Text 123, 1602 rader
Skriven 2006-06-18 01:27:00 av KURT WISMER (1:123/140)
Ärende: News, June 18 2006
==========================
[cut-n-paste from sophos.com]

Name   W32/Bagle-KF

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * W32/Bagle.gen@MM

Prevalence (1-5) 5

Description
W32/Bagle-KF is a worm for the Windows platform.

W32/Bagle-KF includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Bagle-KF is a worm for the Windows platform.

W32/Bagle-KF includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Bagle-KF copies itself to <Windows system 
folder>\hldrrr.exe. The worm will then launch notepad.exe.

The following registry entries are created to run hldrrr.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
hldrrr
<Windows system folder>\hldrrr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hldrrr
<Windows system folder>\hldrrr.exe

Registry entries are created under:

HKCU\Software\FirstRRRun\





Name   W32/Bagle-KH

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * W32/Bagle.gen@MM

Prevalence (1-5) 3

Description
W32/Bagle-KH is a worm for the Windows platform.

W32/Bagle-KH includes functionality to access the internet and 
communicate with
a remote server via HTTP.

Advanced
W32/Bagle-KH is a worm for the Windows platform.

W32/Bagle-KH includes functionality to access the internet and 
communicate with
a remote server via HTTP.

When first run W32/Bagle-KH copies itself to <Windows system 
folder>\hldrrr.exe.

The following registry entries are created to run hldrrr.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
hldrrr
<Windows system folder>\hldrrr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
hldrrr
<Windows system folder>\hldrrr.exe

Registry entries are created under:

HKCU\Software\FirstRRRun\





Name   W32/Opanki-BT

Type  
    * Worm

How it spreads  
    * Network shares
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Opanki-BT is a worm with backdoor functionality for the Windows 
platform.

W32/Opanki-BT runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Opanki-BT attempts to spread via AOL Instant Messenger, by 
copying itself to remote network shares and by exploiting any of the 
following vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS 
(MS03-049) (CAN-2003-0812), PNP (MS05-039), IMAIL Server, ASN.1 
(MS04-007).

Advanced
W32/Opanki-BT is a worm with backdoor functionality for the Windows 
platform.

W32/Opanki-BT runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Opanki-BT attempts to spread via AOL Instant Messenger, by 
copying itself to remote network shares and by exploiting any of the 
following vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS 
(MS03-049) (CAN-2003-0812), PNP (MS05-039), IMAIL Server, ASN.1 
(MS04-007).

When first run W32/Opanki-BT copies itself to <Windows 
folder>\scvhost.exe.

The file scvhost.exe is registered as a new system driver service 
named "lsass", with a display name of "Local Security Authority 
Subsystem Service" and a startup type of automatic, so that it is 
started automatically during system startup. Registry entries are 
created under:

HKLM\SYSTEM\CurrentControlSet\Services\lsass\

W32/Opanki-BT sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Small-BWB

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Small.crd

Prevalence (1-5) 2

Description
Troj/Small-BWB is a downloader Trojan for the Windows platform.

Advanced
Troj/Small-BWB is a downloader Trojan for the Windows platform.

Troj/Small-BWB downloads and runs an executable file to 
C:\WINNT\system32\svchw.exe.





Name   Troj/Zapchas-BM

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Backdoor.IRC.Zapchast
    * BKDR_ZAPCHAST.EI
    * IRC/Zapchast.J

Prevalence (1-5) 2

Description
Troj/Zapchas-BM is a Trojan for the Windows platform.

Troj/Zapchas-BM runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
Troj/Zapchas-BM is a Trojan for the Windows platform.

Troj/Zapchas-BM runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When Troj/Zapchas-BM is installed the following files are created:

<Windows system folder>\aliases.ini
<Windows system folder>\control.ini
<Windows system folder>\mirc.ico
<Windows system folder>\mirc.ini
<Windows system folder>\nicks.txt
<Windows system folder>\remote.ini
<Windows system folder>\script.ini
<Windows system folder>\servers.ini
<Windows system folder>\sup.bat
<Windows system folder>\sup.reg
<Windows system folder>\svchost.exe
<Windows system folder>\users.ini

The following registry entries are set or modified, so that 
svchost.exe is run when files with extensions of CHA and IRC are 
opened/launched:

HKCR\ChatFile\Shell\open\command
(default)
<Windows system folder>\svchost.exe" -noconnect

HKCR\irc\Shell\open\command
(default)
<Windows system folder>\svchost.exe" -noconnect

Registry entries are created under:

HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\





Name   W32/Melo-E

Type  
    * Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Melo-E is a worm for the Windows platform.

