Text 117, 2140 rader
Skriven 2005-05-28 17:17:00 av KURT WISMER (1:123/140)
Ärende: News, May 28 2005
=========================
[cut-n-paste from sophos.com]

Name   W32/Mytob-CN

Type  
    * Worm

How it spreads  
    * Email messages
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Uses its own emailing engine

Prevalence (1-5) 3

Description
W32/Mytob-CN is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-CN can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer.

Advanced
W32/Mytob-CN is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-CN runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/Mytob-CN can spread by sending itself as an email attachment to 
email addresses it harvests from the infected computer.

Emails sent by the worm have the following characteristics:

Subject:
Security measures
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Email Account Suspension
Notice of account limitation

Message text:
Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.

The original message has been included as an attachment.

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.

We attached some important information regarding your account.

Please read the attached document and follow it's instructions.

When first run W32/Mytob-CN copies itself to <Windows system>\nec.exe.

The following registry entries are created to run nec.exe on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM
nec.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM
nec.exe

W32/Mytob-CN sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-CN modifies the Windows hosts file in order to block access to 
the following security-related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.msn.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
 




Name   W32/Mytob-L

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address

Prevalence (1-5) 3

Description
W32/Mytob-L is a mass-mailing worm with IRC backdoor functionality.

W32/Mytob-L runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels

W32/Mytob-L can spread by sending itself as an email attachment to email 
addresses it harvests from the infected computer.

Emails sent by the worm have the following characteristics:

Subject:
Security measures
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Email Account Suspension
Notice of account limitation

Body:
Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.

The original message has been included as an attachment.

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.

We attached some important information regarding your account.

Please read the attached document and follow it's instructions.

Advanced
W32/Mytob-L is a mass-mailing worm with IRC backdoor functionality.

W32/Mytob-L runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels

W32/Mytob-L can spread by sending itself as an email attachment to email 
addresses it harvests from the infected computer.

Emails sent by the worm have the following characteristics:

Subject:
Security measures
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
Account Alert
Important Notification
*WARNING* Your Email Account Will Be Closed
Email Account Suspension
Notice of account limitation

Body:
Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.

The original message has been included as an attachment.

We regret to inform you that your account has been suspended due to the 
violation of our site policy, more info is attached.

We attached some important information regarding your account.

Please read the attached document and follow it's instructions.

When first run W32/Mytob-L copies itself to 
<Windows system folder>\nec.exe.

The following registry entries are created to run nec.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM
nec.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM
nec.exe

W32/Mytob-L sets the following registry entries, disabling the automatic 
startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-L modifies the Windows hosts file in order to block access to 
the following security-related websites:

127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 virustotal.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.msn.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.virustotal.com





Name   W32/Mytob-I

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Net-Worm.Win32.Mytob.gen
    * W32/Mytob.gen@MM

Prevalence (1-5) 3

Description
W32/Mytob-I is a mass-mailing worm with IRC backdoor functionality.

W32/Mytob-I can spread by sending itself as an email attachment to email 
addresses it harvests from the infected computer, and to computers 
vulnerable to the RCP-DCOM (MS04-012) and LSASS (MS04-011) exploits.

Emails sent by the worm have the following characteristics:

Subject:

Server Report

Sensitive information inside

Important documents

F-R-E-E. American Idol Screen Saver

<random>

Body:

Very cool American Idol Screen Saver.

The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The original message was included as an attachment

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

Advanced
W32/Mytob-I is a mass-mailing worm with IRC backdoor functionality.

W32/Mytob-I can spread by sending itself as an email attachment to email 
addresses it harvests from the infected computer, and to computers 
vulnerable to the RCP-DCOM (MS04-012) and LSASS (MS04-011) exploits. The 
following patches for the operating system vulnerabilities exploited by 
W32/Mytob-I can be obtained from the Microsoft website:

MS04-011
MS04-012

Emails sent by the worm have the following characteristics:

Subject:

Server Report

Sensitive information inside

Important documents

F-R-E-E. American Idol Screen Saver

<random>

Body:

Very cool American Idol Screen Saver.

