Text 49, 1834 rader
Skriven 2005-07-03 01:13:00 av KURT WISMER (1:123/140)
Ärende: News, July 3 2005
=========================
[copy-n-paste from sophos.com]
Name W32/Mytob-BY
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
Aliases
* Net-Worm.Win32.Mytob.bi
* WORM_MYTOB.GN
Prevalence (1-5) 2
Description
W32/Mytob-BY is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-BY can spread by sending itself as an email attachment to
email addresses it harvests from the infected computer, either as an
attachment with a double-extension or as a zip file containing a file
with a double-extension. W32/Mytob-BY avoids sending emails to addresses
containing certain strings in them.
W32/Mytob-BY processes the emails it has harvested by splitting them
into name and domain. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested
domains. W32/Mytob-BY spoofs the sender, sending emails as if from one
of the following at the same domain as the recipient:
support
administrator
mail
service
admin
info
register
webmaster
For example if sending itself to name@example.com, W32/Mytob-BY might
send the email as if from admin@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text - a formatted version of one of the following:
Dear user <recipient's username>,
You have successfully updated the password of your <recipient's domain>
account.
If you did not authorize this change or if you need assistance with your
account, please contact <recipient's domain> customer service at:
<spoofed sender address>
Thank you for using <recipient's domain>!
The <recipient's domain> Support Team <BR>
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear user <recipient's username>,
It has come to our attention that your <recipient's domain> User Profile
( x ) records are out of date. For further details see the attached
document.
Thank you for using <recipient's domain>!
The <recipient's domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear <recipient's username> Member,
We have temporarily suspended your email account <recipient's domain>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our processors.
See the details to reactivate your <recipient's domain> account.
Sincerely,The <recipient's domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear <recipient's domain> Member,
Your e-mail account was used to send a huge amount of unsolicited spam
messages during the recent week. If you could please take 5-10 minutes
out of your online experience and confirm the attached document so you
will not run into any future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <recipient's domain> Support Team
+++ Attachment: No Virus found
+++ <recipient's domain> Antivirus - www.<recipent's domain>
Attachment name:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
First extension (of attachment or of file inside zip):
doc
htm
txt
Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat
If the attachment is a zip file it will have the same base name as the
double-extension file inside.
Example attachment names include document.txt.pif and
information.doc.cmd, usually with a large number of spaces between the
extensions.
Advanced
W32/Mytob-BY is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-BY runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels, including the ability to download and
execute files on the infected computer.
W32/Mytob-BY can spread by sending itself as an email attachment to
email addresses it harvests from the infected computer, either as an
attachment with a double-extension or as a zip file containing a file
with a double-extension. W32/Mytob-BY avoids sending emails to addresses
containing certain strings in them.
W32/Mytob-BY processes the emails it has harvested by splitting them
into name and domain. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested domains.
W32/Mytob-BY spoofs the sender, sending emails as if from one of the
following at the same domain as the recipient:
support
administrator
mail
service
admin
info
register
webmaster
For example if sending itself to name@example.com, W32/Mytob-BY might
send the email as if from admin@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text - a formatted version of one of the following:
Dear user <recipient's username>,
You have successfully updated the password of your <recipient's domain>
account.
If you did not authorize this change or if you need assistance with your
account, please contact <recipient's domain> customer service at:
<spoofed sender address>
Thank you for using <recipient's domain>!
The <recipient's domain> Support Team <BR>
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear user <recipient's username>,
It has come to our attention that your <recipient's domain> User Profile
( x ) records are out of date. For further details see the attached
document.
Thank you for using <recipient's domain>!
The <recipient's domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear <recipient's username> Member,
We have temporarily suspended your email account <recipient's domain>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our processors.
See the details to reactivate your <recipient's domain> account.
Sincerely,The <recipient's domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <recipient's domain> Antivirus - www.<recipient's domain>
Dear <recipient's domain> Member,
Your e-mail account was used to send a huge amount of unsolicited spam
messages during the recent week. If you could please take 5-10 minutes
out of your online experience and confirm the attached document so you
will not run into any future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <recipient's domain> Support Team
+++ Attachment: No Virus found
+++ <recipient's domain> Antivirus - www.<recipent's domain>
Attachment name:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
First extension (of attachment or of file inside zip):
doc
htm
txt
Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat
If the attachment is a zip file it will have the same base name as the
double-extension file inside.
