Text 106, 2177 rader
Skriven 2005-03-13 17:54:00 av KURT WISMER (1:123/140)
Ärende: News, March 13 2005
===========================
[cut-n-paste from sophos.com]

Name   W32/Sober-L

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Leaves non-infected files on computer

Prevalence (1-5) 3

Description
W32/Sober-L is a mass-mailing worm for the Windows platform.

Emails sent by the worm will have the following characteristics:

Subject line:
Ich habe Ihre E-Mail bekommen!
or
Your Password & Account number

Message text:
Hallo,
jemand schickt ihre privaten Mails auf meinem Account.
Ich schaetze mal, das es ein Fehler vom Provider ist.

Insgesamt waren es jetzt schon 6 Mails!
Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.

Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger 
nicht mehr auf meinem Account landen, es Nervt naemlich.

Gruss

or

hi,

i've got an admin mail with a Password and Account info!
but the mail recipient are you! it's probably an esmtp error, i think.

i've copied the full mail text in the Windows text-editor & zipped.

ok, cya...

Attached file:
MailTexte.zip
or
acc_text.zip

Advanced
W32/Sober-L is a mass-mailing worm which sends itself to addresses 
harvested from the infected computer.

When first run, W32/Sober-L will open Notepad and display a body of text 
that starts:

Mail-Text:
Unzip failed

W32/Sober-L will copy itself to a subfolder of the Windows folder named 
\MSAGENT\SYSTEM with the filename SMSS.EXE. In order to run 
automatically each time a user logs on, W32/Sober-L will continually set 
the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
" Services.dll"
<Windows folder>\msagent\system\smss.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
_Services.dll
<Windows folder>\msagent\system\smss.exe

W32/Sober-L also creates the following data files:

\msagent\win32\emdata.mmx
\msagent\win32\zipzip.zab
\read.me
\nonrunso.ber
\stopruns.zhz
\xcvfpokd.tqa

The READ.ME file contains the following text:

test test test

In diesem Sinne:
Odin alias Anon

W32/Sober-L will attempt to terminate processes with names containing 
the following strings:

gcas, gcip, giantanti, stinger, hijackthis

W32/Sober-L harvests email addresses from files with the following 
strings in their filenames:

pmr phtm stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl 
dhtm cgi pp ppt msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp 
nab fdb vap dsp ade sln dsw mde frm bas adr cls ini ldif log mdb xml wsh 
tbb abx abd adb pl rtf mmf doc ods nch xls nsf txt wab eml hlp mht nfo 
php asp shtml dbx

W32/Sober-L avoids sending email to addresses that contain any of the 
following strings:

ntp- ntp@ ntp. test@ office @www @from. support smtp- @smtp. gold-certs 
ftp. .dial. .ppp. anyone subscribe announce @gmetref sql. someone 
nothing you@ user@ reciver@ somebody secure whatever@ whoever@ anywhere 
yourname mustermann@ .kundenserver. mailer-daemon variabel password 
noreply -dav law2 .sul.t- .qmail@ t-ipconnect t-dialin ipt.aol time 
postmas service freeav @ca. abuse winrar domain. host. viren bitdefender 
spybot detection ewido. emsisoft linux google @foo. winzip @example. 
bellcore. @arin mozilla @iana @avp icrosoft. @sophos @panda @kaspers 
free-av antivir virus verizon. @ikarus. @nai. @messagelab nlpmail01. 
clock

The email sent by W32/Sober-L depends on the recipient address. Emails 
sent to recipients whose email address is in the .de, .ch, .at, .li 
domains or contains the string "gmx." will receive an email as follows:

Subject line:

Ich habe Ihre E-Mail bekommen!

Message text:

Hallo,
jemand schickt ihre privaten Mails auf meinem Account.
Ich schaetze mal, das es ein Fehler vom Provider ist.

Insgesamt waren es jetzt schon 6 Mails!
Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.

Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger 
nicht mehr auf meinem Account landen, es Nervt naemlich.

Gruss

Attached file:

MailTexte.zip

Email sent to other addresses will have the following characteristics:

Subject line:

Your Password & Account number

Message text:

hi,

i've got an admin mail with a Password and Account info!
but the mail recipient are you! it's probably an esmtp error, i think.

i've copied the full mail text in the Windows text-editor & zipped.

ok, cya...

Attached file:

acc_text.zip

The ZIP file will contain an executable file named 
mail_text-data.txt.pif

The From address line will be faked.





Name   W32/Sumom-A

Type  
    * Worm

How it spreads  
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Deletes files off the computer
    * Installs itself in the Registry

Aliases  
    * IM-Worm.Win32.Sumom.a
    * WORM_FATSO.A

Prevalence (1-5) 3

Description
W32/Sumom-A is an instant messenger and P2P worm.

Advanced
W32/Sumom-A is an instant messenger and P2P worm.

W32/Sumom-A copies itself to the files FORMATSYS.EXE and SERBW.EXE in 
the Windows system folder, MSMBW.EXE in the Windows folder, and to the 
filename LSPT.EXE in the root folder.

W32/Sumom-A sets entries at the following locations in the registry so 
as to run these copies of itself on system startup with the name "ltwob", 
"serpe" or "avnort":

HKCU\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

W32/Sumom-A copies itself to the following filenames in the root folder 
which it attempts to send via the Microsoft Windows Messenger to members 
of the infected user's contact list:

Crazy frog gets killed by train!.pif
Annoying crazy frog getting killed.pif
See my lesbian friends.pif
LOL that ur pic!
My new photo!.pif
Me on holiday!.pif
The Cat And The Fan piccy.pif
How a Blonde Eats a Banana...pif
Mona Lisa Wants Her Smile Back.pif
Topless in Mini Skirt! lol.pif
Fat Elvis! lol.pif
Jennifer Lopez.scr

W32/Sumom-A copies itself to the file AUTORUN.EXE in the following 
folder:

Documents and Settings\\Local Settings\Application Data\
Microsoft\CDBurning\

W32/Sumom-A creates the file AUTORUN.INF in the same folder in order to 
run the AUTORUN.EXE copy of itself on startup.