The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The original message was included as an attachment

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

When first run W32/Mytob-I copies itself to:

C:\american_idols.scr
C:\girl_juggling_monkeys.scr
C:\matrix4_screen_saver.scr
<Windows system folder>\scvhost.exe

The following registry entries are created to run scvhost.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
scvhost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINTASK
scvhost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINTASK
scvhost.exe

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
scvhost.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
scvhost.exe

HKCU\Software\Microsoft\OLE
WINTASK
scvhost.exe

HKLM\SOFTWARE\Microsoft\Ole
WINTASK
scvhost.exe

W32/Mytob-I blocks access to security-related websites by writing the 
folllowing entries to the Windows hosts file:

127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com





Name   W32/Mytob-AN

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine

Aliases  
    * Net-Worm.Win32.Mytob.x

Prevalence (1-5) 2

Description
W32/Mytob-AN is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-AN is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011). Email sent by 
W32/Mytob-AN has the following properties:

Subject line:

document
Good day
Mail Delivery System
Mail Transaction Failed
message
readme
Server Report
Status

Message text:

'This is a multi-part message in MIME format.'

'Mail transaction failed. Partial message is available.'

'The message contains Unicode characters and has been sent as a binary 
attachment.'

'The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.'

'The original message was included as an attachment.'

'Here are your banks documents.'

The attached file consists of a base name followed by the extentions 
PIF, SCR, EXE,CMD or ZIP. The worm may optionally create double 
extensions where the first extension is DOC, TXT or HTM and the final 
extension is PIF, SCR, EXE, CMD or ZIP.

W32/Mytob-AN harvests email addresses from files on the infected 
computer and from the Windows address book.

Advanced
W32/Mytob-AN is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

When first run W32/Mytob-AN copies itself to the Windows system folder 
as wpad.exe and creates the following registry entries:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa\
MS PLUS INC
"wpad.exe"

HKCU\Software\Microsoft\OLE\
MS PLUS INC
"wpad.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
MS PLUS INC
"wpad.exe"

HKLM\SOFTWARE\Microsoft\Ole\
MS PLUS INC
"wpad.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MS PLUS INC
"wpad.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
MS PLUS INC
"wpad.exe"

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
MS PLUS INC
"wpad.exe"

W32/Mytob-AN copies itself to the root folder as:

funny_pic.scr
my_photo2005.scr
see_this!!.scr

and drops a file called hellmsn.exe detected by Sophos Anti-Virus 
products as W32/Mytob-D. This component attempts to spread the worm by 
sending the aforementioned SCR files through Windows Messenger to all 
online contacts.

W32/Mytob-AM also appends the following to the HOSTS file to deny access 
to security related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com

W32/Mytob-AN is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011). Email sent by 
W32/Mytob-AN has the following properties:

Subject line:

document
Good day
Mail Delivery System
Mail Transaction Failed
message
readme
Server Report
Status

Message text:

'This is a multi-part message in MIME format.'

'Mail transaction failed. Partial message is available.'

'The message contains Unicode characters and has been sent as a binary 
attachment.'

'The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.'

'The original message was included as an attachment.'

'Here are your banks documents.'

The attached file consists of a base name followed by the extentions 
PIF, SCR, EXE,CMD or ZIP. The worm may optionally create double 
extensions where the first extension is DOC, TXT or HTM and the final 
extension is PIF, SCR, EXE, CMD or ZIP.

W32/Mytob-AN harvests email addresses from files on the infected 
computer and from the Windows address book. The worm avoids sending 
email to addresses that contain the following:

.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
you





Name   W32/Rizon-B

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer

Aliases  
    * Trojan.Win32.VB.uj
    * W32/Rizon.worm

Prevalence (1-5) 2

Description
W32/Rizon-B is a worm that terminates processes and deletes files.

Advanced
W32/Rizon-B is a worm that terminates processes and deletes files.

