Text 192, 1293 rader
Skriven 2007-06-10 19:26:00 av KURT WISMER
Ärende: News, June 10 2007
==========================
[cut-n-paste from sophos.com]
Name W32/VB-DVR
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/VB-DVR is a worm for the Windows platform.
W32/VB-DVR may attempt to spread by copying itself to removable
drives and creating an autorun.inf file to enable the worm copy to be
run.
Advanced
W32/VB-DVR is a worm for the Windows platform.
W32/VB-DVR may attempt to spread by copying itself to removable
drives and creating an autorun.inf file to enable the worm copy to be
run.
W32/VB-DVR may copy itself to the following filename:
C:\Windows\Web\Sys.exe
and create the following file:
C:\Windows\System32\KillAll.bat - may be deleted
W32/VB-DVR may delete the following file:
C:\Windows\System32\WinWare.sys
The worm creates the following registry entries:
HKCU\Software\Policies\Microsoft\Windows\System
DisableCMD
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NoooH
C:\windows\web\sys.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableSR
1
Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
Name Troj/Zapchas-DC
Type
* Trojan
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
Troj/Zapchas-DC is a Trojan for the Windows platform.
Advanced
Troj/Zapchas-DC is a Trojan for the Windows platform.
When first run the Trojan installs the following files:
<System>\hhdfdf\704.reg
<System>\hhdfdf\d.dll
<System>\hhdfdf\download
<System>\hhdfdf\g.exe
<System>\hhdfdf\ksomk
<System>\hhdfdf\l4m1.bmp
<System>\hhdfdf\l4m2.bmp
<System>\hhdfdf\l4m3.bmp
<System>\hhdfdf\l4m3r.exe
<System>\hhdfdf\l4m4.bmp
<System>\hhdfdf\l4m5.bmp
<System>\hhdfdf\l4m6.bmp
<System>\hhdfdf\l4m7.bmp
<System>\hhdfdf\l4m8.bmp
<System>\hhdfdf\l4m9.bmp
<System>\hhdfdf\lam1.exe
<System>\hhdfdf\lam2.exe
<System>\hhdfdf\lam3.exe
<System>\hhdfdf\lam4.exe
<System>\hhdfdf\lam5.exe
<System>\hhdfdf\logs
<System>\hhdfdf\mirc.ini
<System>\hhdfdf\msn.dll
<System>\hhdfdf\nm
<System>\hhdfdf\ournik
<System>\hhdfdf\sounds
<System>\hhdfdf\systemac.dll
<System>\hhdfdf\u
The files l4m1.bmp, l4m2.bmp, l4m3.bmp, l4m4.bmp, l4m5.bmp, l4m6.bmp,
l4m7.bmp, l4m8.bmp, l4m9.bmp are detected as Troj/Progent-AF.
The files lam2.exe is detected as daSniff. The files lam3.exe and
lam4.exe are detected as HideWindow. The file lam5.exe is detected as
NirPassView.
The file l4m3r.exe is the mIRC chat application.
Name Troj/Hazufa-A
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Hazufa-A is a Trojan for the Windows platform.
Advanced
Troj/Hazufa-A is a Trojan for the Windows platform.
Troj/Hazufa-A steals user keystrokes and button-presses and stores
them in the file <Windows>\offlog.txt.
When first run, Troj/Hazufa-A copies itself to <Windows>\svchost.exe
and creates the following registry entry to run itself on system
startup:
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\<clsid>
StubPath
<Windows>\svchost.exe
Troj/Hazufa-A may display a fake error message with the title
"CrossLowDetail: CrossLowDetail.exe - DLL nicht gefunden" and text
"Die Dynamic Link Liberty d3d9.dll wirde nicht im angegebenen Pfad
<path> gefunden." and attempt to launch a remote website in an
internet browser.
Name W32/Poebot-LR
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Prevalence (1-5) 2
Description
W32/Poebot-LR is a worm for the Windows platform.
Advanced
W32/Poebot-LR is a worm for the Windows platform.
