Text 156, 1227 rader
Skriven 2006-12-10 19:23:00 av KURT WISMER (1:123/140)
Ärende: News, December 10 2006
==============================
[cut-n-paste from sophos.com]
Name Troj/StraDr-Fam
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
Aliases
* Email-Worm.Win32.Warezov.fb
* Win32/Stration
* PAK_Generic.001
Prevalence (1-5) 3
Description
Troj/StraDr-Fam detects a family of Trojan droppers.
Advanced
Troj/StraDr-Fam detects a family of Trojan droppers.
When run, the Trojan will create a randomly named executable file in
the Windows system folder and run it. This file is detected as
W32/Strati-Gen.
Name W32/Stration-CH
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Warezov.fb
* Win32/Stration
Prevalence (1-5) 3
Description
W32/Stration-CH is a network worm for the Windows platform.
W32/Stration-CH includes functionality to download, install and run
new software.
Advanced
W32/Stration-CH is a network worm for the Windows platform.
W32/Stration-CH includes functionality to download, install and run
new software.
When W32/Stration-CH is installed it creates the file
<System>\<random>.exe (where <random> is a series of 10
randomly-selected letters). This file is detected as W32/Strati-Gen.
When first run, W32/Stration-CH displays the following message box:
Title: Error
Message: Unknown error
Name Troj/Bancos-AXX
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Uses its own emailing engine
* Leaves non-infected files on computer
Aliases
* Trojan-Spy.Win32.Bancos.zv
Prevalence (1-5) 2
Description
Troj/Bancos-AXX is a password-stealing Trojan for the Windows platform.
When first run Troj/Bancos-AXX displays a fake user interface in
order to pretend to be MSN Messenger.
Information stolen by the Trojan may be sent to a remote user by email.
Advanced
Troj/Bancos-AXX is a password-stealing Trojan for the Windows platform.
When first run Troj/Bancos-AXX displays a fake user interface in
order to pretend to be MSN Messenger.
Information stolen by the Trojan may be sent to a remote user by email.
Stolen information may be stored in the file <System>\tempxyz.dll.
Name Troj/Lineag-AFB
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Lineag-AFB is a password-stealing Trojan for the Windows platform.
Advanced
Troj/Lineag-AFB is a password-stealing Trojan for the Windows platform.
When Troj/Lineag-AFB is installed the following files are created:
<Temp>\uxx.dll
<Program Files>\Windows Media Player\svchost.exe
<System>\pdll.dll
The following registry entry is changed to run Troj/Lineag-AFB on
startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<Program Files>\Windows Media Player\svchost.exe,
(the default value for this registry entry is
"<Windows>\System32\userinit.exe,").
Name W32/Looked-BC
Type
* Virus
How it spreads
* Infected files
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Looked-BC is a Windows executable virus and network worm.
Advanced
W32/Looked-BC is a Windows executable virus and network worm.
When first run the virus copies itself to <Windows>\rundl132.exe and
creates a file <Windows>\RichDll.dll, also detected as W32/Looked-BC.
This file attempts to download further malicious code.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
Many files with the name "_desktop.ini" are created, in various
folders on the infected computer. These files are harmless text files.
The following registry entry is created in order to run the virus on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe
Name Troj/Murlo-Q
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Trojan-Downloader.Win32.Murlo.ek
Prevalence (1-5) 2
Description
Troj/Murlo-Q is a Trojan for the Windows platform.
Troj/Murlo-Q includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Murlo-Q is a Trojan for the Windows platform.
Troj/Murlo-Q includes functionality to access the internet and
communicate with a remote server via HTTP.
When Troj/Murlo-Q is installed it creates the following files:
<System>\<8 random letters>.exe (more than one)
<System>\sysvx.exe
\Local Settings\Temp\tmp.tmp (more than one)
\Local Settings\Temp\tmp.bat (more than one)
The above mentioned files are innocuous and may simply be deleted.
The BAT files are used to remove the Trojan executable after execution.
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Internet Explorer
UID
<24 random characters>
Name W32/Stratio-CG
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
Prevalence (1-5) 2
Description
W32/Stratio-CG is a worm for the Windows platform.
When run W32/Stratio-CG creates a file with a random filename in the
Windows System folder. This file is detected by Sophos as
W32/Strati-Gen.