W32/Melo-E deletes all normal files in the top folder of the A: and 
C: drives, replacing them with copies of itself whose filename is the 
original filename plus an additional EXE extension.

W32/Melo-E monitors active windows, and when it finds a window 
indicating a Hotmail email message is being composed in Microsoft 
Internet Explorer, it will append one of the following links to the 
composed message in order to encourage the recipient to download 
another copy of the worm from the Internet :

"jaja look a that video <link to worm>"

"mira este video <link to worm> jaja"

Advanced
W32/Melo-E is a worm for the Windows platform.

W32/Melo-E deletes all normal files in the top folder of the A: and 
C: drives, replacing them with copies of itself whose filename is the 
original filename plus an additional EXE extension.

The worm also copies itself to C:\Windows\Cursors\wam.exe and creates 
the registry entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
axel
"C:\Windows\Cursors\wam.exe"

W32/Melo-E monitors active windows, and when it finds a window 
indicating a Hotmail email message is being composed in Microsoft 
Internet Explorer, it will append one of the following links to the 
composed message in order to encourage the recipient to download 
another copy of the worm from the Internet :

"jaja look a that video <link to worm>"

"mira este video <link to worm> jaja"

The worm terminates the following processes:
_AVPCC
ACKWIN32
AD-AWARE
ADMINTOOL
ADVXDWIN
AGENTA
AGENTSVR
ALERTSVC
ALOGSERV
AMON9X
ANTI-TROJAN
ANTITROJ
ANTIVIRUS
APIMONITOR
APLICA32
APVXDWIN
ASHDISP
ASHQUICK
ATGUARD
ATRO55EN
ATUPDATER
ATWATCH
AUTODOWN
AUTOTRACE
AVCONSOL
AVENGINE
AVGCC32
AVGCTRL
AVGSERV
AVGSERV9
AVGUARD
AVKPOP
AVKSERV
AVKSERVICE
AVKWCTL
AVKWCTL9
AVSCHED32
AVSYNMGR
AVWINNT
AVXGUI
AVXLIVE
AVXMONITOR9X
AVXMONITORNT
AVXQUAR
BD_PROFESSIONAL
BIDSERVER
BLACKD
BLACKICE
BOOTSCAN
BOOTWARN
CCEVTMGR
CFGINTPR
CFGWIZ
CFIADMIN
CFIAUDIT
CFINET
CFINET32
CLAW95
CLAW95CF
CLEANER
CLEANER3
CLEANPC
CMGRDIAN
CMON016
CONNECTIONMONITOR
CPFNT206
CWNB181
CWNTDWMO
DEFSCANGUI
DEFWATCH
DEPUTY
DPATROL
DRWEB32
DRWEBSCD
ECENGINE
EFPEADM
ESCANH95
ESCANHNT
ESCANV95
ESPWATCH
ETRUSTCIPE
EXANTIVIRUS-CNET
EXPERT
F-AGNT95
F-PROT
F-PROT95
F-STOPW
FAMEH32
FINDVIRU
FIREWALL
FLOWPROTECTOR
FNRB32
FP-WIN
FSAV32
FSAV530STBYB
FSAVSTRT
FSGK32
FSMA32
FSMB32
GBMENU
GBPOLL
GENERICS
GLADIATOR
GUARDDOG
GUARDER
HACKERELIMINATOR
HACKTRACERSETUP
IAMAPP
IAMSERV
IAMSTATS
IBMASN
IBMAVSP
ICLOAD95
ICLOADNT
ICSUPP95
ICSUPPNT
IOMON98
IPARMOR
ISRV95
JAMMER
KAVLITE40ENG
MCVSSHLD
MFW2EN
MGAVRTCL
MGAVRTE
MGHTML
MGUTIL
MINILOG
MONITOR
MOOLIVE
MPFTRAY
MSSMMC32
MWATCH
N32SCANW
NAVAPSVC
NAVAPW32
NAVLU32
NAVSTUB
NAVW32
NAVWNT
NEOWATCHLOG
NEOWATCHTRAY
NETARMOR
NETINFO
NETMON
NETSCANPRO
NETSPYHUNTER-1.2
NETUTILS
NISSERV
NORMIST
NPFMESSENGER
NPSSVC
NSCHED32
NTRTSCAN
NTXCONFIG
NVARCH16
NWSERVICE
NWTOOL16
OSTRONET
OUTPOST
PADMIN
PANIXK
PAVFIRES
PAVPROXY
PAVSRV51
PCCCLIENT
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCWIN97
PCCWIN98
PCFWALLICON
PCSCAN
PERISCOPE
PERSFW
PFWADMIN
PINGSCAN
PLATIN
POP3TRAP
POPROXY
PORTDETECTIVE
PORTMONITOR
PPVSTOP
PRAZNA
PROCMAN
PROGRAMAUDITOR
PROPORT
PROTECTX
PVIEW95
QCONSOLE
QSERVER
QTTASK
RAPAPP
RAV7WIN
RAV8WIN32ENG
RAVMON
RAVWIN8
REALMON
RMVTRJAN
RRGUARD
RSHELL
RTVSCN95
RULAUNCH
SAFEWEB
SBSERV
SCAN32
SCANPM
SCRSCAN
SGSSFW32
SPHINX
SS3EDIT
SUPFTRL
SUPPORTER5
SWEEP95
SWNETSUP
SYMPROXYSVC
TASKALERT
TAUMON
TAUSCAN
TBSCAN
TDS2-NT
THGUARD
TITANIN
TITANINXP
TRJSCAN
TROJAN
TROJANHUNTER
TROJANTRAP3
TUCONF
TWEAK-XP
UMXAGENT
UMXLDRA
V530WTBYB
VBCMSERV
VBCONS
VBWIN9X
VBWINNTW
VETTRAY
VIR-HELP
VNLAN300
VPFW30S
VPTR AY
VPTRAY
VSCAN40
VSCHED
VSECOMR
VSHWIN32
VSMAIN
VSSTAT
WATCHDOG
WATCHER
WEBSCANX
WEBTRAP
WFINDV32
WGFE95
WIMMUN32
WINGATE
WINRECON
WINROUTE
WRADMIN
WRCTRL
WSBGATE
XCOMMSVR
XPF202EN
ZATUTOR
ZAUINST
ZONALM2601