Example attachment names include document.txt.pif and
information.doc.cmd, usually with a large number of spaces between the
extensions.
W32/Mytob-BY copies itself to the Window system folder with the filename
nibie.exe or skybotx.exe and sets the following registry entries to run
itself on system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
WINDOWS SYSTEM =
<worm filename>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
WINDOWS SYSTEM =
<worm filename>
W32/Mytob-BY sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
W32/Mytob-BY attempts to terminate a large number of processes related
to security and anti-virus programs including REGEDIT.EXE, MSCONFIG.EXE
and NETSTAT.EXE.
W32/Mytob-BY modifies the Windows hosts file in order to block access to
the following security-related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com
Name Troj/BagleDl-R
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Modifies data on the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Bagle.bq
Prevalence (1-5) 2
Description
Troj/BagleDl-R is a downloader Trojan which will download, install and
run new software without notification that it is doing so.
Troj/BagleDl-R includes functionality to:
- inject its code into EXPLORER.EXE
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security
related applications
Troj/BagleDl-R then attempts to download files from remote websites and
run them.
Troj/BagleDl-R may also run MSPAINT.EXE in an attempt to obfuscate
itself.
Advanced
Troj/BagleDl-R is a downloader Trojan which will download, install and
run new software without notification that it is doing so.
Troj/BagleDl-R includes functionality to:
- inject its code into EXPLORER.EXE
- modify the HOSTS file
- disable other software, including anti-virus, firewall and security
related applications
When first run Troj/BagleDl-R copies itself to <System>\winshost.exe and
creates the file <System>\wiwshost.exe. The file <System>\wiwshost.exe is
also detected by Sophos as Troj/BagleDl-R.
The following registry entries are created to run winshost.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
winshost.exe
<System>\winshost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winshost.exe
<System>\winshost.exe
Registry entries are set as follows:
HKLM\SYSTEM\CurrentControlSet\Services\Alerter
Start
00000004
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
00000004
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
00000004
Troj/BagleDl-R creates a new version of the HOSTS file. The new HOSTS
file will typically contain the following:
127.0.0.1 localhost
Troj/BagleDl-R also attempts to modify or delete the following registry
entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Symantec NetDriver Monitor
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ccApp
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV CfgWiz
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SSC_UserPrompt
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
McAfee Guardian
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
McAfee.InstantUpdate.Monitor
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
APVXDWIN
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KAV50
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avg7_cc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avg7_emc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Zone Labs Client
HKLM\SOFTWARE\Symantec
HKLM\SOFTWARE\McAfee
HKLM\SOFTWARE\KasperskyLab
HKLM\SOFTWARE\Agnitum
HKLM\SOFTWARE\Panda Software
HKLM\SOFTWARE\Zone Labs
Troj/BagleDl-R then attempts to download files from remote websites and
run them.
Troj/BagleDl-R may also run MSPAINT.EXE in an attempt to obfuscate
itself.
Name W32/Sdbot-AYF
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
* Drops more malware
Prevalence (1-5) 2
Description
W32/Sdbot-AYF is a network worm with backdoor Trojan functionality for
the Windows platform.
The worm spreads through network shares protected by weak passwords,
MS-SQL servers and through various operating system vulnerabilities.
W32/Sdbot-AYF connects to a predetermined IRC channel and awaits further
commands from remote users.
Patches for the vulnerabilities exploited by W32/Sdbot-AYF can be
obtained from Microsoft at:
MS02-039
MS04-011
MS04-012
Advanced
W32/Sdbot-AYF is a network worm with backdoor Trojan functionality for
the Windows platform.
When first run, W32/Sdbot-AYF copies itself to the Windows system folder
as WinAwk.exe, drops a driver file named rdriv.sys and creates the
following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinAwk
"WinAwk.exe"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RDRIV
[several entries]
HKLM\SYSTEM\CurrentControlSet\Services\rdriv
[several entries]
HKLM\SYSTEM\CurrentControlSet\Control
WaitToKillServiceTimeout
"7000"
The rdriv.sys file dropped by W32/Sdbot-AYF is detected by Sophos's
anti-virus products as Troj/Rootkit-X.