W32/Rizon-B attempts to install itself in the Start Menu by copying 
itself to the following folders:

C:\Documents and Settings\All Users\Menu 
Start\Programma's\Opstarten\SoundMAX.exe

H:\Windows NT 5.1 Workstation Profile\Menu 
Start\Programma's\Opstarten\SoundMAX.exe

The worm terminates the following processes:

rclnt.exe
rshelper.exe
srvany.exe
WUOLService.exe
wuser32.exe

W32/Rizon-B deletes the folders C:\NOVELL and C:\progra~1\divace~1 .

The worm makes a copy of the system file cmd.exe named temp.exe in the 
Windows system folder.





Name   W32/Alcra-A

Type  
    * Worm

How it spreads  
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security

Aliases  
    * WORM_ALCAN.A
    * W32.Alcra.A
    * W32/Alcan.worm!p2p
    * P2P-Worm.Win32.Alcan.a
    * W32.Alcra.A

Prevalence (1-5) 2

Description
W32/Alcra-A is a worm for the Windows platform.

W32/Alcra-A drops the files temp.zip, p2pnetwork.exe and bszip.dll to 
the Windows system folder. The temp.zip file is a zipped copy of the 
worm. Bszip.dll is a clean file compression utility. Sophos's anti-virus 
products detect p2pnetwork.exe as W32/Rbot-ACZ.

The worm copies itself into shared folders used by common Peer to Peer 
(P2P) filesharing applications.

Advanced
W32/Alcra-A is a worm for the Windows platform.

When run, W32/Alcra-A copies itself to the following locations:
<Program files folder>/MsConfigs/MsConfigs.exe
/z.tmp

The worm then sets the following registry entry in order to run each 
time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MsConfigs
"<Program files folder>\MsConfigs\MsConfigs.exe"

W32/Alcra-A drops the files temp.zip, p2pnetwork.exe and bszip.dll to 
the Windows system folder. The temp.zip file is a zipped copy of the 
worm. Bszip.dll is a clean file compression utility. Sophos's anti-virus 
products detect p2pnetwork.exe as W32/Rbot-ACZ.

W32/Alcra-A replaces the following system utilities with corrupt files:

cmd.com
netstat.com
ping.com
regedit.com
taskkill.com
tasklist.com
taskmgr.exe
tracert.com

The worm copies itself into shared folders used by common Peer to Peer 
(P2P) filesharing applications where the path to the folder contains any 
of the following:

Ares\My Shared Folder
Bearshare\Shared
Edonkey2000\Incoming
eMule\Incoming
gnucleus\downloads
grokster\my grokster
Kazaa\My Shared Folder
Limewire\Shared
morpheus\My Shared Folder
My Shared Folder
rapigator\share
shareaza\downloads
shared

W32/Alcra-A may also modify documents containing hyperlinks by changing 
the hyperlink destination to point to a predefined URL.





Name   W32/Qeds-A

Type  
    * Worm

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.VB.xb
    * W32/Qeds

Prevalence (1-5) 2

Description
W32/Qeds-A is a virus for the Windows platform.

The virus will attempt to download and execute a file from one of four 
predefined URLs.

W32/Qeds-A will disable Taskmanager and the registry tools before 
copying itself to the Windows system folder, and to the following 
locations as DHelp.dll.

<Windows folder>
<Windows system folder>
<Windows system folder>\wbem

Advanced
W32/Qeds-A is a virus for the Windows platform.

The virus will attempt to download and execute a file from one of four 
predefined URLs.

W32/Qeds-A will disable Taskmanager and the registry tools before 
copying itself to the Windows system folder, and to the following 
locations as DHelp.dll.