Name Troj/LowZone-DS
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* Trojan-Clicker.Win32.Agent.ip
Prevalence (1-5) 2
Description
Troj/LowZone-DS is a Trojan for the Windows platform.
Troj/LowZone-DS includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/LowZone-DS is a Trojan for the Windows platform.
Troj/LowZone-DS includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/LowZone-DS copies itself to the Windows system
folder and creates the following files:
<Desktop>\Internet Explorer.lnk
<User>\Start Menu\Internet Explorer.lnk
The following registry entry is created to run Troj/LowZone-DS on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
<original Trojan filename>
<System>\winsvc\svc\<original Trojan filename>
The file <original Trojan filename> is registered as a COM object,
creating registry entries under:
HKCR\CLSID\(16C7013F-912E-42ac-AA8E-A10A180DFF51)
The following registry entries are set, affecting internet security:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz\www
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz\www
*
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2
1004
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2
1201
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2
MinLevel
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2
RecommendedLevel
0
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\
\NameSpace\(16C7013F-912E-42ac-AA8E-A10A180DFF51)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\
NameSpace\(16C7013F-912E-42ac-AA8E-A10A180DFF51)
HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
http://www.gooogle.bz
Name Troj/Bombka-P
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs a browser helper object
Prevalence (1-5) 2
Description
Troj/Bombka-P is a Trojan for the Windows platform.
When run, the Trojan sets registry entries under:
HKCR\Comcap16.ComCap\
HKCR\Comcap16.ComCap.1\
Name W32/Stration-CI
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Drops more malware
* Downloads code from the internet
Aliases
* Email-Worm.Win32.Warezov.gz
* Email-Worm.Win32.Warezov.dq
* Win32/Stration.RJ
* WORM_STRAT.GS
Prevalence (1-5) 2
Description
W32/Stration-CI is a network worm for the Windows platform.
Name W32/Kidala-I
Type
* Worm
How it spreads
* Network shares
* Peer-to-peer
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Kidala-I is a mass-mailing worm and IRC backdoor Trojan for the
Windows platform.
Advanced
W32/Kidala-I is a mass-mailing worm and IRC backdoor Trojan for the
Windows platform.
W32/Kidala-I spreads:
- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7,
W32/Sasser, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011)
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030),
MSSQL (MS02-039) (CAN-2002-0649) and PNP (MS05-039)
When first run W32/Kidala-I copies itself to:
\My Downloads\YahooMessenger_Loader.scr
<Program Files>\KaZaA\My Shared Folder\icq2006-final.bat
<Program Files>\eDonkey2000\Incoming\Angilina_Jolie_Sucks_a_Dick.scr
<System>\sysmon.exe
The following registry entry is created to run sysmon.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32
<System>\sysmon.exe
Name Troj/Remadm-P
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Enables remote access
Prevalence (1-5) 2
Description
Troj/Remadm-P is a backdoor Trojan for the Windows platform.
Troj/Remadm-P enables remote users to virtually control an infected
system.
Name Troj/Dloadr-ARB
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.QQHelper.qr
Prevalence (1-5) 2
Description
Troj/Dloadr-ARB is a Trojan for the Windows platform.
Troj/Dloadr-ARB contains functionality to download and run further
executable code.
Name W32/VB-CUZ
Type
* Spyware Worm
Affected operating systems
* Windows
Side effects
* Steals information
* Uses its own emailing engine
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.VB.cb
* Generic
Prevalence (1-5) 2
Description
W32/VB-CUZ is a password stealing worm for the Windows platform.
W32/VB-CUZ includes functionality to send notification messages to
remote
locations.
Advanced
W32/VB-CUZ is a password stealing worm for the Windows platform.
W32/VB-CUZ includes functionality to send notification messages to
remote
locations.
When first run W32/VB-CUZ copies itself to:
<Windows>\svchost.exe
<System>\BttnServ.exe
The following registry entries are created to run W32/VB-CUZ on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(Default)
<Windows>\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CPQEASYBTTN
<System>\BttnServ.exe
Name Troj/Dloadr-ARE
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/Dloadr-ARE is a downloader Trojan for the Windows platform.
Troj/Dloadr-ARE includes functionality to download and install
further software.
When run the Trojan creates a randomly named DLL file in the Windows
system folder. The DLL is also detected as Troj/Dloadr-ARE.
