Text 76, 1395 rader
Skriven 2005-12-10 12:11:00 av KURT WISMER (1:123/140)
Ärende: News, December 10 2005
==============================
[cut-n-paste from sophos.com]
Name Troj/Danmec-F
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* MultiDropper-PH
* Trojan.Danmec
Prevalence (1-5) 3
Description
Troj/Danmec-F is a Trojan for the Windows platform.
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files.
Troj/Danmec-F displays a fake error message with the title
"Component not found"
and the message text
"Application can not run because vbrun64.dll not found"
Advanced
Troj/Danmec-F is a Trojan for the Windows platform.
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files.
Troj/Danmec-F displays a fake error message with the title
"Component not found"
and the message text
"Application can not run because vbrun64.dll not found".
When Troj/Danmec-F is installed the following files are created:
<Temp>\_uninsep.bat - may be safely deleted
<Windows system folder>\checkreg.exe - Troj/Danmec-F
<Windows system folder>\iisload.dll - Troj/Danmec-F
<Windows system folder>\s32l.txt - may be safely deleted
<Windows system folder>\ws386l.ini - may be safely deleted
<Windows system folder>\wsl6530.dll - Troj/Danmec-F
The following registry entry is created to run checkreg.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
<Windows system folder>\checkreg.exe
Name Troj/Brepbot-B
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Breplibot.m
* Backdoor.Ryknos
* W32/Brepibot
Prevalence (1-5) 2
Description
Troj/Brepbot-B is a backdoor Trojan for the Windows platform.
Advanced
Troj/Brepbot-B is a backdoor Trojan for the Windows platform.
When first run Troj/Brepbot-B copies itself to <System>\csrcmd.exe
and creates the following files:
<Temp>\466.bat
<Temp>\755.bat
These files can be safely deleted.
The following registry entries are created to run csrcmd.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WindowsTaskStat
csrcmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WindowsTaskStat
csrcmd.exe
Troj/Brepbot-B includes functionality to:
- terminate and disable anti-virus and security related processes
- download files from the internet and run them
Name Troj/Danmec-E
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* MultiDropper-PH
* Trojan.Danmec
Prevalence (1-5) 2
Description
Troj/Danmec-E is a Trojan for the Windows platform.
Troj/Danmec-E displays a fake error message with the title "Component
not found" and the message text "Application can not run because
vbreun64.dll not found".
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files.
Advanced
Troj/Danmec-E is a Trojan for the Windows platform.
Troj/Danmec-E displays a fake error message with the title "Component
not found" and the message text "Application can not run because
vbreun64.dll not found".
When Troj/Danmec-E is installed the following files are created:
<System>\checkreg.exe
<System>\wsl<randomnumbers>.dll
<System>\iisload.dll
<System>\s32l.txt
<System>\ws386l.ini
<Temp>\_uninsep.bat
The files checkreg.exe, wsl<randomnumbers>.dll and iisload.dll are
also detected as Troj/Danmec-E. The files s32l.txt and ws386l.ini are
clean data files, and the file _uninsep.bat is a clean file used to
delete components of Troj/Danmec-E.
The following registry entry is created to run checkreg.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
<System>\checkreg.exe
Troj/Danmec-E displays a fake error message with the title "Component
not found" and the message text "Application can not run because
vbreun64.dll not found".
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files.
Name Troj/Stinx-H
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Stinx-H is a Trojan for the Windows platform.
Advanced
Troj/Stinx-H is a Trojan for the Windows platform.
When first run Troj/Stinx-H copies itself to <System>\smszac32.exe
and creates the following files:
<Temp>\442.bat
<Temp>\952.bat
442.bat and 952.bat may both be deleted.
The following registry entries are created to run smszac32.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
DiskEventChk
smszac32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DiskEventChk
smszac32.exe
Troj/Stinx-H can be instructed to delete, execute, and download and
execute files.
Troj/Stinx-H will also try and circumvent the Windows Firewall if it
is present.
Name Troj/Bancban-KB
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banbra.df
Prevalence (1-5) 2
Description
Troj/Bancban-KB is a password stealing Trojan targeted at customers
of Brazilian banks.
Troj/Bancban-KB includes functionality to access the internet and
communicate with a remote server via HTTP.