When run, the worm copies itself to <System>\winamp.exe and
<System>\winIogon.exe
The following registry entry is created to run winIogon.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Logon Application
<System>\winIogon.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Logon Application
<System>\winamp.exe
Name Mal/Behav-116
Type
* Malicious Behavior
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
Mal/Behav-116 is a behavior found within malware.
Name W32/Stration-AP
Type
* Worm
How it spreads
* Email messages
* Network shares
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Warezov.nf
* Win32/Stration.YU
* WORM_STRAT.IM
Prevalence (1-5) 2
Description
W32/Stration-AP is a worm for the Windows platform.
W32/Stration-AP spreads via network shares and email messages.
Advanced
W32/Stration-AP is a worm for the Windows platform.
W32/Stration-AP spreads via network shares and email messages.
When first run W32/Stration-AP creates the following files:
\hotpmsta.exe - also detected as W32/Stration-AP
\mprmdpnm.dll - also detected as W32/Stration-AP
\apcunetu.dll - also detected as W32/Stration-AP
\sclgcert.exe - detected as W32/Stratio-FU
\hotpmsta.dat - DAT file, may be deleted safely.
and appends itself to the following registry entry to start itself:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
mprmdpnm.dll
Name Troj/NetVQ-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Installs itself in the Registry
Aliases
* Trojan.Win32.Agent.afg
* TROJ_AGENT.RCD
Prevalence (1-5) 2
Description
Troj/NetVQ-A is a Trojan for the Windows platform.
Advanced
Troj/NetVQ-A is a Trojan for the Windows platform.
Troj/NetVQ-A drops a file to <System>\<random characters>.dll,
detected as Troj/NetVQ-Gen, and installs it as a Layered Service
Provider (LSP), creating entries under the following location:
HKLM\SYSTEM\CurrentControlSet\Services
WinSock2
Name W32/Poebot-LQ
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Prevalence (1-5) 2
Description
W32/Poebot-LQ is a worm for the Windows platform.
Advanced
W32/Poebot-LQ is a worm for the Windows platform.
The worm has the functionality to spread via network shares.
When run the worm copies itself to <System>\winIogon.exe.
The following registry entry is created to run winIogon.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Logon Application
<System>\winIogon.exe
Name W32/Anis-B
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
W32/Anis-B is a worm for the Windows platform.
Advanced
W32/Anis-B is a worm for the Windows platform.
When first run W32/Anis-B copies itself to <Root>\pagefile.exe and
creates the following files:
<User>\Application Data\Microsoft\Internet Explorer\Quick
Launch\Internet Explorer.lnk
<Desktop>\Internet Explorer.lnk
<User>\Start Menu\Internet Explorer.lnk
<Root>\autorun.inf
The following registry entry is set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
{871C5380-42A0-1069-A2EA-08002B30309D}
1
W32/Anis-B attempts to periodically copy itself to removeable drives,
including floppy drives and USB keys. The worm will attempt to create
a hidden file Autorun.inf on the removeable drive and copy itself to
the same location. The file Autorun.inf is designed to start the worm
once the removeable drive is connected to a uninfected computer.
Name WM/Trugbar-B
Type
* Virus
How it spreads
* Infected files
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Deletes files off the computer
Prevalence (1-5) 2
Description
WM/Trugbar-B is a Microsoft Word Macro virus for the Windows platform.
Advanced
WM/Trugbar-B is a Macro virus for the Windows platform.
WM/Trugbar-B will attempt to infect other open documents, including
normal.dot.
On the 2nd and 18th days of the month, WM/Trugbar-B will attempt to
drop a file to:
<Windows>\System
TRUG.vbs
This file is detected as VBS/Trugbar-A.
Name Troj/Bifrose-UR
Type
* Trojan
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
Troj/Bifrose-UR is a Trojan for the Windows platform.
Name W32/Sdbot-DEW
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Scans network for weak passwords
Prevalence (1-5) 2
Description
W32/Sdbot-DEW is a worm with backdoor functionality for the Windows
platform.
Advanced
W32/Sdbot-DEW is a worm with backdoor functionality for the Windows
platform.
W32/Sdbot-DEW spreads to other network computers by exploiting common
buffer overflow vulnerabilities.