<Windows folder>
<Windows system folder>
<Windows system folder>\wbem

W32/Qeds-A will terminate any processes associated of the following 
executables and inject code into the files in order to cause itself to 
be executed when the infected file is executed:

<Windows system folder>\dllcache\notepad.exe
<Windows system folder>\dllcache\\explorer.exe
<Windows system folder>\dllcache\\iexplore.exe
<Windows system folder>\notepad.exe
<Windows folder>\notepad.exe
<Windows folder>\explorer.exe
\Program Files\Internet Explorer\iexplore.exe
<path to file>\QQexternal.exe
<path to file>\TIMPlatform.exe
<path to file>\BugReport.exe
<path to file>\QQ.exe
<path to file>\QQGame.exe

W32/Qeds-A will create or modify the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
"1"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Management Instrumentation
"<executable name>"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
"0"





Name   W32/Rbot-ADA

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security

Aliases  
    * W32/Sdbot.worm.gen
    * WORM_RBOT.AZM

Prevalence (1-5) 2

Description
W32/Rbot-ADA is a worm which attempts to spread to remote network 
shares. It also contains backdoor Trojan functionality, allowing 
unauthorised remote access to the infected computer via IRC channels.

Advanced
W32/Rbot-ADA is a worm which attempts to spread to remote network 
shares. It also contains backdoor Trojan functionality, allowing 
unauthorised remote access to the infected computer via IRC channels.

W32/Rbot-ADA spreads to network shares with weak passwords and via 
network security exploits as a result of the backdoor Trojan element 
receiving the appropriate command from a remote user.

W32/Rbot-ADA copies itself to the Windows system folder with the 
filename SCRTKFG.EXE and creates entries at the following locations in 
the registry with the value "System CSRSS Patch" so as to run itself on 
system startup, resetting these values times multiple times every 
minute:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

W32/Rbot-ADA also sets the following registry entry to point to itself 
with the same value, resetting it multiple times every minute:

HKCU\Software\Microsoft\OLE

W32/Rbot-ADA attempts to set the following registry entries every 2 
minutes:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

W32/Rbot-ADA attempts to delete network shares on the host computer 
every 2 minutes.

W32/Rbot-ADA attempts to terminate a large number of processes related 
to security and anti-virus programs including REGEDIT.EXE, MSCONFIG.EXE 
and NETSTAT.EXE.

W32/Rbot-ADA may attempt to log keystrokes to the file DHANFJF.XML in 
the Windows system folder.





Name   W32/Kipis-U

Type  
    * Worm

How it spreads  
    * Email attachments
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Reduces system security

Aliases  
    * Email-Worm.Win32.Kipis.u
    * W32/Kipis.u@MM
    * W32.Kipis.A@mm
    * WORM_KIPIS.M

Prevalence (1-5) 2

Description
W32/Kipis-U is an email and network share worm and backdoor for the 
Windows platform.

W32/Kipis-U sends itself by email to addresses found on the hard disk of 
the infected computer.

Email sent by the worm has a subject line, message text and attachment 
name in one of 6 languages, English, French, German, Russian, Spanish or 
Ukrainian. The language is chosen according to the domain of the email 
recipient.

W32/Kipis-U runs continuously in the background, providing a backdoor 
server which allows a remote intruder to upload and run arbitrary 
programs on the infected computer.

Advanced
W32/Kipis-U is an email and network share worm and backdoor for the 
Windows platform.

W32/Kipis-U sends itself by email to addresses found on the hard disk of 
the infected computer in files with the following extensions :

ADB
DBX
DHTM
DOC
EML
HTM
MSG
PAB
PHP
SHTM
TBB
TXT
UIN
WAB
XLS

The worm avoids sending email to addresses containing any of the 
following strings:

@avp.
@bitdefen
@borlan
@drweb
@fido
@foo
@iana
@ietf
@kasper
@klamav
@license
@mcafee
@messagelab
@microsof
@mydomai
@nod3
@nodomai
@norman
@panda
@rfc-ed
@somedomai
@sopho
@symante
@usenet
@virusli
abuse@
accoun
admin@
antivir
anyone@
bsd
bugs@
contact@
contract@
f-secur
free-av
google
help@
info@
listserv
mailer-
mozzila
news@
newvir
nobody@
noone@
noreply
notice@
page@
pgp
podpiska@
postmaster@
privacy@
rar@
rating@
register@
root@
sales@
service@
site@
soft@
spm111@
suporte@
support@
technical@
the.bat
update@
virus@
webmaster@
winrar
winzip
you@

Email sent by the worm has a subject line, message text and attachment 
name in one of 6 languages, English, French, German, Russian, Spanish or 
Ukrainian. The language is chosen according to the domain of the email 
recipient.