The worm spreads through network shares protected by weak passwords,
MS-SQL servers and through various operating system vulnerabilities.
W32/Sdbot-AYF connects to a predetermined IRC channel and awaits further
commands from remote users. The backdoor component of W32/Sdbot-AYF can
be instructed to perform the following functions:
scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server
Patches for the vulnerabilities exploited by W32/Sdbot-AYF can be
obtained from Microsoft at:
MS02-039
MS04-011
MS04-012
Name W32/Traxg-B
Type
* Worm
How it spreads
* Email messages
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
* Installs itself in the Registry
Aliases
* WORM_VB.F
Prevalence (1-5) 2
Description
W32/Traxg-B is a worm that attempts to spread using Microsoft Outlook.
W32/Traxg-B may create the file C:\folder.htt. This file may be deleted.
Advanced
W32/Traxg-B is a worm that attempts to spread using Microsoft Outlook.
W32/Traxg-B copies itself to several locations using randomly generated
filenames and creates the following registry entry in order to run on
Windows startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TempCom
W32/Traxg-B may set the following registry entries in order to modify
the behaviour of Windows Explorer:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Hidden = 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
HideFileExt = 1
W32/Traxg-B may create the file c:\folder.htt. This file may be deleted.
Name Troj/Insor-B
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Dropper.Win32.Small.aay
* Downloader-ACG
Prevalence (1-5) 2
Description
Troj/Insor-B is a downloader and proxy Trojan.
When run the Trojan drops iedld32.dll into the Windows system folder and
loads it.
Troj/Insor-B can be given a command to download and run an executable or
provide a proxy connection on a random port.
Advanced
Troj/Insor-B is a downloader and proxy Trojan.
When run the Trojan drops iedld32.dll into the Windows system folder and
loads it.
When there is an active internet connection Troj/Insor-B notifies a
remote server that it is active and waits for a command.
Troj/Insor-B can be given a command to download and run an executable or
provide a proxy connection on a random port.
Troj/Insor-B will create the following registry entries so as to
auto-load:
HKCR\CLSID\(114C670C-C510-4F49-B431-4B812F50BA7B)\InprocServer32
(default)
"<System>\iedld32.dll"
Name Troj/Zlob-K
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Zlob.s
* Downloader-XC
* Trojan.Zlob.B
Prevalence (1-5) 2
Description
Troj/Zlob-K is a downloader Trojan.
Troj/Zlob-K will contact predefined remote sites and download data. The
Trojan may then download further executable files and run them.
Advanced
Troj/Zlob-K is a downloader Trojan.
Troj/Zlob-K will contact predefined remote sites and download data. The
Trojan may then download further executable files and run them.
In order to run automatically each time Explorer initializes,
Troj/Zlob-K will set the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
notepad.exe
msmsgs.exe
In order to run automatically each time a user logs in, Troj/Zlob-K will
add MSMSGS.EXE to the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Troj/Zlob-K will attempt to hide its activity by injecting code into
EXPLORER.EXE.
Name W32/Kelvir-CB
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Aliases
* IM-Worm.Win32.Kelvir.cb
Prevalence (1-5) 2
Description
W32/Kelvir-CB is an instant messaging worm for the Windows platform.
Advanced
W32/Kelvir-CB is an instant messaging worm for the Windows platform.
W32/Kelvir-CB monitors the status of all Windows Messenger contacts and
sends the following text to all online contacts:
Doesnt this kind of look like you?
http://[DOMAIN REMOVED]/pics.php?id=345&pic=4565.jpg
At the time of writing, the link referenced in the message text was
unavailable.
Name Troj/Multidr-DQ
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Multidr-DQ is a Trojan for the Windows platform.
Troj/Multidr-DQ drops several files and then runs them. The dropped
files are detected by Sophos's anti-virus products as Troj/Prorat-19 or
Troj/Bckdr-CKA.
Advanced
Troj/Multidr-DQ is a Trojan for the Windows platform.
