready2wear\
HKCR\xsmx.ready2wear.1\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\(521693AA-7453-47ED-9959-3BD47DAA1B1
Name Troj/BankSnif-G
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banker.atw
Prevalence (1-5) 2
Description
Troj/BankSnif-G is a Trojan for the Windows platform.
Advanced
Troj/BankSnif-G is a Trojan for the Windows platform.
When first run Troj/BankSnif-G copies itself to <User>\order_mala.exe
and creates the file <User>\order_opt2.bin.
The file order_opt2.bin is not malicious and can simply be deleted.
The following registry entry is created to run order_mala.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
order_Shell
<User>\order_mala.exe
Name W32/Bagle-CU
Type
* Worm
Affected operating systems
* Windows
Side effects
* Drops more malware
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Bagle.fc
* W32/Bagle.dv.dr
* Trojan.Lodav.A
Prevalence (1-5) 2
Description
W32/Bagle-CU is a worm for the Windows platform.
When run, the worm opens a dialog box asking the user to 'Select file
to crack'.
W32/Bagle-CU drops the Trojan Troj/BagleDl-BL.
Advanced
W32/Bagle-CU is a worm for the Windows platform.
When run, the worm opens a dialog box asking the user to 'Select file
to crack'.
When W32/Bagle-CU is installed the following files are created:
<Temp>\<random filename>.dmp
<Windows system folder>\anti_troj.exe
<Windows system folder>\winlog.dll
<Windows system folder>\winlog.exe
The files anti_troj.exe and winlog.exe are also copied to the Temp
folder under random filenames.
The file anti_troj.exe is detected as Troj/BagleDl-BL.
The following registry entries are created to run anti_troj.exe and
winlog.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
key2
<Windows system folder>\winlog.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
key2
<Windows system folder>\winlog.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe
Registry entries are created under:
HKCU\Software\FirstRRRun\
Name Troj/Bancos-PZ
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
Aliases
* Trojan-Spy.Win32.Banker.mm
Prevalence (1-5) 2
Description
Troj/Bancos-PZ is a Trojan for the Windows platform.
The Trojan is registered as a Browser Helper Object and steals login
credentials entered into web page forms.
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|