W32/Sumom-A also copies itself to the following folders:

My Shared Folder
Program Files\eMule\Incoming
Documents and Settings\<uasername>\Shared

copying itself to the following filenames so as to spread over P2P 
networks:

Messenger Plus! 3.50.exe
MSN all version polygamy.exe
MSN nudge bomb.exe

W32/Sumom-A also sets the following registry entries to hinder its 
removal:

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
DisableSR =
"0"

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
DisableConfig =
"0"

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
Hidden =
"2"

W32/Sumom-A terinates a large number processes related to anti-virus and 
security progams, including REGEDIT.EXE, TASKMGR.EXE and MSCONFIG.EXE.

W32/Sumom-A attempt to download and, on certain days of the month, open 
a file from http://frog.0catch.com to the file "British National 
Party.jpg". This file is currently unavailable for download.

W32/Sumom-A drops and runs a file called Crazy-Frog.Html to the root 
folder which tries to show a JPG picture file from 
http://frog.0catch.com and also to contact a PHP script at 
http://udjc.com.

W32/Sumom-A attempts to overwrite the HOSTS file with the following 
lines, preventing access to the websites:

64.233.167.104 www.symantec.com
64.233.167.104 www.sophos.com
64.233.167.104 www.mcafee.com
64.233.167.104 www.viruslist.com
64.233.167.104 www.f-secure.com
64.233.167.104 www.avp.com
64.233.167.104 www.kaspersky.com
64.233.167.104 www.networkassociates.com
64.233.167.104 www.ca.com
64.233.167.104 www.my-etrust.com
64.233.167.104 www.nai.com
64.233.167.104 www.trendmicro.com
64.233.167.104 www.grisoft.com
64.233.167.104 securityresponse.symantec.com
64.233.167.104 symantec.com
64.233.167.104 sophos.com
64.233.167.104 mcafee.com
64.233.167.104 liveupdate.symantecliveupdate.com
64.233.167.104 viruslist.com
64.233.167.104 f-secure.com
64.233.167.104 kaspersky.com
64.233.167.104 kaspersky-labs.com
64.233.167.104 avp.com
64.233.167.104 networkassociates.com
64.233.167.104 ca.com
64.233.167.104 mast.mcafee.com
64.233.167.104 my-etrust.com
64.233.167.104 download.mcafee.com
64.233.167.104 dispatch.mcafee.com
64.233.167.104 secure.nai.com
64.233.167.104 nai.com
64.233.167.104 update.symantec.com
64.233.167.104 updates.symantec.com
64.233.167.104 us.mcafee.com
64.233.167.104 liveupdate.symantec.com
64.233.167.104 customer.symantec.com
64.233.167.104 rads.mcafee.com
64.233.167.104 trendmicro.com
64.233.167.104 grisoft.com
64.233.167.104 sandbox.norman.no
64.233.167.104 www.pandasoftware.com
64.233.167.104 uk.trendmicro-europe.com

W32/Sumom-A attempts to terminate certain processes and delete certain 
files relating to the W32/Assiral family of mass-mailing worms. 
W32/Sumom-A drops and, on certain days of the month, opens a message to 
the author of the W32/Assiral worm in a file called "Message to n00b 
LARISSA.txt" containing the following text:

Hey LARISSA fuck off, you fucking n00b!.. Bla bla to your fucking
Saving the world from Bropia, the world n33ds saving from you!

'-S-K-Y-'-D-E-V-I-L-'





Name   W32/Forbot-ER

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Wootbot.u

Prevalence (1-5) 2

Description
W32/Forbot-ER is a network worm which attempts to spread via network 
shares. The worm contains backdoor functions that allow unauthorised 
remote access to the infected computer via IRC channels.

W32/Forbot-ER spreads to unpatched computers affected by the LSASS 
security exploit (MS04-011).

Advanced
W32/Forbot-ER is a network worm which attempts to spread via network 
shares. The worm contains backdoor functions that allow unauthorised 
remote access to the infected computer via IRC channels.

W32/Forbot-ER spreads to unpatched computers affected by the LSASS 
security exploit (MS04-011).

When run the worm moves itself to the Windows System folder as 
instantmsgrs.exe and creates the following registry entries so as to run 
itself on computer logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
mousedrive.exe
instantmsgrs.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
mousedrive.exe
instantmsgrs.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
mousedrive.exe
instantmsgrs.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
mousedrive.exe
instantmsgrs.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
mousedrive.exe
instantmsgrs.exe

Once installed, W32/Forbot-ER will attempt to setup an HTTP and a SOCKS4 
proxy server, delete connections to network shares, participate in 
denial-of-service (DoS) attacks, harvest email addresses and steal CD 
keys when instructed to do so by a remote attacker.





Name   W32/Kelvir-B

Type  
    * Worm

How it spreads  
    * Web downloads
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * IM-Worm.Win32.Kelvir.a

Prevalence (1-5) 2

Description
W32/Kelvir-B is an instant messenging worm.

W32/Kelvir-B spreads by sending a message through Windows Messenger to 
all of an infected user's contacts. The message encourages the recipient 
to visit a web page to download an update and reads:

omg this is funny! <URL>

W32/Kelvir-B will attempt to download a file named PATCH.EXE from a 
remote website and save it as C:\patch.exe





Name   W32/Rbot-WX

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.IRCBot.y

Prevalence (1-5) 2

Description
W32/Rbot-WX is a network worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-WX spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

Advanced
W32/Rbot-WX is a network worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-WX spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

W32/Rbot-WX can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-WX can be instructed by a remote user 
to perform the following functions:

    * start an FTP server
    * start a Proxy server
    * start a web server
    * take part in distributed denial of service (DDoS) attacks
    * log keypresses
    * capture screen/webcam images
    * packet sniffing
    * port scanning
    * download/execute arbitrary files
    * start a remote shell (RLOGIN)

The worm copies itself to a file named lsassx.exe in the Windows system 
folder and creates the following registry entries:

HKCU\Software\Microsoft\OLE\
Windows Taskmanager=
"lsassx.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Taskmanager=
"lsassx.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Windows Taskmanager=
"lsassx.exe"





Name   W32/Kelvir-D

Type  
    * Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Downloads code from the internet
    * Reduces system security

Aliases  
    * W32/Kelvir.worm.d

Prevalence (1-5) 2

Description
W32/Kelvir-D is an instant messenging worm that spreads by sending a 
message through Windows Messenger to all of an infected user's contacts.

W32/Kelvir-D arrives attached to the message that encourages the 
recipient to visit a web page to download an update and reads:

lol! see it! u'll like it .

W32/Kelvir-D also attempts to download and execute ME.JPG and FILE.EXE 
files from the predefined websites.

For more information about ME.JPG see W32/Rbot-XA.