When run, Troj/Multidr-DQ drops the following files and then runs them:
\Windows\ktd32.atm
\Windows\plugin1.dat
\Windows\services.exe
\Windows\system\sservice.exe
\Windows\system32\fservice.exe
\Windows\system32\lncom_.exe
\Windows\system32\reginv.dll
\Windows\system32\winkey.dll
\Windows\transliator.exe
The dropped files are detected by Sophos's anti-virus products as
Troj/Prorat-19 (services.exe, sservice.exe, fservice.exe, reginv.dll and
winkey.dll) or Troj/Bckdr-CKA (lncom_.exe and transliator.exe). The
ktd32.atm and plugin1.dat files are harmless data files and may be
safely deleted.
Name W32/Codbot-AG
Type
* Worm
How it spreads
* Network shares
* Web downloads
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
* Downloads code from the internet
Aliases
* WORM_SDBOT.BLH
* Backdoor.Win32.Codbot.ag
* W32.Toxbot
Prevalence (1-5) 2
Description
W32/Codbot-AG is a network worm with backdoor functionality for the
Windows platform.
W32/Codbot-AG can spread to remote network shares protected by weak
passwords and to computers vulnerable to common exploits, including the
RPC-DCOM, LSASS and MSSQL vulnerabilities.
W32/Codbot-AG can be controlled by a remote attacker via the IRC
network. The attacker can issue commands to download and run further
malicious code, steal passwords and system information and sniff packets
from the local network.
Advanced
W32/Codbot-AG is a network worm with backdoor functionality for the
Windows platform.
W32/Codbot-AG can spread to remote network shares protected by weak
passwords and to computers vulnerable to common exploits, including the
RPC-DCOM, LSASS and MSSQL vulnerabilities. The following patches for the
operating system vulnerabilities exploited by W32/Codbot-AG can be
obtained from the Microsoft website:
MS02-039
MS04-011
MS04-012
W32/Codbot-AG can be controlled by a remote attacker via the IRC network.
The attacker can issue commands to download and run further malicious
code, steal passwords and system information and sniff packets from the
local network.
W32/Codbot-AG copies itself to the Windows system folder with the
filename dhcpclient.exe.
On NT-based versions of Windows (NT,2000,XP) the worm registers itself
as a service process named Ulead Service with a displayname of DHCP
Client and a start-type of automatic so that the worm is run on computer
login. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP_CLIENT
<several entries>
HKLM\SYSTEM\CurrentControlSet\Services\DHCP Client
<several entries>
W32/Codbot-AG also creates the following registry entries in order to
run as a service process in safe mode:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client
(default)
Service
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DHCP Client
(default)
Service
Name Troj/Banker-DV
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Steals credit card details
* Steals information
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banker.cv
Prevalence (1-5) 2
Description
Troj/Banker-DV is a password-stealing Trojan targeted at customers of
Brazilian banks.
Troj/Banker-DV may display a fake error message containing the following
text:
Erro de aplicativo
Aplicativo nao inicializado corretamente (0xc0000005). Clique em OK para
finalizar a execucao
Advanced
Troj/Banker-DV is a password-stealing Trojan targeted at customers of
Brazilian banks.
Troj/Banker-DV will monitor a user's internet access. When certain
internet banking sites are visited, the Trojan will display a fake login
screen in order to trick the user into inputting their details.
Troj/Banker-DV will then send the stolen details to a remote location.
Troj/Banker-DV may display a fake error message containing the following
text:
Erro de aplicativo
Aplicativo nao inicializado corretamente (0xc0000005). Clique em OK para
finalizar a execucao
When first run, Troj/Banker-DV will copy itself to <System>\winlogin.exe
In order to run automatically each time a user logs in, Troj/Banker-DV
will set the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
<System>\winlogin.exe
Name Troj/Psyme-CA
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Exploits system or software vulnerabilities
Aliases
* Trojan-Downloader.VBS.Psyme.q
* VBS/Psyme
* CHM_PSYME.AG
Prevalence (1-5) 2
Description
Troj/Psyme-CA is an HTML-based script which exploits the XMLHTTP and
ADODB Stream vulnerabilities associated with Microsoft Internet Explorer
to download and run an executable file.
Advanced
Troj/Psyme-CA is an HTML-based script which exploits the XMLHTTP and
ADODB Stream vulnerabilities associated with Microsoft Internet Explorer
to download and run an executable file.