The Trojan attempts to log keypresses entered into certain websites
and online banking applications. The Trojan may display fake user
interfaces in order to persuade the user to enter confidential
details. Stolen information is sent by email to a remote user.
Advanced
Troj/Bancban-KB is a password stealing Trojan targeted at customers
of Brazilian banks.
Troj/Bancban-KB includes functionality to access the internet and
communicate with a remote server via HTTP.
The Trojan attempts to log keypresses entered into certain websites
and online banking applications. The Trojan may display fake user
interfaces in order to persuade the user to enter confidential
details. Stolen information is sent by email to a remote user.
When Troj/Bancban-KB is installed it creates the file
<System>\imgrt.txt which is an image file and can be safely deleted.
Troj/Bancban-KB is usually located as the <System>\imgrt.scr file.
The following registry entry is created to run the Trojan on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
dark
<System>\imgrt.scr
Troj/Bancban-KB may create registry entries under the following entry:
HKCU\dark\
Name W32/Tilebot-BY
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Aimbot.bc
* W32/Sdbot.worm.gen.bh
Prevalence (1-5) 2
Description
W32/Tilebot-BY is a Trojan for the Windows platform.
W32/Tilebot-BY spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Tilebot-BY runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Tilebot-BY is a Trojan for the Windows platform.
W32/Tilebot-BY spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Tilebot-BY runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-BY includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-BY copies itself to the Windows system
folder.
W32/Tilebot-BY is registered as a new system driver service named
"winmngr", with a display name of "WinMan" and a startup type of
automatic, so that it is started automatically during system startup.
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\winmngr\
W32/Tilebot-BY sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Graybrd-AU
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Backdoor.Win32.GrayBird.bh
Prevalence (1-5) 2
Description
Troj/GrayBrd-AU is a Trojan for the Windows platform.
Troj/GrayBrd-AU includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/GrayBrd-AU is a Trojan for the Windows platform.
Troj/GrayBrd-AU includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/GrayBrd-AU copies itself to <Windows>\oyhskycn.scr.
The file oyhskycn.scr is registered as a new system driver service
named "nServersnhsgg", with a display name of "Serverckyysh" and a
startup type of automatic, so that it is started automatically during
system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\nServersnhsgg\
Name Troj/Danmec-G
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* MultiDropper-PH
Prevalence (1-5) 2
Description
Troj/Danmec-G is a Trojan for the Windows platform.
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files and retrieve information about
an infected system, including network details, and send these to a
remote intruder.
Troj/Danmec-G displays a fake error message with the title "Component
not found" and the message text "Application can not run because
vbrun64.dll not found".
Advanced
Troj/Danmec-G is a Trojan for the Windows platform.
The Trojan opens a port and offers remote attackers the ability to
route HTTP traffic through the infected computer. The Trojan may also
download and install additional files and retrieve information about
an infected system, including network details, and send these to a
remote intruder.
Troj/Danmec-G displays a fake error message with the title "Component
not found" and the message text "Application can not run because
vbrun64.dll not found".
When Troj/Danmec-G is installed the following files are created:
<System>\checkreg.exe - Troj/Danmec-G
<System>\iisload.dll - Troj/Danmec-G
<System>\s32l.txt - safe to delete
<System>\ws386l.ini - safe to delete
<System>\wsl6530.dll - Troj/Danmec-G
The following registry entry is created to run checkreg.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
<System>\checkreg.exe
Name W32/Mytob-GC
Type
* Worm
Affected operating systems
* Windows
Aliases
* Net-Worm.Win32.Mytob.gen
* W32/Mytob.gen@MM
Prevalence (1-5) 2
Description
W32/Mytob-GC is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-GC runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels, including the ability to
download and execute files on the infected computer.
W32/Mytob-GC processes the emails it has harvested by splitting them
into name and domain, avoiding sending emails to addresses containing
certain strings in them. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested
domains. W32/Mytob-GC spoofs the sender, sending emails as if from
the name "security" at the same domain as the recipient.
For example if sending itself to name@example.com, W32/Mytob-GC would
send the email as if from security@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Account Alert
ACCOUNT ALERT
Message text - a formatted version of the following:
Dear Valued Member,
According to our terms of services, you will have to confirm your
e-mail by the following link, or your account will be suspended
within 24 hours for security reasons.
http://www.<recipient's full
address>/confirm.php?account=<recipient's domain>
After following the instructions in the sheet, your account will not
be interrupted and will continue as normal.