W32/Sdbot-DEW can be instructed to perform the following functions:
start an FTP server
start a Proxy server
start a web server
start an IRC daemon
take part in distributed denial of service (DDoS) attacks
log keypresses (such as username password)
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software
turn off security software such as anti-virus or firewall
The worm may also spread via networks shares protected by weak
passwords.
When first run W32/Sdbot-DEW copies itself to <Windows>\VTTimer.exe.
Registry entries are modified under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\winLogon
Name Troj/Agent-FTK
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
* Scans network for vulnerabilities
Aliases
* Trojan.Win32.Agent.vk
* W32/Agent.DID
* Win32/Spy.Agent.NCT
Prevalence (1-5) 2
Description
Troj/Agent-FTK is a Trojan for the Windows platform.
Advanced
Troj/Agent-FTK is a Trojan for the Windows platform.
Troj/Agent-FTK scans the network for Windows shares.
The following registry entry is created to run Troj/Agent-FTK on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ShareSearcher
<pathname of the Trojan executable>
Name W32/Tilebot-JT
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* W32/Sdbot.worm.gen.ce
* Backdoor.Win32.SdBot.bjd
Prevalence (1-5) 2
Description
W32/Tilebot-JT is an IRC backdoor worm for the Windows platform.
Advanced
W32/Tilebot-JT is an IRC backdoor worm for the Windows platform.
W32/Tilebot-JT runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-JT includes functionality to access the internet and
communicate with a remote server via HTTP.
W32/Tilebot-JT spreads
- to computers vulnerable to common exploits, including: RealVNC
(CVE-2006-2369)
- to MSSQL servers protected by weak passwords
- to network shares protected by weak passwords
W32/Tilebot-JT patches the Windows executable files ftp.exe and
tftp.exe so that they no longer function. W32/Tilebot-JT also patches
the Windows system file sfc_os.dll to disable Windows system file
checking.
When first run W32/Tilebot-JT copies itself to <Windows>\ctfmon.exe.
The file <Windows>\ctfmon.exe is registered as a new system driver
service named "Ctfmon", with a display name of "Alternative User
Input Services" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\Ctfmon
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d
Name Troj/SetCook-A
Type
* Trojan
Affected operating systems
* Windows
Aliases
* Trojan.Win32.Agent.anr
Prevalence (1-5) 2
Description
Troj/SetCook-A is a Trojan for the Windows platform.
Advanced
Troj/SetCook-A is a Trojan for the Windows platform.
When run Troj/SetCook-A quietly makes changes to registry entries
under:
HKCU\Software\Microsoft\AllowCookie\
Troj/SetCook-A also includes functionality to silently change privacy
zone settings.
Name W32/Baysur-A
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Drops more malware
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Baysur-A is a worm for the Windows platform.
W32/Baysur-A attempts to spread to removable drives by copying itself
to those drives and creating the file autorun.inf on them.
Advanced
W32/Baysur-A is a worm for the Windows platform.
W32/Baysur-A attempts to spread to removable drives by copying itself
to those drives and creating the file <Root>\autorun.inf on them. The
file autorun.inf is designed to execute the worm when the removeable
device is connected to an uninfected computer.
When first run the worm copies itself to the following locations:
<Root>\BIN.scr
<Root>\NV.scr
<Root>\powerarchiver.scr
<Root>\Recycled.scr
<Root>\Program Files.scr
<Root>\STARTUP.scr
<Root>\System Volume Information.scr
<Root>\Thumbs.com
<Root>\WINDOWS.scr
W32/Baysur-A creates the following files
<Root>\Autorun.inf
<Root>\Thumbs .db
<Windows>\Thumbs .db
<Startup>\Adobe Online.com
<Startup>\Adobe Update.com
<Startup>\Autoexec.bat
The following registry entries are set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
LegalNoticeCation
"<Random Text> - 24.01.2007 Surabaya"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
LegalNoticeText
"Surabaya in my birthday"
"Don't kill me, i'm just send message from your computer"
"Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku
sangat berarti"
"Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku"
"Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu,
hanyalah lamunan dalam sesal"
"Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0"
Name Troj/Zapchas-DD
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Zapchas-DD is a Trojan for the Windows platform.