W32/Kipis-U also attempts to spread to shared folders by copying itself 
to any folder that has 'share' or 'microsof' in its name. The worm uses 
the following filenames when copying to shared folders:

Land Attack(source and files).exe
DDoS bot(src)..scr
Forum Hack.txt.scr
Winamp 6(plugins).exe
Crack collection.scr
NLP.scr
Hack Unix Server(info).scr
Screensaver for Hackers.scr
Windows 2000(source code).scr
Hack Chat.exe
Kaspersy Antivirus Key(ver.5.xx,Pro,Personal).exe

W32/Kipis-U runs continuously in the background, providing a backdoor 
server which allows a remote intruder to upload and run arbitrary 
programs on the infected computer.

When first run W32/Kipis-U copies itself to:

<Windows folder>\regedit.com
<Windows system folder>\Microsoft\iexplore.exe

The following registry entry is created to run iexplore.exe on startup:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe <Windows system folder>\Microsoft\iexplore.exe

The following registry entry is also set:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WOW\boot
shell
<Windows system folder>\Microsoft\iexplore.exe

W32/Kipis-U attempts to disable services that have the follwing strings 
in their names:

anvir
apv
avc
aveng
avg
avk
avp
avw
avx
blackd
blacki
blss
cfi
clean
defwat
drweb
egedit.ex
ewall
fsa
fsm
guard
hijack
hxde
ilemon
kerio
klagent
klamav
luacomserv
minilog.
monitor
mooli
mosta
mpf
nav
neomon
netarm
netspy
nisse
nisum
nod3
norman
normis
norton
outpos
pav
pavsrv
pcc
protect
proxy.
rav
rfw
spider
svc.
syman
taskmgr
tmon
trojan
updat
upgrad
virus
vsmon
zapro.
zonalm
zonea





Name   W32/Agobot-SN

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Steals information
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * W32/Gaobot.worm.gen.j

Prevalence (1-5) 2

Description
W32/Agobot-SN is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Agobot-SN spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including RPC-DCOM (MS04-012) and by 
copying itself to network shares protected by weak passwords.

W32/Agobot-SN runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

Advanced
W32/Agobot-SN is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Agobot-SN spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including RPC-DCOM (MS04-012) and by 
copying itself to network shares protected by weak passwords.

W32/Agobot-SN runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

When first run W32/Agobot-SN copies itself to <System>\hmlsvc32.exe.

The following registry entries are created to run hmlsvc32.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HPl Services
hmlsvc32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPl Services
hmlsvc32.exe

W32/Agobot-SN modifies the HOSTS file, changing the URL to IP mappings 
for selected websites, thus preventing normal access to these sites, by 
adding the following entries:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com





Name   Troj/Molehut-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.Mole.f
    * MoleHut

Prevalence (1-5) 2

Description
Troj/Molehut-A is a Trojan for the Windows platform.

Troj/Molehut-A will move itself to the Windows system folder as System.

Advanced
Troj/Molehut-A is a Trojan for the Windows platform.

Troj/Molehut-A will move itself to the Windows system folder as System.

The Trojan will then create several entries under the following registry 
entry:

HKCU\Software\Microsoft\Mole

The Trojan will also create the following registry entry:

HKLM\Software\Policies\Microsoft\Internet 
Explorer\Infodelivery\Restrictions
NoSplash
1





Name   W32/Mytob-AK

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine

Aliases  
    * WORM_MYTOB.BT

Prevalence (1-5) 2

Description
W32/Mytob-AK is a mass-mailing worm with IRC backdoor functionality for 
the windows platform..