Thanks for your attention to this request. We apologize for any
inconvenience.
Sincerely, <recipient's domain> Security Department
NB the link in the email actually points to a file
Confirmation_Sheet.pif at a remote location. If sending itself to
name@example.com, W32/Mytob-GC would format the fake link to appear
to be pointing at
http://www.name@example.com/confirm.php?account=example.com.
Advanced
W32/Mytob-GC is a mass-mailing worm and IRC backdoor Trojan.
W32/Mytob-GC runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels, including the ability to
download and execute files on the infected computer.
When first run W32/Mytob-GC attempts to copy itself to
<System>\netsvc.exe, although it is usually unsuccessful.
The following registry entries are created to run netsvc.exe on
startup, regardless of whether it was able to copy itself there
successfully:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Internet Services
netsvc.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Internet Services
netsvc.exe
W32/Mytob-GC sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
W32/Mytob-GC can spread by sending a link to a file at a remote
website to email addresses it harvests from the infected computer.
This remote file may be a copy of W32/Mytob-GC.
W32/Mytob-GC processes the emails it has harvested by splitting them
into name and domain, avoiding sending emails to addresses containing
certain strings in them. Once it has sent itself to the emails it has
harvested, it uses a predefined list of names with the harvested
domains. W32/Mytob-GC spoofs the sender, sending emails as if from
the name "security" at the same domain as the recipient.
For example if sending itself to name@example.com, W32/Mytob-GC would
send the email as if from security@example.com.
Emails sent by the worm have characteristics from the following:
Subject line:
Account Alert
ACCOUNT ALERT
Message text - a formatted version of the following:
Dear Valued Member,
According to our terms of services, you will have to confirm your
e-mail by the following link, or your account will be suspended
within 24 hours for security reasons.
http://www.<recipient's full
address>/confirm.php?account=<recipient's domain>
After following the instructions in the sheet, your account will not
be interrupted and will continue as normal.
Thanks for your attention to this request. We apologize for any
inconvenience.
Sincerely, <recipient's domain> Security Department
NB the link in the email actually points to a file
Confirmation_Sheet.pif at a remote location. If sending itself to
name@example.com, W32/Mytob-GC would format the fake link to appear
to be pointing at
http://www.name@example.com/confirm.php?account=example.com.
W32/Mytob-GC attempts to terminate a large number of processes
related to security and anti-virus programs including REGEDIT.EXE,
MSCONFIG.EXE and NETSTAT.EXE.
W32/Mytob-GC modifies the Windows hosts file in order to block access
to the following security-related websites:
127.0.0.1 www.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.norton.com
127.0.0.1 norton.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.drweb.com
127.0.0.1 drweb.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 www.avira.com
127.0.0.1 avira.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.bitdefender.com
127.0.0.1 bitdefender.com
127.0.0.1 www.cert.org
127.0.0.1 cert.org
127.0.0.1 www.nod32.com
127.0.0.1 nod32.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 www.clamav.net
127.0.0.1 clamav.net
127.0.0.1 www.quickheal.com
127.0.0.1 quickheal.com
127.0.0.1 www.avp.com
127.0.0.1 avp.com
127.0.0.1 www.avg.com
127.0.0.1 avg.com
127.0.0.1 www.fortinet.com
127.0.0.1 fortinet.com
127.0.0.1 www.fortinet.net
127.0.0.1 fortinet.net
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.sarc.com
127.0.0.1 sarc.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 www.free-av.com
127.0.0.1 free-av.com
127.0.0.1 www.f-prot.com
127.0.0.1 f-prot.com
127.0.0.1 www.ravantivirus.com
127.0.0.1 ravantivirus.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.avast.com
127.0.0.1 avast.com
127.0.0.1 www.antivir.com
127.0.0.1 antivir.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 vil.nai.com
127.0.0.1 us.mcafee.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 housecall.trendmicro.com
127.0.0.1 grisoft.com
127.0.0.1 www.grisoft.com
127.0.0.1 free.grisoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
Name W32/Sdbot-AGC
Type
* Spyware Worm
How it spreads
* Network shares
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Reduces system security
* Installs itself in the Registry
* Used in DOS attacks
Aliases
* Backdoor.Win32.SdBot.aad
Prevalence (1-5) 2
Description
W32/Sdbot-AGC is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Sdbot-AGC spreads to other network computers by Instant messaging
programmes and by exploiting common buffer overflow vulnerabilities,
including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1
(MS04-007).