Name   W32/Tibick-C

Type  
    * Worm

How it spreads  
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * P2P-Worm.Win32.Tibick.d
    * W32/Tibick!p2p
    * WORM_TIBICK.A

Prevalence (1-5) 2

Description
W32/Tibick-C is a peer to peer worm.

W32/Tibick-C also contains limited IRC backdoor Trojan functionality. 
W32/Tibick-C will attempt to connecting to a remote IRC server and may 
attempt to download and execute a file from a specified address to a 
random filename with an EXE extension in the Windows system folder if 
instructed to do so.

Advanced
W32/Tibick-C is a peer to peer worm.

W32/Tibick-C copies itself to the Windows system folder as SVCNET.EXE 
and creates the following registry entries so as to run itself on system 
startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Shellapi32
svcnet.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Shellapi32
svcnet.exe

W32/Tibick-C may attempt to copy itself to the subfolder MSVIEW of the 
Windows folder with some of the following filenames, appending different 
numbers of zero bytes to the end of each to give them different 
filesizes:

321 Studios GamesXCopy 1.0.8 crack.exe
3D Studio Max 6 crack.exe
ABBYY FineReader Pro 7.0 crack.exe
acdsee 7.0.61 crack.exe
Adobe Photoshop all.exe
Adobe Photoshop CS 8 crack.exe
Adobe Photoshop CS crack.exe
Adobe Serial Generator v2.0.exe
Adult Tetris 2 crack.exe
Age of Empires II The Age of Kings NO CD crack.exe
Backyard Baseball 2003 no cd crack.exe
Backyard Wrestling 2 - There Goes the Neighborhood Eidos Int
Battlefield 1942 no cd crack.exe
Battlefield Vietnam EA Games crack.exe
Battlefield Vietnam Multiplayer Online Crack.exe
Besieger DreamCatcher Interactive crack.exe
BitComet.exe
CloneDVD2 v2.5.3.3 crack.exe
Command & Conquer - Generals no cd crack.exe
Command & Conquer - Generals Zero Hour EA Games crack.exe
Command & Conquer - Generals Zero Hour no cd crack.exe
CopyToDVD 3.0.3 crack.exe
Corel Draw Graphics Suite 12.0 crack.exe
Counter-Strike Condition Zero Keygen.exe
Crusader Kings Paradox Entertainment crack.exe
Cubase Audio XT 3.X crack.exe
CyberLink PowerDVD v6.0 Deluxe7 crack.exe
Dark Age Of Camelot - Trials Of Atlantis no cd crack.exe
Dark Matter - The Baryon Proj crack.exe
dBpowerAmp Music Converter.exe
Deus Ex Invisible War NO CD Crack.exe
DFX Audio Enhancement 2.0.1 crack.exe
Diablo 2 NO CD crack.exe
Easy CD-DA Extractor 7.1.3.1 crack.exe
Easy CD-DA Extractor 7.13.2 keygen.exe
eMule.exe
Enter the Matrix Atari crack.exe
eractive crack.exe
ESPN NFL 2K5 Sega crack.exe
ethesda Softworks crack.exe
F.E.A.R. VU Games crack.exe
Fable Microsoft crack.exe
Far Cry Ubisoft crack.exe
Fifa 2005 crack.exe
Final Fantasy VII - Advent Children PSP Square Enix crack.exe
Final Fantasy XI - Square Enix USA no cd crack.exe
Final Fantasy XII Square Enix crack.exe
Fire Emblem - Seima no Kouseki GBA Nintendo crack.exe
FlashFXP 2 RC2 Crack.exe
FlashFXP All Version KeyGen.exe
FlashFXP v1.4.1 Crack.exe
FlashFXP v1.4.3 Crack.exe
FlashFXP v2.0 Crack.exe
FlashFXP v2.1 crack.exe
FlashFXP v2.2 crack.exe
FlashGet.exe
Forgotten Realms - Demon Stone Atari crack.exe
Forgotten Realms - Demon Stone crack.exe
Free Internet TV 3.2 crack.exe
Freedom Force no cd crack.exe
Front Mission 4 Square Enix crack.exe
FrontPage XP 2002 Crack.exe
FTP Server Serv-U 5.1 Coporate Edition crack.exe
Full Spectrum Warrior THQ crack.exe
Geist GC Nintendo crack.exe
GetRight 5.2 crack.exe
Goblin Commander - Unleash the Horde Jaleco Entertainment crack.exe
Gran Turismo 4 SCEA crack.exe
Grand Theft Auto - San Andreas Rockstar Games crack.exe
Grand Theft Auto 3 no cd crack.exe
Grand Theft Auto III no cd crack.exe
Grand Theft Auto San Andreas NO CD crack.exe
Grand Theft Auto Vice City NO CD crack.exe
Grand Theft Auto: San Andreas crack.exe
Grokster.exe
GTA crack.exe
Gunbound Trainer.exe
GX Transcoder 2.10.2350 keygen.exe
Half-Life 2 crack.exe
Half-Life 2 Keygen.exe
Half-Life 2 NO CD Crack.exe
Half-Life 2 VU Games crack.exe
Halo - Combat Evolved - Microsoft no cd crack.exe
Halo 2 crack.exe
Harry Potter and the Prisoner of Azkaban Adventure EA Games crack.exe
Harry Potter and the Sorcerers Stone no cd crack.exe
Harry Potter and The Sorcerers Stone no cd crack.exe
Heroes of Might and Magic IV no cd crack.exe
Hidden and Dangerous 2 NO CD Crack.exe
HijackThis.exe
Icewind Dale 2 no cd crack.exe
ICQ 4.exe
ICQ Pro 2003b.exe
iMesh.exe
Internet Download Manager v4.02 crack.exe
IsoBuster Professional v1.7.0.0 crack.exe
Jedi Academy NO CD Crack.exe
JetAudio Basic.exe
Joint Operations - Typhoon Rising NovaLogic crack.exe
Juiced Acclaim crack.exe
K-Lite Codec Pack v2.31 Full crack.exe
K-Lite Mega Codec Pack 1.13 keygen.exe
Kaspersky Anti-Hacker v1.7 crack.exe
Kazaa Download Accelerator Pro.exe
Kingdom Hearts II Square Enix crack.exe
Knights Apprentice Memoricks Adventures Games crack.exe
LimeWire (International).exe
LimeWire server scanner.exe
LimeWire.exe
Lord of the Rings: The Battle for Middle-earth 1.00 crack.exe
LOTR NO CD Crack.exe
Macromedia ColdFusion MX crack.exe
Macromedia Contribute v2.0 crack.exe
Macromedia Director 8 Crack.exe
Macromedia Dreamweaver 4.0 Patch.exe
Macromedia Dreamweaver MX 2004 7.0 crack.exe
Macromedia Dreamweaver MX v6.0 crack.exe
Macromedia Dreamweaver UltraDev 4.0 Patch.exe
Macromedia Fireworks 4.0 Patch.exe
Macromedia Flash 5 Crack.exe
Macromedia Flash All Versions keygen.exe
Macromedia Flash MX v6.0 crack.exe
Macromedia Flash SWF-Unprotect v2.0.exe
Macromedia FreeHand v10 Loader.exe
Madden NFL 2003 no cd crack.exe