W32/Mytob-AK is capable of spreading through operating system 
vulnerabilities, including the LSASS (MS04-011) exploit.

W32/Mytob-AK can harvest email addresses from files on the infected 
computer and from the Windows address book.

Emails sent by the worm have the following characteristics:

Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
<blank>

Message body:
The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

The original message was included as an attachment,

Here are your bank documents

Advanced
W32/Mytob-AK is a mass-mailing worm with IRC backdoor functionality for 
the windows platform..

W32/Mytob-AK is capable of spreading through operating system 
vulnerabilities, including the LSASS (MS04-011) exploit. The following 
patches for the operating system vulnerabilities exploited by 
W32/Mytob-AK can be obtained from the Microsoft website:

MS04-011

W32/Mytob-AK can harvest email addresses from files on the infected 
computer and from the Windows address book.

Emails sent by the worm have the following characteristics:

Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
<blank>

Message body:
The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

The original message was included as an attachment,

Here are your bank documents

W32/Mytob-AK copies itself to the Windows system folder as 
"taskgmr32.exe" or "t4skmgr.exe" and creates the following registry 
entries in order to run automatically on computer logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WINTASK

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK

The worm also creates the following registry entries to point to itself:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa\
WINTASK

HKCU\Software\Microsoft\OLE\
WINTASK

HKLM\SOFTWARE\Microsoft\Ole\
WINTASK

W32/Mytob-AK copies itself to the root folder with the following 
filenames:

funny_pic.scr
my_photo2005.scr
see_this!!.scr

W32/Mytob-AK blocks access to security-related websites by writing the 
following entries to the Windows hosts file:

127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com

W32/Mytob-AK may create a new file detected by Sophos as W32/Mytob-D.





Name   Troj/RNWatch-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information

Prevalence (1-5) 2

Description
Troj/RNWatch-A is a backdoor Trojan for the Windows platforms.

Advanced
Troj/RNWatch-A is a backdoor Trojan for the Windows platforms.

Once executed Troj/RNWatch-A copies itself to the Windows system folder 
with the filenames winierun.exe and bfwinier.exe, and in order to be 
able to run automatically when Windows starts up sets the registry 
entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinIeRun
"winierun.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinIeRun
"winierun.exe"





Name   W32/Agobot-ATK

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information

Aliases  
    * WORM_AGOBOT.ATK
    * W32.HLLW.Gaobot
    * W32/Sdbot.worm.gen.bj

Prevalence (1-5) 2

Description
W32/Agobot-ATK is a network worm with backdoor functionality for the 
Windows platform.

W32/Agobot-ATK spreads through network shares protected by weak 
passwords and through various unpatched operating system vulnerabilities.

Advanced
W32/Agobot-ATK is a network worm with backdoor functionality for the 
Windows platform.

When run, W32/Agobot-ATK copies itself to the Windows system folder as 
hmlsvc32.exe and sets the following registry entries in order to run 
each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HPl Services
hmlsvc32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HPl Services
hmlsvc32.exe

The backdoor component joins a predetermined IRC channel and awaits 
commands from a remote user.

W32/Agobot-ATK spreads through network shares protected by weak 
passwords and through various unpatched operating system vulnerabilities.





Name   W32/Banish-A

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer
    * Uses its own emailing engine
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Banish-A is a mass-mailing worm.

Emails sent by the worm have the following characteristics:

Subject line:

OK. Read the attached instructions to solve the problem.
Here are the details.
Re: Thank you for your choice.
Thank you for shopping. This mail contains your invoice.
Thank you. Your credit card was processed successfully.

Attached file:
A filename chosen from those in the current user's "Recent Documents" 
folder.

W32/Banish-A also spreads by exploiting the following vulnerabilities:

LSASS (MS04-011)
IIS5 (MS04-011)

W32/Banish-A contains the following message:

ExiliuM SerieS A
In honour to all the people that were, are, or will be forced
to leave their homelands. NO MORE EXILED PEOPLE, NO MORE WARS
(c)ThE ExpaTRiatE 2005

Advanced
W32/Banish-A is a mass-mailing worm.