On Windows 98 the Trojan will save the downloaded file to C:\qwe.exe, on
Windows 2000 the file will be downloaded to C:\Documents and
Settings\All Users\Start Menu\Programs\Startup\qwe.exe, and under
Windows 95, ME, NT, and XP the file will be downloaded and saved over
Windows Media Player if it exists at any of the following locations:
C:\Programmer\Windows Media Player\wmplayer.exe
C:\Program\Windows Media Player\wmplayer.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Programfiler\Windows Media Player\wmplayer.exe
C:\Programas\Windows Media Player\wmplayer.exe
C:\Programa1s\Windows Media Player\wmplayer.exe
C:\Archivos de programa\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
Name W32/Rbot-AGP
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Downloads code from the internet
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Backdoor.Win32.IRCBot.cj
* W32/Sdbot.worm.gen.bj
Prevalence (1-5) 2
Description
W32/Rbot-AGP is a worm with backdoor functionality for the Windows
platform that spreads to other network computers by exploiting a number
of known vulnerabilities and by copying itself to network shares
protected by weak passwords.
Advanced
W32/Rbot-AGP is a worm with backdoor functionality for the Windows
platform that spreads to other network computers by exploiting a number
of known vulnerabilities and by copying itself to network shares
protected by weak passwords.
W32/Rbot-AGP runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
W32/Rbot-AGP includes functionality to access the internet and
communicate with a remote server via HTTP.
Once executed W32/Rbot-AGP moves itself to the file <Windows system
folder>\scrnsaver.scr, and in order to be able to run automatically when
Windows starts up sets the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Screen Saver
scrnsaver.scr
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Screen Saver
scrnsaver.scr
When W32/Rbot-AGP is installed it creates the file <Windows system
folder>\svkp.sys which is a legitimate driver for NT based systems.
The file SVKP.sys is registered as a new system driver service named
"SVKP", with a display name of "SVKP" and a startup type of automatic,
so that it is started automatically during system startup. Registry
entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\SVKP\
Name Troj/Bancb-Fam
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Steals credit card details
* Turns off anti-virus applications
* Steals information
* Uses its own emailing engine
* Records keystrokes
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Bancb-Fam detects members of the Bancban family of Trojans. Members
of this family typically attempt to steal confidential information when
a user visits banking-related websites.
Advanced
Troj/Bancb-Fam detects members of the Bancban family of Trojans. Members
of this family typically attempt to steal confidential information when
a user visits banking-related websites.
Trojans of this family typically monitor URLs entered into Internet
Explorer. When certain websites are visited, the Trojan may display a
fake user interface in order to trick the user into entering
confidential details. Stolen information is sent by email to a remote
user.
Typically a registry entry is created in order to run the Trojan on
system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
<Trojan filename excluding extension>
<Path to Trojan>
Name W32/Rbot-AGQ
Type
* Worm
Prevalence (1-5) 2
Description
W32/Rbot-AGQ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGQ spreads by copying itself to network shares protected by
weak passwords.
W32/Rbot-AGQ runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
W32/Rbot-AGQ includes functionality to:
- steal confidential information
- carry out DDoS flooder attacks
- silently download, install and run new software, including updates of
its software
Advanced
W32/Rbot-AGQ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGQ spreads by copying itself to network shares protected by
weak passwords.
W32/Rbot-AGQ runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
W32/Rbot-AGQ includes functionality to:
- steal confidential information
- carry out DDoS flooder attacks
- silently download, install and run new software, including updates of
its software
When first run W32/Rbot-AGQ copies itself to <System>\syscfg.exe.
The following registry entries are created to run syscfg.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
System Support
syscfg.exe
Name W32/Codbot-Gen
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Sophos Anti-Virus products detect members of the W32/Codbot family of
worms as W32/Codbot-Gen.
Worms detected as W32/Codbot-Gen provide backdoor Trojan functionality
to a remote attacker via IRC channels. Such worms may spread to remote
network shares with weak passwords in response to a command from a
remote attacker.
Members of W32/Codbot family typically attempt to exploit
vulnerabilities, such as the LSASS vulnerability (MS04-011).
Advanced
Sophos Anti-Virus products detect members of the W32/Codbot family of
worms as W32/Codbot-Gen.
Worms detected as W32/Codbot-Gen provide backdoor Trojan functionality
to a remote attacker via IRC channels. Such worms may spread to remote
network shares with weak passwords in response to a command from a
remote attacker.