Name   Troj/Zlob-NW

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Zlob-NW is a downloader Trojan for the Windows platform.

Advanced
Troj/Zlob-NW is a downloader Trojan for the Windows platform.

When run Troj/Zlob-NW creates the file <System>\ld<random 
characters>.tmp and
<System>\regperf.exe.

Once installed, the following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
wininet.dll
regperf.exe





Name   Troj/DwnLdr-DCY

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Win32/TrojanDownloader.Delf.AJD

Prevalence (1-5) 2

Description
Troj/DwnLdr-DCY is a Trojan for the Windows platform.

Advanced
Troj/DwnLdr-DCY is a Trojan for the Windows platform.

Troj/DwnLdr-DCY includes functionality to access the internet and 
communicate
with a remote server via HTTP.





Name   W32/Sdbot-BVK

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Used in DOS attacks
    * Scans network for open ports

Aliases  
    * Backdoor.Win32.SdBot.aoz
    * W32/Sdbot.SZP

Prevalence (1-5) 2

Description
W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Sdbot-BVK can spread via network shares protected by weak 
passwords, or by exploiting common vulnerabilities, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007).

W32/Sdbot-BVK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-BVK includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Sdbot-BVK can spread via network shares protected by weak 
passwords, or by exploiting common vulnerabilities, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007).

W32/Sdbot-BVK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-BVK includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Sdbot-BVK copies itself to <System>\netbtd.exe.

The file netbtd.exe is registered as a new system driver service 
named "NetBTD", with a display name of "NetBTD(ntbtd)" and a startup 
type of automatic, so that it is started automatically during system 
startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\

W32/Sdbot-BVK sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Agent-CBA

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Proxy.Win32.Agent.ji

Prevalence (1-5) 2

Description
Troj/Agent-CBA is a downloader Trojan for the Windows platform.