Madden NFL 2005 EA crack.exe
Mafia no cd crack.exe
MagicScore maestro 3.5 keygen.exe
Malice Mud Duck Productions crack.exe
Mario Pinball Land GBA Puzzle Nintendo crack.exe
Mario Tennis GC Nintendo crack.exe
Matrix Screensaver.exe
Max Payne 2 Fall Of Max Payne no cd crack.exe
Max Payne 2 NO CD Crack.exe
Max Payne 2 The Fall of Max Payne NO CD crack.exe
MaxPayne 2 The Fall Of Max Payne Crack.exe
McAfee VirusScan 9.0 crack.exe
McFarlanes Evil Prophecy Konami crack.exe
Medal of Honor- Allied Assault no cd crack.exe
Medal Of Honor - Allied Assault BreakThrough no cd crack.exe
Medal Of Honor - Allied Assault no cd crack.exe
Medal of Honor Pacific Assault EA Games crack.exe
Medieval - Total War no cd crack.exe
Mega Man Anniversary Collection GC Capcom crack.exe
Metal Gear Acid PSP Konami crack.exe
Metal Gear Solid 3 - Snake Eater Konami crack.exe
Microsoft Flight Simulator 2004 - A Century Of Flight no cd crack.exe
Microsoft Office 2000 Regmaker.exe
Microsoft Office XP Activation Crack.exe
Microsoft Office XP Activation Killer.exe
Microsoft Office XP Professional Crack.exe
Microsoft Office XP Professional Serial.exe
Microsoft Office XP Universal Activator v1.0.exe
Microsoft Windows Media Player.exe
Microsoft Windows Xp Profesional Sp 2 keygen.exe
Microsoft Windows XP Professional ( Corp key ) keygen.exe
Midnight Club 3 - DUB Edition Rockstar Games crack.exe
mirc 6.1x reg entries.exe
mIRC 6.X crack.exe
Monopoly 3 ISO crack.exe
Monopoly 3 keygen.exe
Morpheus.exe
Mortal Kombat 4 crack.exe
Mozilla Firefox.exe
MP3 Doctor 5.11.15 crack.exe
mp3DirectCut 1.38 keygen.exe
MS Office XP Activation Crack.exe
MS Zoo Tycoon no cd crack.exe
MSN advert remover.exe
MSN Messenger (Windows XP).exe
MSN Toolbar advert remover.exe
MSN Toolbar.exe
MusicMatch Jukebox Plus 9.00 crack.exe
MVP Baseball 2004 EA crack.exe
Need For Speed: Underground 2 crack.exe
Need for Speed4 - NOCD.exe
NeedforspeedUnderground-nocd.exe
Nero 6 Ultra Edition 6.6.0.1 crack.exe
Nero 6 Ultra Edition Crack.exe
Norton AntiVirus 2004 Professional Edition keygen.exe
norton antivirus 2005 crack.exe
Norton Antivirus 2005 crack.exe
RollerCoaster Tycoon NO CD Crack (Including Attractions Pack).exe
RYL crack.exe
Second Life Linden Lab crack.exe
Serials 2000 v7.1 Plus (build 06.16.04) keygen.exe
Shadow Ops - Red Mercury Atari crack.exe
ShellShock - Nam 67 Eidos Interactive crack.exe
Shockwave Player.exe
Silent Storm - Sentinels _No Company crack.exe
Sim City 4 - Rush Hour no cd crack.exe
Sim City 4 Deluxe no cd crack.exe
Sim Theme Park World no cd crack.exe
Sims 2 crack.exe
Singles - Flirt Up Your Life Eidos Interactive crack.exe
Snood crack.exe
Snood Crack.exe
Snood.exe
Snowblind Eidos Interactive crack.exe
SolSuite 2004 - Solitaire Card Games Suite.exe
Sonic the Hedgehog 3 crack.exe
Spider-Man 2 Activision crack.exe
Spider-Man 2 GC Activision crack.exe
Sponge Bob Square Pants - Operation Krabby Patty no cd crack.exe
Spy Sweeper 3.2 147 crack.exe
Spybot - Search & Destroy.exe
The Sims - Vacation Expansion Pack no cd crack.exe
The Sims 2 crack.exe
The Sims Deluxe no cd crack.exe
The Sims Double Deluxe no cd crack.exe
The Sims no cd crack.exe
The Suffering Encore Software Inc. crack.exe
The Suffering Midway crack.exe
Thief - Deadly Shadows Eidos Interactive crack.exe
Tiger Woods PGA Tour 2004 crack.exe
Tom Clancys Ghost Recon - Desert Siege no cd crack.exe
Tom Clancys splinter cell pandora tomo db
Tom Clancys Splinter Cell Pandora Tomorrow Ubisoft crack.exe
Tom Clancys Splinter Cell Ubisoft crack.exe
Tony Hawks Underground crack.exe
Total Commander v6.03a PowerPack 25 crack.exe
Trillian crasher.exe
Trillian Pro v3.0.950 crack.exe
Trillian.exe
Tweak-XP Pro 4.0.2 crack.exe
Unreal Tournament 2003 no cd crack.exe
Unreal Tournament 2004 Atari crack.exe
Unreal Tournament 2004 crack (keygen).exe
Unreal Tournament 2004 Crack.exe
Unreal Tournament 2004 NO CD crack.exe
Vampire - The Masquerade - Bloodlines Activision crack.exe
VirtualLab Data Recovery crack.exe
VirtualLab Data Recovery.exe
Virtuosa Phoenix Edition Crack.exe
Warcraft III - Reign Of Chaos no cd crack.exe
Warez P2P.exe
WebRoot Spy Sweeper 3.5.0.189 crack.exe
Webroot Spy Sweeper Crack.exe
Webroot Spy Sweeper.exe
WebSite Watcher v4.02 crack.exe
Winace 2.x Crack.exe
Winamp 5.03 Full crack.exe
Winamp Full.exe
windows server 2003 crack.exe
Windows Server 2003 SP1 Build 1039-2l crack.exe
Windows XP Activation Crack.exe
Windows XP home edition Activation.exe
Windows XP Pro 64-bit crack.exe
Windows XP Professional crack.exe
Windows XP SP2 KeyGen.exe
WinDVD Platinum 5.0.26.23 crack.exe
WinMX.exe
WinRAR 3.30 Corporate Ed crack.exe
WinRAR 3.x Crack.exe
WinRAR All KeyGen.exe
WinRAR crack (keygen).exe
WinRAR v3.20 Final keygen.exe
WinRAR v3.30 Final keygen.exe
WinRAR v3.41 Final keygen.exe
WinRAR.exe
WinZip 9.x Crack.exe
WinZip All KeyGen.exe
WinZip All Versions keygen.exe
Winzip keygen.exe
WinZip Self-Extractor v2.2 keygen.exe
WinZip Self-Extractor v2.2 Patch.exe
WinZip v8.0 Keygen.exe
WinZIP v9.0 Keygen.exe
WinZip v9.0 Registration.exe
WinZip.exe
World of Warcraft Blizzard Entertainment crack.exe
Worms Armageddon NO CD crack.exe
WWE Day of Reckoning GC THQ crack.exe
WWE SmackDown! vs. Raw THQ crack.exe
XBOX X-Fer Ripper and Transfer.exe
XP Slipstreamer v1.0 crack.exe
Yahoo Messenger.exe
Yoshinoya Success crack.exe
ZeroSpyware Lite.exe
Zone Alarm Security Suite 5.5.062 crack.exe
ZoneAlarm crack (keygen).exe
ZoneAlarm.exe
Zoo Tycoon- Dinosaur Digs no cd crack.exe
Zoo Tycoon - Complete Collection no cd crack.exe
Zoo Tycoon no cd crack.exe