Members of W32/Codbot family may copy themselves to the Windows system
folder and create entries in the following registry entries to run
themselves when the user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
This backdoor functionality typically includes the ability to sniff
packets, download further malicious code and steal passwords and other
system information.
W32/Codbot worms may register themselves as service processes.
Members of W32/Codbot family typically attempt to exploit
vulnerabilities, such as the LSASS vulnerability (MS04-011).
Name W32/Mytob-CT
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
Aliases
* Net-Worm.Win32.Mytob.gen
Prevalence (1-5) 2
Description
W32/Mytob-CT is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-CT can spread by sending itself as an email attachment to
email addresses it harvests from the infected computer, either as an
attachment with a double-extension or as a zip file containing a file
with a double-extension. W32/Mytob-CT avoids sending emails to addresses
containing certain strings in them.
W32/Mytob-CT processes the emails it has harvested by splitting them
into name and domain. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested
domains. W32/Mytob-CT spoofs the sender, sending emails as if from one
of the following at the same domain as the recipient:
support
administrator
mail
service
admin
info
register
webmaster
For example if sending itself to name@example.com, W32/Mytob-CT might
send the email as if from admin@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Security measures
Email Account Suspension
Notice of account limitation
Message body - one of the following or a garbled message:
Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.
The original message has been included as an attachment.
We regret to inform you that your account has been suspended due to the
violation of our site policy, more info is attached.
We attached some important information regarding your account.
Please read the attached document and follow it's instructions.
Attachment name:
email-info
email-doc
information
account-details
document
INFO
instructions
info-text
information
First extension (of attachment or of file inside zip):
doc
htm
txt
Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat
If the attachment is a zip file it will have the same base name as the
double-extension file inside.
Example attachment names include document.txt.pif and
information.doc.cmd, usually with a large number of spaces between the
extensions.
Advanced
W32/Mytob-CT is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-CT runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels, including the ability to download and
execute files on the infected computer.
W32/Mytob-CT can spread by sending itself as an email attachment to
email addresses it harvests from the infected computer, either as an
attachment with a double-extension or as a zip file containing a file
with a double-extension. W32/Mytob-CT avoids sending emails to addresses
containing certain strings in them.
W32/Mytob-CT processes the emails it has harvested by splitting them
into name and domain. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested
domains. W32/Mytob-CT spoofs the sender, sending emails as if from one
of the following at the same domain as the recipient:
support
administrator
mail
service
admin
info
register
webmaster
For example if sending itself to name@example.com, W32/Mytob-CT might
send the email as if from admin@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Security measures
Email Account Suspension
Notice of account limitation
Message body - one of the following or a garbled message:
Once you have completed the form in the attached file , your account
records will not be interrupted and will continue as normal.
The original message has been included as an attachment.
We regret to inform you that your account has been suspended due to the
violation of our site policy, more info is attached.
We attached some important information regarding your account.
Please read the attached document and follow it's instructions.
Attachment name:
email-info
email-doc
information
account-details
document
INFO
instructions
info-text
information
First extension (of attachment or of file inside zip):
doc
htm
txt
Second extension (of attachment or of file inside zip):
pif
scr
exe
cmd
bat
If the attachment is a zip file it will have the same base name as the
double-extension file inside.
Example attachment names include document.txt.pif and
information.doc.cmd, usually with a large number of spaces between the
extensions.
W32/Mytob-CT copies itself to the Window system folder with the filename
"Lien Vande Kelder.exe" and sets the following registry entries to run
itself on system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
http://www.lienvandekelder.be =
"Lien Vande Kelder.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
http://www.lienvandekelder.be =
"Lien Vande Kelder.exe"
W32/Mytob-CT sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
W32/Mytob-CT attempts to terminate a large number of processes related
to security and anti-virus programs including REGEDIT.EXE, MSCONFIG.EXE
and NETSTAT.EXE.
W32/Mytob-CT modifies the Windows hosts file in order to block access to
the following security-related websites:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 easydedicated.com
127.0.0.1 www.easydedicated.com
127.0.0.1 easydedicated.net
127.0.0.1 www.easydedicated.net
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
Name W32/Rbot-AGT
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
Prevalence (1-5) 2
Description
W32/Rbot-AGT is a network worm with backdoor functionality for the
Windows platform.