Advanced
Troj/Zapchas-DD is a Trojan for the Windows platform.
When run Troj/Zapchas-DD creates the following files:
<System>\aliases.ini - can be safely removed
<System>\control.ini - can be safely removed
<System>\fullname.txt - can be safely removed
<System>\ident.txt - can be safely removed
<System>\mirc.ico - can be safely removed
<System>\mirc.ini - can be safely removed
<System>\nicks.txt - can be safely removed
<System>\popups.txt - can be safely removed
<System>\remote.ini - can be safely removed
<System>\script.ini - detected as Mal/Zapchas-B
<System>\servers.ini - can be safely removed
<System>\sup.bat - can be safely removed
<System>\sup.reg - can be safely removed
<System>\svchost.exe - detected as W32/Parite-B
<System>\users.ini - can be safely removed
The following registry entries are set:
HKCR\ChatFile\DefaultIcon
(default)
<System>\svchost.exe
HKCR\ChatFile\Shell\open\command
(default)
<System>\svchost.exe -noconnect
HKCR\ChatFile\Shell\open\ddeexec\Application
(default)
svchost
HKCR\ChatFile\Shell\open\ddeexec\Topic
(default)
Connect
HKCR\irc\DefaultIcon
(default)
<System>\svchost.exe
HKCR\irc\Shell\open\command
(default)
<System>\svchost.exe -noconnect
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GNP Generic Host Process
<System>\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC
DisplayName
mIRC
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC
UninstallString
<System>\svchost.exe " -uninstall"
Registry entries are created under:
HKCU\Software\Microsoft\Microsoft Agent
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKCR\.cha
HKCR\.chat
HKCR\ChatFile
HKCR\irc
Name W32/OutLaw-A
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/OutLaw-A is a worm for the Windows platform.
Advanced
W32/OutLaw-A is a worm for the Windows platform.
When first run W32/OutLaw-A copies itself to:
<RECYCLER>\systems.com
<System>\taskmger.com
The following registry entry is created to run systems.com rundll.exe
on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
userd
<RECYCLER>\systems.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
Explorer.exe taskmger.com
Registry Entries are modified under:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskmgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoFolderOptions
1
W32/OutLaw-A attempts to periodically copy itself to removeable
drives, including floppy drives and USB keys. The worm will attempt
to create a hidden file Autorun.inf on the removeable drive and copy
itself to the same location. The file Autorun.inf is designed to
start the worm once the removeable drive is connected to a uninfected
computer.
Name W32/Spybot-NU
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Mytobor.c
* W32/Sdbot.worm
Prevalence (1-5) 2
Description
W32/Spybot-NU is a worm with IRC backdoor functionality for the
Windows platform.
Advanced
W32/Spybot-NU is a worm with IRC backdoor functionality for the
Windows platform.
W32/Spybot-NU spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including RealVNC (CVE-2006-2369).
W32/Spybot-NU also spreads by copying itself to network shares.
W32/Spybot-NU runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Spybot-NU copies itself to
<System>\dllcache\upnt.exe.
The file upnt.exe is registered as a new system driver service named
"Universal Printer NT Service", with a display name of "Universal
Printer NT Service" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\Universal Printer NT Service
W32/Spybot-NU sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
Name Troj/Graybir-E
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
Aliases
* Backdoor.Win32.Agent.ahj
* Win32/Agent.NEO
Prevalence (1-5) 2
Description
Troj/Graybir-E is a backdoor Trojan for the Windows platform.
Name Troj/BankDL-CN
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/BankDL-CN is a Trojan for the Windows platform.
The Trojan includes functionality to access the internet and
communicate with a remote server via HTTP.
The file downloaded by the Trojan is detected as Troj/Bancos-BCU
Name W32/SillyFDC-AD
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* W32/Backdoor.AMMN
* Virus.Win32.VB.cl
* Win32/Brocat.E worm
Prevalence (1-5) 2
Description
W32/SillyFDC-AD is a worm with backdoor functionality for the Windows
platform.
W32/SillyFDC-AD spreads via removable storage devices.