W32/Sdbot-AGC runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Sdbot-AGC disables some security related software.
Advanced
W32/Sdbot-AGC is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Sdbot-AGC spreads to other network computers by Instant messaging
programmes and by exploiting common buffer overflow vulnerabilities,
including: WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1
(MS04-007).
W32/Sdbot-AGC runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Sdbot-AGC copies itself to <Windows>\taskmgr.exe.
The file <Windows>\taskmgr.exe is registered as a new system driver
service named "Microsoft Update Service", with a display name of
"Microsoft Update Service" and a startup type of automatic, so that
it is started automatically during system startup. Registry entries
are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Update Service\
W32/Sdbot-AGC sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are also created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Banker-IK
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banker.aem
* W32/Banker.EVV
Prevalence (1-5) 2
Description
Troj/Banker-IK is a Trojan for the Windows platform.
Advanced
Troj/Banker-IK is a Trojan for the Windows platform.
The following registry entry is created to run Troj/Banker-IK on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Redirect
<pathname of the Trojan executable>
Name W32/Tilebot-CB
Type
* Spyware Worm
How it spreads
* Network shares
* Chat programs
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aad
* W32/Sdbot.worm.gen.l
* W32.Spybot.Worm
* WORM_AIMDES.E
Prevalence (1-5) 2
Description
W32/Tilebot-CB is a worm with backdoor functionality for the Windows
platform.
W32/Tilebot-CB spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including: WKS (MS03-049)
(CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007). The worm also
spreads via network shares protected by weak passwords and AOL
Instant Messenger.
W32/Tilebot-CB runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-CB includes functionality to:
- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
Advanced
W32/Tilebot-CB is a worm with backdoor functionality for the Windows
platform.
W32/Tilebot-CB spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including: WKS (MS03-049)
(CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007). The worm also
spreads via network shares protected by weak passwords and AOL
Instant Messenger.
W32/Tilebot-CB runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-CB includes functionality to:
- set up an FTP server
- spread via AOL Instant Messager by sending messages automatically
- change Internet Explorer start page
- set or remove network shares
- port scanning
- packet sniffing
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
When first run W32/Tilebot-CB copies itself to <Windows
folder>\lsass.exe.
The file lsass.exe is registered as a new system driver service named
"lsass", with a display name of "Local Security Authority Subsystem
Service" and a startup type of automatic, so that it is started
automatically during system startup. Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\lsass\
W32/Tilebot-CB sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4
Additional registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update
AUOptions
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update
AUState
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0
HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
The following patches for the operating system vulnerabilities
exploited by W32/Tilebot-CB can be obtained from the Microsoft website:
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx
http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx
Name Troj/Perda-I
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Trojan-Proxy.Win32.Agent.id
* BKDR_AGENT.FO
Prevalence (1-5) 2
Description
Troj/Perda-I is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Advanced
Troj/Perda-I is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
The following registry entry is created to run Troj/Perda-I on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
taskbar
<pathname of the Trojan executable>
Name Troj/Mipbot-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* SpamTool.Win32.Mailbot.d
Prevalence (1-5) 2
Description
Troj/Mipbot-A is a Trojan for the Windows platform.
Troj/Mipbot-A attempts to connect to one of several pre-specified
servers from where it can receive further information.
Troj/Mipbot-A is used to send unsolicited emails from an infected
computer.
Advanced
Troj/Mipbot-A is a Trojan for the Windows platform.
Troj/Mipbot-A attempts to connect to one of several pre-specified
servers from where it can receive further information.
Troj/Mipbot-A is used to send unsolicited emails from an infected
computer.
The following registry entries are created to run code exported by
the Trojan DLL on startup:
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\<original filename>
DllName
<pathname of the Trojan DLL>
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\<original Trojan filename>
Startup
Startup
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\<original Trojan filename>
Impersonate
dword
Name Troj/Dloadr-ABJ
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Drops more malware
Aliases
* Trojan-Dropper.Win32.Small.vv
* Downloader-XB
Prevalence (1-5) 2
Description
Troj/Dloadr-ABJ is a Trojan for the Windows platform.