W32/Rbot-AGT spreads using a variety of techniques including exploiting
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS and WKS) and using backdoors
opened by other worms or Trojans.
W32/Rbot-AGT can be controlled by a remote attacker over IRC channels.
Advanced
W32/Rbot-AGT is a network worm with backdoor functionality for the
Windows platform.
The worm copies itself to a file named scrsave.scr in the Windows system
folder and creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MS Screen Saver
scrsave.scr
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS Screen Saver
scrsave.scr
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
MS Screen Saver
scrsave.scr
W32/Rbot-AGT spreads using a variety of techniques including exploiting
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS and WKS) and using backdoors
opened by other worms or Trojans.
W32/Rbot-AGT can be controlled by a remote attacker over IRC channels.
The backdoor component of W32/Rbot-AGT can be instructed by a remote
user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software
Patches for the operating system vulnerabilities exploited by
W32/Rbot-AGT can be obtained from Microsoft at:
MS01-059
MS03-007
MS03-049
MS04-011
MS04-012
Name W32/Rbot-AGI
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Agobot.xb
Prevalence (1-5) 2
Description
W32/Rbot-AGI is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGI runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
W32/Rbot-AGI can spread to remote network shares protected by weak
passwords and to computers vulnerable to common exploits, including
LSASS (MS04-011). For a patch for this vulnerability, see:
MS04-011
Advanced
W32/Rbot-AGI is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGI runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer via IRC channels.
W32/Rbot-AGI can spread to remote network shares protected by weak
passwords and to computers vulnerable to common exploits, including
LSASS (MS04-011). For a patch for this vulnerability, see:
MS04-011
W32/Rbot-AGI copies itself to the Windows system folder with a random
filename and sets the following registry entries in order to run
automatically on computer login:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win Secure Update
<path to worm>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win Secure Update
<path to worm>
Name Troj/Banker-EB
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Steals credit card details
* Steals information
Aliases
* Trojan-Downloader.Win32.Small.ayu
Prevalence (1-5) 2
Description
Troj/Banker-EB is a password stealing Trojan for the Windows platform.
Troj/Banker-EB collects data sent to banking sites in Internet Explorer
sessions.
Advanced
Troj/Banker-EB is a password stealing Trojan for the Windows platform.
Troj/Banker-EB collects data sent to banking sites in Internet Explorer
sessions.
Troj/Banker-EB may set several registry entries under
HKCR\CLSID\(e3175614-f331-f31a-53ed-fdd682644311).
Name Troj/ByteVeri-M
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Exploits system or software vulnerabilities
Aliases
* Exploit-ByteVerify
* JAVA_BYTEVER.Q
* Trojan.Java.ClassLoader.ai
Prevalence (1-5) 2
Description
Troj/ByteVeri-M is a Java Applet that exploits a vulnerability in the
Byte Code Verify component of the Microsoft VM to download and run an
executable file.
Advanced
Troj/ByteVeri-M is a Java Applet that exploits a vulnerability in the
Byte Code Verify component of the Microsoft VM to download and run an
executable file.
Troj/ByteVeri-M arrives by browsing websites whose pages contain applets
that use the Troj/ByteVeri-M class.
For more information about this exploit see the Microsoft Security
Bulletin MS03-011.
Name Troj/GrayBird-M
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Steals information
* Drops more malware
* Downloads code from the internet
* Reduces system security
Prevalence (1-5) 2
Description
Troj/GrayBird-M is a Trojan for the Windows platform.
The Trojan opens a backdoor allowing remote intruders access to the
infected computer. Troj/GrayBird-M may also attempt to download and
execute files from a remote site.
Advanced
Troj/GrayBird-M is a Trojan for the Windows platform.
The Trojan opens a backdoor allowing remote intruders access to the
infected computer. Troj/GrayBird-M may also attempt to download and
execute files from a remote site.
When run, Troj/GrayBird-M copies itself to the Windows folder as
yak_tw.exe and drops a file as yak_tw.dll to the same location. The
Trojan registers itself as a service process with the display name "yak
tw" and sets registry entries under the following:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_YAK_TW
HKLM\SYSTEM\ControlSet001\Services\yak tw
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|