Troj/Agent-CBA includes functionality to access the internet and 
communicate with a remote server via HTTP.

Troj/Agent-CBA attempts to stealth itself on an infected system.

Advanced
Troj/Agent-CBA is a downloader Trojan for the Windows platform.

Troj/Agent-CBA includes functionality to access the internet and 
communicate with a remote server via HTTP.

Troj/Agent-CBA attempts to stealth itself on an infected system.

When first run Troj/Agent-CBA copies itself to <System>\clcbt.exe and 
creates the file <Windows>\comdlg66.dll.

The following registry entry is created to run clcbt.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
clcbt.exe
<System>\clcbt.exe





Name   Troj/Adclick-CP

Type  
    * Trojan

Affected operating systems  
    * Windows

Aliases  
    * Trojan-Spy.Win32.Delf.dq

Prevalence (1-5) 2

Description
Troj/Adclick-CP is a Trojan for the Windows platform.

When run, Troj/Adclick-CP launches Internet Explorer and attempts to 
access predefined URLs.

Advanced
Troj/Adclick-CP is a Trojan for the Windows platform.

When run, Troj/Adclick-CP launches Internet Explorer and attempts to 
access predefined URLs.

When run, Troj/Adclick-CP creates the following files:

<temp>\001122.html
<temp>\51link.html
<temp>\536net.html
<temp>\access_log
<temp>\agent_log
<temp>\dy.html
<temp>\error_log
<temp>\index11.html
<temp>\index2005.html
<temp>\index24.html
<temp>\index8.html
<temp>\is686_.html
<temp>\pop001122.html
<temp>\pop536.html
<temp>\referer_log
<temp>\ulink.html
<temp>\yule.html

These files can be deleted safely.

Troj/Adclick-CP modifies the file <system>\drivers\etc\hosts with the 
following information:

127.0.0.1 www1.tmdqq.net
127.0.0.1 www3.57185.com
127.0.0.1 www.szfocus.net
9.9.9.9 skypetools.tom.com
9.9.9.9 www.cool-pic.com
9.9.9.9 www.511ku.com
9.9.9.9 www.511q.com
9.9.9.9 www.fvip.cn
9.9.9.9 17rm.com
9.9.9.9 www.mv23.com
9.9.9.9 www.911y.com
9.9.9.9 www.kanhaha.com
9.9.9.9 168.tu9.cn
9.9.9.9 liao8.top22.cn
9.9.9.9 top22.cn
9.9.9.9 tu9.cn
9.9.9.9 liao8.tu9.cn
9.9.9.9 www.haha9999.com
9.9.9.9 haha9999.com
9.9.9.9 www.mmm168.com
9.9.9.9 www.rm78.com
9.9.9.9 rm78.com
9.9.9.9 v.511.cc
9.9.9.9 www.kvip.cn
9.9.9.9 assistant.3721.com
9.9.9.9 www.10uu.com
9.9.9.9 168.8799.com
9.9.9.9 www.movieon.net
9.9.9.9 www.18mei.com
9.9.9.9 vod.xp99.net
9.9.9.9 vcd.58so.com
9.9.9.9 www.movie78.com
9.9.9.9 www.103h.com
9.9.9.9 www.kan8dy.com
9.9.9.9 www.yk88.com
9.9.9.9 www.qq500.cn
9.9.9.9 www.921mn.com
9.9.9.9 www.38mtv.com
9.9.9.9 www.591mn.com
9.9.9.9 liao2.sees8.com
9.9.9.9 www.66pp.net
9.9.9.9 www.581mm.com
9.9.9.9 www.cl258.com
9.9.9.9 www.sedy8.com
9.9.9.9 www.531kdy.com
9.9.9.9 www.ku90.com
9.9.9.9 www.47028.com
9.9.9.9 client.jogo.cn
9.9.9.9 iebar.t2t2.com
9.9.9.9 download.3721.com
9.9.9.9 vod.mmm168.com
9.9.9.9 www.521lan.com
9.9.9.9 www.dy87.com
9.9.9.9 www.55p5.com
9.9.9.9 liao.kkddd.com
9.9.9.9 www.ddkkk.com
9.9.9.9 www.setu8.com
9.9.9.9 www.mfvo.com
9.9.9.9 vod.soucn.net
9.9.9.9 vod.88997.com
9.9.9.9 www.777dy.com
9.9.9.9 pi.51.net
9.9.9.9 liao8.ip33.cn
9.9.9.9 2liao8.ip33.cn
9.9.9.9 www.kku98.com
9.9.9.9 wwv.86565.com
9.9.9.9 wwv.vbdy.com
9.9.9.9 00565.com
9.9.9.9 www.88588cc.com
9.9.9.9 www.bb90dy.com
9.9.9.9 www.0011222.com
9.9.9.9 www.5k8dy.com
9.9.9.9 www.0730dy.com
9.9.9.9 www.5111dy.com
9.9.9.9 www.999ko.com
9.9.9.9 www.gongzhusms.com
9.9.9.9 www.cc911.com
9.9.9.9 www.rongtv.com