W32/Tibick-C will then set some of the following registry entries to 
point to the MSVIEW folder to allow the worm to spread via KaZaA and 
iMesh:

HKCU\Software\Kazaa\LocalContent
Dir<NUM>
(where <NUM> is in the range 0-100)

HKCU\Software\iMesh\Client\LocalContent
Dir<NUM>
(where <NUM> is in the range 0-100)

W32/Tibick-C may add a line to the file MorphConfig.ini in the folder 
found at HKLM\SOFTWARE\Morpheus\Install_Dir, pointing to the MSVIEW 
folder to allow the worm to spread via Morpheus.

W32/Tibick-C may add a line to the file Shared Folders.txt in the Data 
subfolder of the folder found at HKCR\wareo\shell\open\command, pointing 
to the MSVIEW folder to allow the worm to spread via Warez.

W32/Tibick-C may add a line to the file shareddir.dat in the Config 
subfolder of the folder found at HKCU\Software\eMule\Install Path, 
pointing to the MSVIEW folder to allow the worm to spread via eMule.

W32/Tibick-C may write a long XML string to the file DCPlusPlus.xml 
found in the folder at HKLM\SOFTWARE\DC++\Install_Dir, ending with a 
line pointing to the MSVIEW folder to allow the worm to spread via DC++.

W32/Tibick-C may also set some of the following registry entries to help 
it spread via KaZaA and iMesh:

HKCU\Software\Kazaa\Advanced
SuperNode
0

HKCU\Software\Kazaa\Advanced
ScanFolder
0

HKCU\Software\Kazaa\LocalContent
DisableSharing
0

HKCU\Software\Kazaa\LocalContent
DisableListFiles
1

HKCU\Software\Kazaa\ResultsFilter
firewall_filter
0

HKCU\Software\Kazaa\ResultsFilter
virus_filter
0

HKCU\Software\Kazaa\Transfer
UploadBandwidth
0

HKCU\Software\Kazaa\Transfer
ConcurrentUploads
0

HKCU\Software\Kazaa\Transfer
NoUploadLimitWhenIdle
1

HKCU\Software\Kazaa
LimitBitrate
0

HKCU\Software\Kazaa\DontShow
CloseToSystray
1

HKCU\Software\Kazaa\InstantMessaging
IgnoreAll
1

HKCU\Software\Kazaa\UserDetails
AutoConnected
1

HKCU\Software\iMesh\Client\LocalContent
DisableSharing
0

HKCU\Software\iMesh\Client\LocalContent
ConcurrentUploads
20

W32/Tibick-C also contains limited IRC backdoor Trojan functionality. 
W32/Tibick-C will attempt to connecting to a remote IRC server and may 
attempt to download and execute a file from a specified address to a 
random filename with an EXE extension in the Windows system folder if 
instructed to do so.





Name   W32/Bropia-G

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Drops more malware

Prevalence (1-5) 2

Description
W32/Bropia-G is an Instant Messenger worm for the Windows platform.

The worm is a self-extracting archive which drops the following files to 
the current folder and then runs them:

f.exe - detected by Sophos as W32/Forbot-ET
link.exe - detected by Sophos as W32/Bropia-G

W32/Bropia-G monitors the status of MSN messenger and sends copies of 
itself to Messenger contacts.





Name   W32/Radbot-A

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Prevalence (1-5) 2

Description
W32/Radbot-A is a multi-component worm

W32/Radbot-A drops files detected as W32/Rbot-VN and Troj/Istbar-AH.

The worm W32/Rbot-VN attempts to spread W32/Radbot-A to remote network 
shares with weak passwords.

Advanced
W32/Radbot-A is a multi-component worm.

W32/Radbot-A drops and runs three files in the Windows folder:

1.EXE
2.EXE
Z.BAT

The file 1.EXE is detected as Troj/Istbar-AH. The file 2.EXE is detected 
as W32/Rbot-VN.

The file Z.BAT runs the two EXE files and then deletes both the archive 
and itself.

The worm W32/Rbot-VN attempts to spread W32/Radbot-A to remote network 
shares with weak passwords.





Name   W32/Rbot-XE

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information
    * Downloads code from the internet

Prevalence (1-5) 2

Description
W32/Rbot-XE is a network worm with a backdoor functionality for the 
Windows platform that allows unauthorised remote access to the infected 
computer via IRC channels while running in the background as a service 
process.