Name W32/Dref-R
Type
* Virus
How it spreads
* Email attachments
* Infected files
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Glowa.g
Prevalence (1-5) 2
Description
W32/Dref-R is a mass-mailing worm and parasitic virus with IRC
backdoor functionality for the Windows platform.
Advanced
W32/Dref-R is a mass-mailing worm and parasitic virus with IRC
backdoor functionality for the Windows platform.
When first run W32/Dref-R copies itself to <System>\wservice.exe and
creates the following following file.
<Current Folder>\doC0R24.exe
The file doC0R24.exe is detected as Troj/Dloadr-APW.
W32/Dref-R will attempt to infect SCR, HTM, HTA, EXE and RAR files
then email itself as an attachment to email addresses harvested from
the infected computer.
Files infected with the virus are detected as W32/Dref-L.
W32/Dref-R may arrive in an email message with the following
characteristics:
Subject line: chosen from
White house news!
READ AND RESEND ASAP!
NEWS!
ATTN TO EVERYBODY!
Incredible news!
ATTN
URGENT NEWS!
URG
Message text: chosen from
3rd Glogal War Just Started!!! Read more in file!
Nuclear War in Russia! Read news in file!
President Bush DEAD! Read attached file!
Putin and Bush starts NUCLEAR WAR! Check the file!
Nuclear WAR in USA! Read attached file!
GLOBAL NUCLEAR WAR JUST STARTED! News in file.
President Putin dead! Read more in attached file!
Attached file:chosen from
truth.exe
last.exe
lasest news.exe
never.exe
war.exe
about me.exe
a.exe
read me .exe
open.exe
The files attached in the emails are detected as Troj/Dloadr-APW.
The following registry entries are created to run wservice.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
UpdateService
<System>\wservice.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdateService
<System>\wservice.exe
W32/Dref-R sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Name Troj/LdPinc-AZE
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
Aliases
* Trojan-PSW.Win32.LdPinch.aze
* Win32/PSW.LdPinch.NCC
Prevalence (1-5) 2
Description
Troj/LdPinc-AZE is a password-stealing Trojan for the Windows platform.
Advanced
Troj/LdPinc-AZE is a password-stealing Trojan for the Windows platform.
When Troj/LdPinc-AZE is installed the following files are created:
\Pinch.exe
\csrss.exe
\hook.txt
The files csrss.exe and Pinch.exe are also detected as Troj/LdPinc-AZE.
The following registry entry is created to run Troj/LdPinc-AZE on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
system
\csrss.exe
Name Troj/BagleDl-BW
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/BagleDl-BW is a downloader Trojan for the Windows platform.
The Trojan includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/BagleDl-BW is a downloader Trojan for the Windows platform.
The Trojan includes functionality to access the internet and
communicate with a remote server via HTTP.
When run the Trojan copies itself to <System>\wintems.exe.
The following registry entry is created to run wintems.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
german.exe
<System>\wintems.exe
Name Troj/Banloa-ASE
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Spy.Win32.Banker.bdr
Prevalence (1-5) 2
Description
Troj/Banloa-ASE is a downloader Trojan for the Windows platform.
Advanced
Troj/Banloa-ASE is a downloader Trojan for the Windows platform.
When run Troj/Banloa-ASE attempts to copy itself to
<System>\explore.exe and sets the following registry entries to run
itself on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
IntSys1
<path to Trojan executable>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntSys1
<path to Trojan executable>
Name W32/Tilebot-IC
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aad
* WORM_SDBOT.EAI
Prevalence (1-5) 2
Description
W32/Tilebot-IC is a worm with IRC backdoor functionality for the
Windows platform.
W32/Tilebot-IC spreads to other network computers:
- by exploiting common buffer overflow vulnerabilities, including:
LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), WKS (MS03-049) and
ASN.1
(MS04-007).
- through network shares.
W32/Tilebot-IC runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via IRC channels.
Advanced
W32/Tilebot-IC is a worm with IRC backdoor functionality for the
Windows platform.
W32/Tilebot-IC spreads to other network computers
- by exploiting common buffer overflow vulnerabilities, including:
LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), WKS (MS03-049) and
ASN.1
(MS04-007).
- through network shares.
W32/Tilebot-IC runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Tilebot-IC copies itself to <System>\vcmon.exe.