Name   Troj/FeebDl-R

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Reduces system security

Prevalence (1-5) 2

Description
Troj/FeebDl-R is a Trojan for the Windows platform.

The Trojan attempts to download and execute files from remote sites. 
The Trojan may arrive via email and may contain an attached file with 
the ZIP file extension. The ZIP file contains an HTML based script 
file which may have the file extension HTA.

Advanced
Troj/FeebDl-R is a Trojan for the Windows platform.

The Trojan attempts to download and execute files from remote sites. 
The Trojan may arrive via email and may contain an attached file with 
the ZIP file extension. The ZIP file contains an HTML based script 
file which may have the file extension HTA.

Downloaded files are placed in the C:\Recycled folder and are named 
"userinit.exe"

The Trojan may delete the following registry entries, if they exist:

HKLM\SYSTEM\CurrentControlSet\Services
pcipim

HKLM\SYSTEM\CurrentControlSet\Services
pcIPPsC

HKLM\SYSTEM\CurrentControlSet\Services
RapDrv

HKLM\SYSTEM\CurrentControlSet\Services
FirePM

HKLM\SYSTEM\CurrentControlSet\Services
KmxFile

Troj/FeebDl-R may copy itself to the "Common Startup" folder as 
determined by the registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Common Startup





Name   W32/Tilebot-FI

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aoz
    * WORM_SDBOT.DJ

Prevalence (1-5) 2

Description
W32/Tilebot-FI is a worm with backdoor functionality for the Windows 
platform.

W32/Tilebot-FI spreads to other network computers by exploiting 
common buffer
overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), 
PNP
(MS05-039) and ASN.1 (MS04-007). The worm may also spreads via 
network shares
and MSSQL servers protected by weak passwords.

W32/Tilebot-FI runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Tilebot-FI includes functionality to:

- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks

Advanced
W32/Tilebot-FI is a worm with backdoor functionality for the Windows 
platform.

W32/Tilebot-FI spreads to other network computers by exploiting 
common buffer
overflow vulnerabilities, including: WKS (MS03-049) (CAN-2003-0812), 
PNP
(MS05-039) and ASN.1 (MS04-007). The worm may also spreads via 
network shares
and MSSQL servers protected by weak passwords.

W32/Tilebot-FI runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Tilebot-FI includes functionality to:

- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks

When first run W32/Tilebot-FI copies itself to the Windows folder as
netbtd.exe.

The file netbtd.exe is registered as a new system driver service 
named "NetBTD",
with a display name of "NetBTD(ntbtd)" and a startup type of 
automatic, so that
it is started automatically during system startup. Registry entries 
are created
under:

HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\

W32/Tilebot-FI sets the following registry entries, disabling the 
automatic
startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4

Additional registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Control\
WaitToKillServiceTimeout
7000

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





Name   Troj/Haxdoor-HM

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Haxdoor.hm
    * BackDoor-BAC

Prevalence (1-5) 2

Description
Troj/Haxdoor-HM is a Trojan for the Windows platform.

Troj/Haxdoor-HM runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/Haxdoor-HM includes functionality to:

- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security 
related applications

Advanced
Troj/Haxdoor-HM is a Trojan for the Windows platform.

Troj/Haxdoor-HM runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

Troj/Haxdoor-HM includes functionality to:

- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security 
related applications

When Troj/Haxdoor-HM is installed the following files are created:

<System>\klgcptini.dat
<System>\ms87.dat
<System>\pptp16.dll
<System>\pptp24.sys
<System>\qz.dll
<System>\qz.sys

The files pptp16.dll and qz.dll are detected as Troj/Haxdor-Fam and 
the files pptp24.sys and qz.sys are detected as Troj/Haxdor-Gen.