W32/Rbot-XE spreads to the weakly protected network shares and via 
network security exploits as a result of the backdoor Trojan element 
receiving the appropriate command from a remote user.

Advanced
W32/Rbot-XE is a network worm with a backdoor functionality for the 
Windows platform that allows unauthorised remote access to the infected 
computer via IRC channels while running in the background as a service 
process.

W32/Rbot-XE spreads to the weakly protected network shares and via 
network security exploits as a result of the backdoor Trojan element 
receiving the appropriate command from a remote user.

Once executed W32/Rbot-XE copies itself to the Windows system folder 
with the filename mcafee32.exe, and in order to be able to run 
automatically when Windows starts up sets the registry entry:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe mcafee32.exe

W32/Rbot-XE also may set the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

W32/Rbot-XE may modify the following registry entry to restrict 
anonymous enumeration of SAM accounts:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymousSAM

W32/Rbot-XE can add and delete network shares and users on the infected 
computer. The worm can also change the network logon rights of accounts 
in the local system policy.

W32/Rbot-XE may change the security settings of Microsoft Internet 
Explorer by modifying entries in the registry at the following location:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3





Name   W32/Domwis-H

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * BKDR_DOMWIS.C
    * Backdoor.Win32.Wisdoor.av

Prevalence (1-5) 2

Description
W32/Domwis-H is a network worm which contains IRC backdoor Trojan 
functionality which allows a malicious user remote access to the 
infected computer.

W32/Domwis-H spreads via network security exploits as a result of the 
backdoor Trojan element receiving the appropriate command from a remote 
user.

W32/Domwis-H can be instructed by a remote user to perform a variety of 
other tasks including to steal system information and log keystrokes, to 
download and execute remote files, and to get information about running 
processes and to terminate them.

Advanced
W32/Domwis-H is a network worm which contains IRC backdoor Trojan 
functionality which allows a malicious user remote access to the 
infected computer.

W32/Domwis-H copies itself to the Windows folder with the filename 
WINFRW.EXE and creates the following entry in the registry so as to run 
itself on system startup, resetting this value periodically:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows System Configuration
%WINDOWS%\WINFRW.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Security Updater
%WINDOWS%\WINFRW.EXE

W32/Domwis-H spreads via network security exploits as a result of the 
backdoor Trojan element receiving the appropriate command from a remote 
user.

W32/Domwis-H can be instructed by a remote user to perform a variety of 
other tasks including to steal system information and log keystrokes, to 
download and execute remote files, and to get information about running 
processes and to terminate them.





Name   W32/Agobot-QT

Type  
    * Worm

How it spreads  
    * Network shares
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Deletes files off the computer
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Win32.Agobot.xs
    * W32/Agobot.CVS

Prevalence (1-5) 2

Description
W32/Agobot-QT is a worm with backdoor Trojan functionality.

W32/Agobot-QT connects to an IRC channel and listens for backdoor 
commands from a remote attacker. The worm may also spread to network 
shares with weak passwords or by DCC.

W32/Agobot-QT contains backdoor functionality including the ability to 
do any of the following:

- participate in denial of service attacks
- download updates and other files
- list, create and terminate processes and services
- provide a remote command shell
- log keypresses
- delete files
- delete network shares
- make registry changes
- steal system information
- send files by DCC
- exploit vulnerabilities
- monitor network traffic

W32/Agobot-QT also modifies the system HOSTS file in order to prevent 
access to certain anti-virus and other websites.

Advanced
W32/Agobot-QT is a worm with backdoor Trojan functionality.

W32/Agobot-QT connects to an IRC channel and listens for backdoor 
commands from a remote attacker. The worm may also spread to network 
shares with weak passwords or by DCC.

W32/Agobot-QT contains backdoor functionality including the ability to 
do any of the following:

- participate in denial of service attacks
- download updates and other files
- list, create and terminate processes and services
- provide a remote command shell
- log keypresses
- delete files
- delete network shares
- make registry changes
- steal system information
- send files by DCC
- exploit vulnerabilities
- monitor network traffic

W32/Agobot-QT also modifies the system HOSTS file in order to prevent 
access to the following web addresses:

avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
f-secure.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
my-etrust.com
nai.com
networkassociates.com
rads.mcafee.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
trendmicro.com
update.symantec.com
updates.symantec.com
us.mcafee.com
viruslist.com
www.avp.com
www.ca.com
www.f-secure.com
www.kaspersky.com
www.mcafee.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.com

When first run W32/Agobot-QT copies itself to the Windows system folder 
as SUPER.EXE and creates the following registry entries in order to run 
itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
super
super.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
super
super.exe





Name   W32/Rbot-XI

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Modifies passwords

Aliases  
    * W32/Sdbot.worm.gen.h
    * WORM_RBOT.ASU

Prevalence (1-5) 2

Description
W32/Rbot-XI a network worm with backdoor functionality for the Windows 
platform.

W32/Rbot-XI spreads to weakly protected network shares and to computers 
vulnerable to the LSASS, RPC-DCOM, and IIS5SSL exploits. For more 
information about these vulnerabilities see MS04-011 (for both the LSASS 
and IIS5SSL exploits) and MS04-012 (for the RPC-DCOM exploit).

When installed W32/Rbot-XI connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands.

Advanced
W32/Rbot-XI a network worm with backdoor functionality for the Windows 
platform.

W32/Rbot-XI spreads to weakly protected network shares and to computers 
vulnerable to the LSASS, RPC-DCOM, and IIS5SSL exploits. For more 
information about these vulnerabilities see MS04-011 (for both the LSASS 
and IIS5SSL exploits) and MS04-012 (for the RPC-DCOM exploit).