The file vcmon.exe is registered as a new system driver service named
"Windows
Security Manager", with a display name of "Windows Security Manager"
and a
startup type of automatic, so that it is started automatically during
system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Windows Security Manager
W32/Tilebot-IC sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
Registry entries are created under the following affecting system
security:
HKLM\SOFTWARE\Microsoft\Security Center
Name Troj/QQRob-ABQ
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-PSW.Win32.Delf.nx
* PWS-QQRob
Prevalence (1-5) 2
Description
Troj/QQRob-ABQ is a Trojan for the Windows platform.
Advanced
Troj/QQRob-ABQ is a Trojan for the Windows platform.
When run, Troj/QQRob-ABQ installs itself into the Windows folder as
WUAUCLT.EXE, setting the following Registry entry to hook system
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft
(WinDir)\wuauclt.exe
Once running, Troj/QQRob-ABQ attempts to terminate several security
products.
Troj/QQRob-ABQ also sets the following Registry entries:
HKCU\Software\Microsoft\Internet Explorer\New Windows
PopupMgr
"no"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
hx-1
"1"
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
000000bd
Name W32/Looked-BE
Type
* Virus
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Worm.Win32.Viking.bd
Prevalence (1-5) 2
Description
W32/Looked-BE is a virus.
W32/Looked-BE infects EXE files found on the infected computer and
attempts to spread to remote network shares with weak passwords.
The virus includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Looked-BE is a virus.
W32/Looked-BE infects EXE files found on the infected computer and
attempts to spread to remote network shares with weak passwords.
The virus includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Looked-BE copies itself to
<Windows>\uninstall\rundl132.exe and <Windows>\logo1_.exe and creates
<Windows>\Dll.dll, which is also detected as W32/Looked-BE.
Many files with the name "_desktop.ini" are also created, in various
folders on the infected computer. These files are harmless text files.
The following registry entry is created to run rundl132.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\uninstall\rundl132.exe
Registry entries are created under:
HKLM\SOFTWARE\Soft\DownloadWWW\
Name W32/Rbot-FYF
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Rbot.bpd
Prevalence (1-5) 2
Description
W32/Rbot-FYF is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-FYF spreads to other network computers by exploiting common
buffer
overflow vulnerabilities, including: LSASS (MS04-011), WebDav
(MS03-007) and
ASN.1 (MS04-007) and by copying itself to network shares protected by
weak
passwords.
W32/Rbot-FYF runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Rbot-FYF includes functionality to terminate anti-virus and
security
processes.
Advanced
W32/Rbot-FYF is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-FYF spreads to other network computers by exploiting common
buffer
overflow vulnerabilities, including: LSASS (MS04-011), WebDav
(MS03-007) and
ASN.1 (MS04-007) and by copying itself to network shares protected by
weak
passwords.
W32/Rbot-FYF runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
W32/Rbot-FYF includes functionality to terminate anti-virus and
security
processes.
When first run W32/Rbot-FYF copies itself to
<System>\ssvvcchhoosst.exe.
The following registry entries are created to run ssvvcchhoosst.exe
on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows Services Edt
ssvvcchhoosst.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Windows Services Edt
ssvvcchhoosst.exe
The following registry entries are set:
HKLM\SOFTWARE\Microsoft\Ole\Microsoft Windows Services Edt
ssvvcchhoosst.exe
HKLM\SYSTEM\ControlSet002\Control\Lsa\Microsoft Windows Services Edt
ssvvcchhoosst.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Microsoft Windows Services
Edt
ssvvcchhoosst.exe
Name Troj/Sharp-T
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Sharp-T is a Trojan for the Windows platform.
Advanced
Troj/Sharp-T is a Trojan for the Windows platform.
When first run Troj/Sharp-T copies itself to
<Windows>\pchealth\csrss.exe and creates the file
<System>\drivers\oreans32.sys.
The file oreans32.sys is a component of a legitimate copy protection
mechanism. It is not malicious.
The following registry entry is created to run Troj/Sharp-T on startup:
HKLM\SOFTWARE\Microsoft\Active Setup\Installed
Components\{7DBBF5D8-5A0A-BA74-4E42-16BE17881CBC}
stubpath
<Windows>\pchealth\csrss.exe s
The file oreans32.sys is registered as a new system driver service
named "oreans32", with a display name of "oreans32". Registry entries
are created under:
HKLM\SYSTEM\CurrentControlSet\Services\oreans32
Registry entries are also created under:
HKCU\Software\Windows Update
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|