The following registry entries are created to run code exported by 
pptp16.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\pptp16
DllName
pptp16.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\pptp16
Startup
KeImageDBG

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\pptp16
Impersonate
1

The file pptp24.sys is registered as a new system driver service 
named "pptp16", with a display name of "MMX2 virtualization service" 
and a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\pptp16\

The file pptp24.sys is registered as a new system driver service 
named "pptp24", with a display name of "MMX virtualization service". 
Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\pptp24\





Name   Troj/Doctrix-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Doctrix-A is a Trojan for the Windows platform.

Troj/Doctrix-A may be distributed with the filename "My 
Documents.exe" and an icon designed to look like a folder icon, so 
that users may inadvertantly execute the Trojan when intending to 
open the "My Documents" folder.

Advanced
Troj/Doctrix-A is a Trojan for the Windows platform.

Troj/Doctrix-A may be distributed with the filename "My 
Documents.exe" and an icon designed to look like a folder icon, so 
that users may inadvertantly execute the Trojan when intending to 
open the "My Documents" folder.

When first run Troj/Doctrix-A copies itself to the Windows folder and 
creates the file <Windows>\Pacuks.

The following registry entry is created to run Troj/Doctrix-A on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System File
<Windows>\<original Trojan filename>





Name   Troj/Repkill-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Virus.Win32.VB.ar

Prevalence (1-5) 2

Description
Troj/Repkill-A is a Trojan for the Windows platform.

Troj/Repkill-A attempts to kill W32/Repper worms, but also terminates 
some security related processes.

Advanced
Troj/Repkill-A is a Trojan for the Windows platform.

When Troj/Repkill-A is installed it copies itself to <Windows 
folder>\svchost.exe, and creates the file <Windows folder>\autorun.inf.

The following registry entries are created to run svchost.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ip
<Windows folder>\svchost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
io
<Windows NT folder>\svchost.exe

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
ff

Troj/Repkill-A attempts to kill any processes with the following names:

ravmon.exe
ntsd.exe
reper.exe
viewer.exe
n0tepad.exe

The final three names suggest that Troj/Repkill-A is designed to kill 
the W32/Repper family of worms.





Name   Troj/FeebDl-S

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * JS/Feebs.gen.f@MM

Prevalence (1-5) 2

Description
Troj/FeebDl-S is a Trojan downloader for the Windows platform.

When run the Trojan will attempt to download and execute components 
from the internet. The downloaded components are detected by Sophos 
as W32/Feebs-Gen.





Name   Troj/Stinx-W

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Win32/IRCBot.PH

Prevalence (1-5) 2

Description
Troj/Stinx-W is an IRC backdoor Trojan for the Windows platform.

Troj/Stinx-W may arrive as an attachment to an email message 
variously claiming to be CCTV footage of a rape on a university campus.

Advanced
Troj/Stinx-W is an IRC backdoor Trojan for the Windows platform.

When first run, Troj/Stinx-W copies itself to the Windows system 
folder with the name svchon32.exe and creates the following registry 
entry to run itself automatically:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ProtocolModuleCmd
svchon32.exe

Troj/Stinx-W connects to a preconfigured IRC server and joins a 
specific channel. A remote attacker can then gain access and control 
over the infected computer.

Troj/Stinx-W may arrive as an attachment to an email message 
variously claiming to be CCTV footage of a rape on a university campus.





Name   W32/Tilebot-FK

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aoy

Prevalence (1-5) 2

Description
W32/Tilebot-FK is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-FK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-FK exploits the following software vulnerabilities:
LSASS (MS04-011)
ASN.1 (MS04-007)

W32/Tilebot-FK includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-FK copies itself to <System>\winscntrl.exe.

Advanced
W32/Tilebot-FK is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-FK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-FK exploits the following software vulnerabilities:
LSASS (MS04-011)
ASN.1 (MS04-007)

W32/Tilebot-FK includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-FK copies itself to <System>\winscntrl.exe.

Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Wins\

W32/Tilebot-FK sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

 
--- MultiMail/Win32 v0.43
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)