W32/SillyFDC-AD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Advanced
W32/SillyFDC-AD is a worm with backdoor functionality for the Windows
platform.
W32/SillyFDC-AD spreads via removable storage devices.
W32/SillyFDC-AD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
When first run W32/SillyFDC-AD copies itself to:
<System>\My_Heart.exe
<System>\<Computer Name>\svchost.exe
and creates the following files:
<Temp>\<random characters>.tmp.
<current folder>\Autorun.inf
Both these files can be safely deleted.
The following registry entries are created to run W32/SillyFDC-AD on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
My_Heart
<System>\My_Heart.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
svchost<name of the worm executable>
<System>\<Computer Name>\svchost.exe
The worm may also change the computername by modifying the following
registry entry:
HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName
ComputerName
"Heart <username>"
HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
"Heart <username>"
Name W32/Lineage-AAB
Type
* Spyware Worm
How it spreads
* Removable storage devices
* Network shares
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Aliases
* Trojan-PSW.Win32.OnLineGames.dr
* W32/PWStealer.HYJ
* virus
Prevalence (1-5) 2
Description
W32/Lineage-AAB is a worm for the Windows platform.
Advanced
W32/Lineage-AAB is a worm for the Windows platform.
W32/Lineage-AAB spreads to other network computers. W32/Lineage-AAB
may copy itself to removable drives on the computer.
When first run W32/Lineage-AAB copies itself to:
<Root>\Shell.exe
<Windows>\help\4CE9831689C2.EXE
and creates the following files:
<Root>\autorun.inf
<Windows>\Deleteme.bat
<Windows>\help\4CE9831689C2.DLL
<Windows>\help\autorun.inf
The file 4CE9831689C2.DLL is detected as Mal/QQPass-B.
The file 4CE9831689C2.DLL is registered as a COM object and
ShellExecute hook, creating registry entries under:
HKCR\CLSID\{F75BA725-26A4-4F94-94EC-F6F6758ADA38}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHoo
ks
\{F75BA725-26A4-4F94-94EC-F6F6758ADA38
Name Troj/Clagger-BC
Type
* Trojan
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
Troj/Clagger-BC is a downloader Trojan for the Windows platform.
Name Troj/Zapchas-DE
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Zapchas-DE is a Trojan for the Windows platform.
Advanced
Troj/Zapchas-DE is a Trojan for the Windows platform.
When first run the Trojan installs the following files:
<System>/aliases.ini
<System>/control.ini
<System>/explorer.exe
<System>/mirc.ico
<System>/mirc.ini
<System>/nicks.txt
<System>/remote.ini
<System>/script.ini
<System>/servers.ini
<System>/sup.bat
<System>/sup.reg
<System>/users.ini
The file script.in is detected as Mal/Zapchas-B.
Other files installed by the Trojan are not harmful within themselves.
Name Troj/eAgent-D
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/eAgent-D is a spamming Trojan tool for the Windows platform,
providing functionality to act as an email spam proxy.
Advanced
Troj/eAgent-D is a spamming Trojan tool for the Windows platform,
providing functionality to act as an email spam proxy.
Troj/eAgent-D includes functionality to access the internet and
communicate with a remote server via HTTP.
When Troj/eAgent-D is installed the following files are created:
<System>\rsvp322.dll
<System>\sporder.dll
A clean copy of the Microsoft library DLL sporder.dll is installed to
the Windows system folder and is used to register the Troj/eAgent-C
DLL as a layered service provider (LSP), creating and modifying
registry entries in the Winsock 2 system configuration database under:
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters
Name Troj/Proxy-HT
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
Prevalence (1-5) 2
Description
Troj/Proxy-HT is a proxy Trojan for the Windows platform.
Advanced
Troj/Proxy-HT is a proxy Trojan for the Windows platform.
Troj/Proxy-HT runs continuously in the background, providing a proxy
server which allows remote users to access the web via the infected
computer, thus obscuring their own addresses.
When first run Troj/Proxy-HT copies itself to <Windows>\svchost.exe.
The following registry entries are created to run svchost.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Firewall
svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Firewall
svchost.exe
--- MultiMail/Win32 v0.43
* Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)
|