Advanced
Troj/Dloadr-ABJ is a Trojan for the Windows platform.
When Troj/Dloadr-ABJ is installed it creates the file \winloadhh.dll.
The file winloadhh.dll is detected as Troj/Dloader-NI.
Name Troj/Funot-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Deletes files off the computer
* Drops more malware
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Funot-A is a Trojan for the Windows platform that includes the
functionality to
replace existing files using the original filenames with the text
file, rename existing files using names constructed from a predefined
list, create text files, and to access the internet and communicate
with a remote server via HTTP.
Advanced
Troj/Funot-A is a Trojan for the Windows platform that includes the
following functionality:
-replaces existing files with a text file that contains the following
message:
"Fun X27 .::@li-RNo.H.::.VasVase"
-renames existing files using names constructed from a predefined
list similar to the following:
3k30
Baby Names hot
activex IT
amizesh.co
bank iran
bandar golpa
bbc
card
boot
carpet iran
...
-creates text files that contain the following message:
"Fun X27 .::@li-RNo.H.::.VasVase"
using names contructed from a predefined list similar to the following:
Vigen es.scf
bank.scf
business
com stories depot
farsi.scf
font
helper windows hedyeh
india islam iran.scf
iran information.scf
iran poem
iran sex
iran sites boobs
iran.scf
iraniansexyax iraniansexyaks
...
-attempts to access the internet and communicate with a remote server
via HTTP
When first run Troj/Funot-A copies itself to the current folder with
filenames similar to the following:
High hack rape.EXE
bank.exe
farsi sex Ebi.EXE
farsi.exe
ir3x.com salamiran word.EXE
iran picture iran666.EXE
where names of the copies may vary and are constructed from
predefined lists.
In order to be able to run automatically at startup Troj/Funot-A sets
a number of registry entries to the following:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<number>
<filename>
where <number> may vary and <filename> is one of the names of the
Trojan copies.
Also Troj/Funot-A creates the file VASVASe.HTML in the current
folder, containing the following message:
.\VASVASe.\
No Worm ; No Spy ; No Trojan ; This is Fun X27
http://www.vasvase27.blogfa.com
Name Troj/Zapchas-AD
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Zapchas-AD is a backdoor Trojan for the Windows platform.
Troj/Zapchas-AD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Troj/Zapchas-AD includes functionality to access the internet and
communicate with a remote server via HTTP.
The Trojan displays a pornographic image.
Advanced
Troj/Zapchas-AD is a backdoor Trojan for the Windows platform.
Troj/Zapchas-AD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Troj/Zapchas-AD includes functionality to access the internet and
communicate with a remote server via HTTP.
When Troj/Zapchas-AD is installed the following files are created:
<Windows system folder>\aliases.ini
<Windows system folder>\control.ini
<Windows system folder>\fullname.txt
<Windows system folder>\ident.txt
<Windows system folder>\mirc.ico
<Windows system folder>\mirc.ini
<Windows system folder>\nicks.txt
<Windows system folder>\poza.exe
<Windows system folder>\remote.ini
<Windows system folder>\script.ini
<Windows system folder>\servers.ini
<Windows system folder>\sup.bat
<Windows system folder>\sup.reg
<Windows system folder>\svchost.exe
<Windows system folder>\users.ini
The file svchost.exe is a version of the mIRC application.
The file poza.exe is an archive file containing a pornographic image.
This is opened automatically when the Trojan is installed.
The following registry entries are set or modified, so that
svchost.exe is run when files with extensions of CHA and IRC are
opened/launched:
HKCR\ChatFile\Shell\open\command
(default)
<Windows system folder>\svchost.exe" -noconnect
HKCR\irc\Shell\open\command
(default)
<Windows system folder>\svchost.exe" -noconnect
Registry entries are set as follows:
HKCR\ChatFile\DefaultIcon
(default)
<Windows system folder>\svchost.exe
HKCR\irc\DefaultIcon
(default)
<Windows system folder>\svchost.exe
Registry entries are created under:
HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\
The file svchost.exe provides an uninstall option which can be
accessed via the Add or Remove Programs dialog in the Windows Control
Panel. The software is listed as "mIRC".
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|