Once executed W32/Rbot-XI copies itself to the Windows system folder 
with the filename cthelper.exe, and in order to be able to run 
automatically when Windows starts up sets the registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
CTHelper
cthelper.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
CTHelper
cthelper.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
CTHelper
cthelper.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices\
CTHelper
cthelper.exe

W32/Rbot-XI also sets the following registry entries:

HKCU\Software\Microsoft\OLE
CTHelper
cthelper.exe

HKLM\Software\Microsoft\OLE
CTHelper
cthelper.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
CTHelper
cthelper.exe

HKCU\Software\Microsoft\OLE
CTHelper
cthelper.exe

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
CTHelper
cthelper.exe

W32/Rbot-XI may modify the setting of the following registry entry to 
enable or disable anonymous access to the IPC$ share:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous

The worm may also be instructed to enable or disable DCOM, by modifying 
the following registry entry:

HKLM\Software\Microsoft\OLE
EnableDCOM

When installed W32/Rbot-XI connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands. These 
commands can cause the infected computer to perform any of the following 
actions:

Scan for remote computers to infect
Start a HTTP, an FTP, or a SOCKS4 server
Log any kesytrokes made on an infected computer
Flood a remote computer using ICMP, SYN, UDP or TCP
Search for, upload, download, and execute files
Browse and attempt to modify any services installed on the computer
Participate in a distributed denial-of-service (DDoS) attack
List and terminate processes
Attempt to disable security software
Create and delete network shares

W32/Rbot-XI attempts to terminate a number of processes related to the 
various AV and security applications as well as Trojans and worms 
including following:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ADAWARE.EXE
ADVXDWIN.EXE
AGENTSVR.EXE
AGENTW.EXE
ALERTSVC.EXE
ALEVIR.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ARR.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATWATCH.EXE
AU.EXE
AUPDATE.EXE
AUTO-PROTECT.NAV80TRY.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGNT.EXE
AVGSERV.EXE
AVGSERV9.EXE
AVGUARD.EXE
AVGW.EXE
AVKPOP.EXE
AVKSERV.EXE
AVKSERVICE.EXE
AVKWCTl9.EXE
AVLTMAIN.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVSYNMGR.EXE
AVWIN95.EXE
AVWINNT.EXE
AVWUPD.EXE
AVWUPD32.EXE
AVWUPSRV.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
BACKWEB.EXE
BARGAINS.EXE
bbeagle.exe
BD_PROFESSIONAL.EXE
BEAGLE.EXE
BELT.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BLSS.EXE
BOOTCONF.EXE
BOOTWARN.EXE
BORG2.EXE
BPC.EXE
BRASIL.EXE
BS120.EXE
BUNDLE.EXE
BVT.EXE
CCAPP.EXE
CCEVTMGR.EXE
CCPXYSVC.EXE
CDP.EXE
CFD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
Claw95.EXE
CLAW95CF.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLICK.EXE
CMD32.EXE
CMESYS.EXE
CMGRDIAN.EXE
CMON016.EXE
CONNECTIONMONITOR.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CTRL.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
d3dupdate.exe
DATEMANAGER.EXE
DCOMX.EXE
DEFALERT.EXE
DEFSCANGUI.EXE
DEFWATCH.EXE
DEPUTY.EXE
DIVX.EXE
DLLCACHE.EXE
DLLREG.EXE
DOORS.EXE
DPF.EXE
DPFSETUP.EXE
DPPS2.EXE
DRWATSON.EXE
DRWEB32.EXE
DRWEBUPW.EXE
DSSAGENT.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
EFPEADM.EXE
EMSW.EXE
ENT.EXE
ESAFE.EXE
ESCANH95.EXE
ESCANHNT.EXE
ESCANV95.EXE
ESPWATCH.EXE
ETHEREAL.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXANTIVIRUS-CNET.EXE
EXE.AVXW.EXE
EXPERT.EXE
EXPLORE.EXE
F-AGNT95.EXE
F-AGOBOT.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FAMEH32.EXE
FAST.EXE
FCH32.EXE
FIH32.EXE
FINDVIRU.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FNRB32.EXE
FP-WIN.EXE
FP-WIN_TRIAL.EXE
FPROT.EXE
FRW.EXE
FSAA.EXE
FSAV.EXE
FSAV32.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
FSGK32.EXE
FSM32.EXE
FSMA32.EXE
FSMB32.EXE
GATOR.EXE
GBMENU.EXE
GBPOLL.EXE
GENERICS.EXE
GMT.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HBINST.EXE
HBSRV.EXE
HIJACKTHIS.EXE
HOTACTIO.EXE
HOTPATCH.EXE
HTLOG.EXE
HTPATCH.EXE
HWPE.EXE
HXDL.EXE
HXIUL.EXE
IAMAPP.EXE
IAMSERV.EXE
IAMSTATS.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IDLE.EXE
IEDLL.EXE
IEDRIVER.EXE
IEXPLORER.EXE
IFACE.EXE
IFW2000.EXE
INETLNFO.EXE
INFUS.EXE
INFWIN.EXE
INIT.EXE
INTDEL.EXE
INTREN.EXE
IOMON98.EXE
IPARMOR.EXE
IRIS.EXE
irun4.exe
ISASS.EXE
ISRV95.EXE
ISTSVC.EXE
JAMMER.EXE
JDBGMRG.EXE
JEDI.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KAVPF.EXE
KAZZA.EXE
KEENVALUE.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KERNEL32.EXE
KILLPROCESSSETUP161.EXE
LAUNCHER.EXE
LDNETMON.EXE
LDPRO.EXE
LDPROMENU.EXE
LDSCAN.EXE
LNETINFO.EXE
LOADER.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LORDPE.EXE
LSETUP.EXE
LUALL.EXE
LUAU.EXE
LUCOMSERVER.EXE
LUINIT.EXE
LUSPT.EXE
MAPISVC32.EXE
MCAGENT.EXE
MCMNHDLR.EXE
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MD.EXE
MFIN32.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MGUI.EXE
MINILOG.EXE
MMOD.EXE
MONITOR.EXE
MOOLIVE.EXE
MOSTAT.EXE
MPFAGENT.EXE
MPFSERVICE.EXE
MPFTRAY.EXE
MRFLUX.EXE
MSAPP.EXE
MSBB.EXE
MSBLAST.EXE
MSCACHE.EXE
MSCCN32.EXE
MSCMAN.EXE
MSCONFIG.EXE
mscvb32.exe
MSDM.EXE
MSDOS.EXE
MSIEXEC16.EXE
MSINFO32.EXE
MSLAUGH.EXE
MSMGT.EXE
MSMSGRI32.EXE
MSSMMC32.EXE
MSSYS.EXE
MSVXD.EXE
MU0311AD.EXE
MWATCH.EXE
N32SCANW.EXE
NAV.EXE
NAVAP.NAVAPSVC.EXE
NAVAPSVC.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVENGNAVEX15.NAVLU32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVSTUB.EXE
NAVW32.EXE
NAVWNT.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NEOWATCHLOG.EXE
NETARMOR.EXE
NETD32.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NETUTILS.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NOD32.EXE
NORMIST.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NOTSTART.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NPSCHECK.EXE
NPSSVC.EXE
NSCHED32.EXE
NSSYS32.EXE
NSTASK32.EXE
NSUPDATE.EXE
NT.EXE
NTRTSCAN.EXE
NTVDM.EXE
NTXconfig.EXE
NUI.EXE
NUPGRADE.EXE
NVARCH16.EXE
NVC95.EXE
NVSVC32.EXE
NWINST4.EXE
NWSERVICE.EXE
NWTOOL16.EXE
OLLYDBG.EXE
ONSRVR.EXE
OPTIMIZE.EXE
OSTRONET.EXE
OTFIX.EXE
OUTPOST.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PandaAVEngine.exe
PANIXK.EXE
PATCH.EXE
PAVCL.EXE
PAVPROXY.EXE
PAVSCHED.EXE
PAVW.EXE
PCCIOMON.EXE
PCCNTMON.EXE
PCCWIN97.EXE
PCCWIN98.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCSCAN.EXE
PDSETUP.EXE
PENIS.EXE
Penis32.exe
PERISCOPE.EXE
PERSFW.EXE
PERSWF.EXE
PF2.EXE
PFWADMIN.EXE
PGMONITR.EXE
PINGSCAN.EXE
PLATIN.EXE
POP3TRAP.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
POWERSCAN.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PRIZESURFER.EXE
PRMT.EXE
PRMVR.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
PROCEXPLORERV1.0.EXE
PROGRAMAUDITOR.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
PUSSY.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAPAPP.EXE
rate.exe
RAV7.EXE
RAV7WIN.EXE
RAV8WIN32ENG.EXE
RAY.EXE
RB32.EXE
RCSYNC.EXE
REALMON.EXE
REGED.EXE
REGEDIT.EXE
REGEDT32.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCAN.EXE
RTVSCN95.EXE
RULAUNCH.EXE
RUN32DLL.EXE
RUNDLL.EXE
RUNDLL16.EXE
RUXDLL32.EXE
SAFEWEB.EXE
SAHAGENT.EXE
SAVE.EXE
SAVENOW.EXE
SBSERV.EXE
SC.EXE
SCAM32.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SCRSVR.EXE
SCVHOST.EXE
SD.EXE
SERV95.EXE
SERVICE.EXE
SERVLCE.EXE
SERVLCES.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SHOWBEHIND.EXE
SMC.EXE
SMS.EXE
SMSS32.EXE
SOAP.EXE
SOFI.EXE
SPERM.EXE
SPF.EXE
SPHINX.EXE
SPOLER.EXE
SPOOLCV.EXE
SPOOLSV32.EXE
SPYXX.EXE
SREXE.EXE
SRNG.EXE
SS3EDIT.EXE
ssate.exe
SSGRATE.EXE
ST2.EXE
START.EXE
STCLOADER.EXE
SUPFTRL.EXE
SUPPORT.EXE
SUPPORTER5.EXE
SVC.EXE
SVCHOSTC.EXE
SVCHOSTS.EXE
SVSHOST.EXE
SWEEP95.EXE
SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
SYMPROXYSVC.EXE
SYMTRAY.EXE
SYSEDIT.EXE
sysinfo.exe
SysMonXP.exe
SYSTEM.EXE
SYSTEM32.EXE
SYSUPD.EXE
TASKMG.EXE
TASKMO.EXE
TASKMON.EXE
TAUMON.EXE
TBSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TDS2-98.EXE
TDS2-NT.EXE
TEEKIDS.EXE
TEST.EXE
TFAK.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRICKLER.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
TSADBOT.EXE
TVMD.EXE
TVTMD.EXE
UNDOBOOT.EXE
UPDAT.EXE
UPDATE.EXE
UPGRAD.EXE
UTPOST.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VET32.EXE
VET95.EXE
VETTRAY.EXE
VFSETUP.EXE
VIR-HELP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC32.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCAN40.EXE
VSCENU6.02D30.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBDAV.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WFINDV32.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
WIMMUN32.EXE
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINNET.EXE
WINPPR32.EXE
WINRECON.EXE
WINSERVN.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
winsys.exe
WINTSK32.EXE
winupd.exe
WINUPDATE.EXE
WKUFIND.EXE
WNAD.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE





Name   W32/Sumom-B

Type  
    * Worm

How it spreads  
    * Chat programs
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Modifies data on the computer
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * WORM_FATSO.B
    * IM-Worm.Win32.Sumom.a

Prevalence (1-5) 2

Description
W32/Sumom-B is an instant messenger and P2P worm.

W32/Sumom-B terinates a large number processes related to anti-virus and 
security programs.

W32/Sumom-B drops and runs a file called Crazy.Html to the root folder 
which tries to display two graphics files from the web.

W32/Sumom-B attempts to overwrite the HOSTS file with the following with 
a predefined list of URLS, preventing access to these websites.

Advanced
W32/Sumom-B is an instant messenger and P2P worm.

W32/Sumom-B copies itself to the files SVOSM.EXE and SYSUP.EXE in the 
Windows system folder, MSMPATCH.EXE in the Windows folder, and to the 
filename DSM.EXE in the root folder.

W32/Sumom-B sets entries at the following locations in the registry so 
as to run these copies of itself on system startup with the name 
"AvSer", "DsmSer" or "rollbk":

HKCU\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

W32/Sumom-B copies itself to the following filenames in the root folder 
which it attempts to send via the Microsoft Windows Messenger to members 
of the infected user's contact list:

One Eye Granny pic!.pif
Me drunk at The Sea!.pif
Punk lives! lol.pif:
Me love you long time.pif
Me pic.pif
Hillbilly chick lol.pif
Dumb looking goth chick.pif
Hot blonde!.pif
Modelling her new bikini.pif
Crazy japanese man kicks crazy frog!.pif
Funny hitler parody!.pif
My birthday pic!.pif

W32/Sumom-B copies itself to the file AUTORUN.EXE in the following 
folder:

Documents and Settings\<username>\Local Settings\Application Data\
Microsoft\CDBurning\

W32/Sumom-B creates the file AUTORUN.INF in the same folder in order to 
run the AUTORUN.EXE copy of itself on startup.

W32/Sumom-B also copies itself to the following folders:

My Shared Folder
Program Files\eMule\Incoming
Document