W32/Banish-A submits queries to popular search engines in order to find 
email addresses to which to send itself.

Emails sent by the worm have the following characteristics:

Subject line:

OK. Read the attached instructions to solve the problem.
Here are the details.
Re: Thank you for your choice.
Thank you for shopping. This mail contains your invoice.
Thank you. Your credit card was processed successfully.

Attached file:
A filename chosen from those in the current user's "Recent Documents" 
folder.

W32/Banish-A also spreads by exploiting the following vulnerabilities:

LSASS (MS04-011)
IIS5 (MS04-011)

When first run, W32/Banish-A copies itself to one of the following 
filenames in the Windows folder:

smss.exe
lsass.exe
csrss.exe
services.exe
winlogon.exe

The worm installs itself as a service with the name "Windows Object 
Manager". The other characteristics of this service are copied from one 
of the already-existing services, chosen at random.

W32/Banish-A deletes any files found in the "repair" subfolder of the 
Windows folder.

W32/Banish-A contains the following message:

ExiliuM SerieS A
In honour to all the people that were, are, or will be forced
to leave their homelands. NO MORE EXILED PEOPLE, NO MORE WARS
(c)ThE ExpaTRiatE 2005





Name   W32/Rbot-UH

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Uses its own emailing engine
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Rbot.gen

Prevalence (1-5) 2

Description
W32/Rbot-UH is a worm with backdoor functionality.

W32/Rbot-UH is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

W32/Rbot-UH will attempt to spread by exploiting the DCOM (MS04-012) and 
LSASS (MS04-011) software vulnerabilities and to computers running 
Microsoft SQL servers with weak passwords

Advanced
W32/Rbot-UH is a worm with backdoor functionality.

W32/Rbot-UH is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

W32/Rbot-UH will attempt to spread by exploiting the following 
vulnerabilities:

DCOM (MS04-012)
LSASS (MS04-011)
Microsoft SQL servers with weak passwords.

When first run, W32/Rbot-UH copies itself to the Windows system folder 
as MCAFESHIELD.EXE and runs this copy of the worm. The copy will then 
attempt to delete the original file. In order to run each time a user 
logs in, W32/Rbot-UH will set the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Mcafee Auto Protect
mcafeshield.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Mcafee Auto Protect
mcafeshield.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Mcafee Auto Protect
mcafeshield.exe

The worm runs continuously in the background providing backdoor access 
to the infected computer.

The backdoor component of W32/Rbot-UH can be used to:

Initiate Distributed Denial-of-Service (DDoS) attacks.
Redirect TCP and SOCKS4 traffic.
Provide a remote login command shell.
Download, upload, delete and execute files.
Set up an HTTP, TFTP and FTP file server.
Steal passwords (including PayPal account information).
Log key presses and clipboard data.
Capture screenshots, webcam pictures and videos.
List and kill processes.
Stop, start, pause and delete services.
Open and close vulnerabilities.
Port scan for vulnerabilities on other remote computers.
Send emails as specified by the remote user.
Flush the DNS and ARP caches.
Shut down and reboot the computer.
Add and delete network shares, groups and users.
Sniff network traffic for passwords.
Send Net Messages.

W32/Rbot-UH can be used to steal registration and key details from 
several computer games and applications including:

Battlefield 1942
Battlefield 1942 (Road To Rome)
Battlefield 1942 (Secret Weapons of WWII)
Battlefield Vietnam
Black and White
Chrome
Command and Conquer: Generals
Command and Conquer: Generals (Zero Hour)
Command and Conquer: Red Alert
Command and Conquer: Red Alert 2
Command and Conquer: Tiberian Sun
Counter-Strike
Far Cry
FIFA 2002
FIFA 2003
Freedom Force
Global Operations
Ground Control II
Gunman Chronicles
Half-Life
Hidden & Dangerous 2
IGI 2: Covert Strike
Industry Giant 2
James Bond 007: Nightfire
Joint Operations: Typhoon Rising
Legends of Might and Magic
Medal of Honor: Allied Assault
Medal of Honor: Allied Assault: Breakthrough
Medal of Honor: Allied Assault: Spearhead
Microsoft Windows Product ID
Nascar Racing 2002
Nascar Racing 2003
Need For Speed Hot Pursuit 2
Need For Speed: Underground
Neverwinter Nights
Neverwinter Nights (Hordes of the Underdark)
Neverwinter Nights (Shadows of Undrentide)
NHL 2002
NHL 2003
NOX
Rainbow Six III RavenShield
Shogun: Total War: Warlord Edition
Soldier of Fortune II - Double Helix
Soldiers Of Anarchy
The Gladiators
Unreal Tournament 2003
Unreal Tournament 2004

W32/Rbot-UH will alter the following registry entries in order to 
enable/disable DCOM and open/close restrictions on IPC$ shares:

HKLM\Software\Microsoft\Ole\EnableDCOM

HKLM\System\CurrentControlSet\Control\Lsa\restrictanonymous

W32/Rbot-UH is capable of altering the following registry entry to 
restrict anonymous enumeration of SAM accounts:

HKLM\System\CurrentControlSet\Control\Lsa\restrictanonymousSAM

W32/Rbot-UH can add and delete network shares and users on the infected 
computer. The worm can also change the network logon rights of accounts 
in the local system policy.





Name   W32/Sdbot-YT

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.SdBot.yn
    * W32/Sdbot.worm.gen.i
    * W32.Randex
    * WORM_SDBOT.BVI

Prevalence (1-5) 2

Description
W32/Sdbot-YT is a network worm with IRC backdoor functionality.

W32/Sdbot-YT allows a remote attacker to control the infected computer 
through an IRC connection.

Advanced
W32/Sdbot-YT is a worm with IRC backdoor functionality for the Windows 
platform.

W32/Sdbot-YT spreads to other network computers infected with certain 
types of malware and by copying itself to network shares protected by 
weak passwords.

W32/Sdbot-YT runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

When first run W32/Sdbot-YT copies itself to 
<Windows system folder>\aim.exe.

The following registry entries are created to run aim.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AOL Instant Messanger
aim.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
AOL Instant Messanger
aim.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AOL Instant Messanger
aim.exe





Name   Troj/Zlob-H

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Downloader-XC

Prevalence (1-5) 2

Description
Troj/Zlob-H is a downloader Trojan.

Troj/Zlob-H attempts to stealth itself by injecting itself into 
EXPLORER.EXE or by registering itself as a service process.

Troj/Zlob-H attempts to download information from one of the following 
websites:

dumpserv.com
zxserv0.com
vnp7s.net

Troj/Zlob-H will also try to download files from these websites to the 
LogFiles subfolder of the Windows system with a filename based on the 
information it downloaded previously, and it may then execute the 
downloaded file.

Advanced
Troj/Zlob-H is a downloader Trojan.

Troj/Zlob-H creates the following entry in the registry so as to run 
itself on system startup, assuming it is called MSMSGS.EXE in a suitable 
folder:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
notepad.exe
"msmsgs.exe"

Troj/Zlob-H also adds MSMSGS.EXE to the following registry entry so as 
to run itself on system startup:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell

Troj/Zlob-H creates a registry entry at the following location:

HKLM\Software\Microsoft\Windows\CurrentVersion
uuid

Troj/Zlob-H attempts to stealth itself by injecting itself into 
EXPLORER.EXE or by registering itself as a service process.

Troj/Zlob-H attempts to download information from one of the following 
websites:

dumpserv.com
zxserv0.com
vnp7s.net

Troj/Zlob-H will also try to download files from these websites to the 
LogFiles subfolder of the Windows system with a filename based on the 
information it downloaded previously, and it may then execute the 
downloaded file.

 
--- MultiMail/Win32 v0.43
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)