Text 136, 2174 rader
Skriven 2005-09-04 19:34:00 av KURT WISMER (1:123/140)
Ärende: News, September 4 2005
==============================
[cut-n-paste from sophos.com]

Name   W32/Lebreat-F

Type  
    * Worm

How it spreads  
    * Email messages
    * Network shares
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 3

Description
W32/Lebreat-F is a mass-mailing worm and backdoor for the Windows 
platform.

W32/Lebreat-F spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including LSASS (MS04-011) and PnP 
(MS05-039).

W32/Lebreat-F also contains the functionality to act as an ftp server 
allowing access to remote users.

W32/Lebreat-F will also attempt to download and execute a file from a 
predefined URL. This file was not available at the time of analysis.

W32/Lebreat-F will also send itself to email addressed harvested from 
the infected computer with the following attributes:

Subject line:

Changes..
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
Re: Incoming Msg
Re: Message Notify
Re: Msg reply
Re: Protected message
Re: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes
Update

Message text:

Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Encrypted document
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach.
See attach.
See the attached file for details.
Try this.
webmaster
Your document is attached.
Your file is attached.

The following patches for the operating system vulnerabilities 
exploited by W32/Lebreat-F can be obtained from the Microsoft website:
MS04-011
MS05-039

Advanced
W32/Lebreat-F is a mass-mailing worm and backdoor for the Windows 
platform.

W32/Lebreat-F spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including LSASS (MS04-011) and PnP 
(MS05-039).

W32/Lebreat-F also contains the functionality to act as an ftp server 
allowing access to remote users.

W32/Lebreat-F will also attempt to download and execute a file from a 
predefined URL. This file was not available at the time of analysis.

W32/Lebreat-F will also send itself to email addressed harvested from 
the infected computer with the following attributes:

Subject line:

Changes..
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
Re: Incoming Msg
Re: Message Notify
Re: Msg reply
Re: Protected message
Re: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes
Update

Message text:

Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Encrypted document
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach.
See attach.
See the attached file for details.
Try this.
webmaster
Your document is attached.
Your file is attached.

Emails will appear to come from the following domains:

aol.com
ca.com
f-secure.com
kaspersky.com
mcafee.com
microsoft.com
msn.com
sarc.com
security.com
securityfocus.com
sophos.com
symantec.com
trendmicro.com
yahoo.com

W32/Lebreat-F avoids sending to addresses containing the following 
text:

@messagelab
@microsoft
anyone@
certific
contract@
f-secur
free-av
gold-certs@
google
icrosoft
listserv
nobody@
noone@
noreply
norton
postmaster@
rating@
samples
support
update
winrar
winzip

W32/Lebreat-F will move itself to the Windows system folder and 
create the following registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winhost
<Windows system folder>\winhost.exe

W32/Lebreat-F will also copy itself to the following files located in 
the Windows system folder:

<several spaces>.exe
e images.exe
e.doc<several spaces>.exe
Windows Sourcecode update.doc<several spaces>.exe
winhost.tmp

W32/Lebreat-F removes a large number of registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Lebreat-F copies itself to any folders with names containing 
'shar' with the following filenames:

XXX hardcore images.exe
Windown Longhorn Beta Leak.exe
WinAmp 6 New!.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
New patch.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Office 2003 Crack, Working!.exe
Kaspersky Antivirus 5.0.exe
Ahead Nero 7.exe

W32/Lebreat-F will drop files to the following locations:

<Windows folder>\beagle.exe (detected as W32/Bagle-BW)
<Windows system folder>\beagle.exe (detected as W32/Bagle-BW)
<Windows folder>scan.exe (detected as W32/Lilbre-A)
<Windows folder>\sgm32.dll (harmless can safely be removed)
<Windows system folder>\mcafee.exe (detected as W32/Lilbre-A)

W32/Lebreat-F will append the following to the HOSTS file in order to 
block access to security related URLs:

127.0.0.1 ca.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mcafee.com
127.0.0.1 pandasoftware.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 us.mcafee.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.sarc.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.trendmicro.com

The following patches for the operating system vulnerabilities 
exploited by W32/Lebreat-F can be obtained from the Microsoft website:
MS04-011
MS05-039





Name   W32/Tilebot-B

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Deletes files off the computer
    * Steals information
    * Drops more malware

Aliases  
    * WORM_SDBOT.BVR

Prevalence (1-5) 2

Description
W32/Tilebot-B is a worm that attempts to spread to remote network 
shares. It also contains backdoor functionality, allowing 
unauthorized remote access to the infected computer via IRC channels.

W32/Tilebot-B spreads to network shares with weak passwords as a 
result of the backdoor Trojan element receiving the appropriate 
command from a remote user.

W32/Tilebot-B allows a remote user to perform a wide range of actions 
on the infected computer including downloading further files, setting 
registry entries and stealing information from the computer including 
from protected storage areas.

W32/Tilebot-B attempts to interfere with and disable certain security 
related processes.

Advanced
W32/Tilebot-B is a worm that attempts to spread to remote network 
shares. It also contains backdoor functionality, allowing 
unauthorized remote access to the infected computer via IRC channels.

W32/Tilebot-B spreads to network shares with weak passwords as a 
result of the backdoor Trojan element receiving the appropriate 
command from a remote user.

W32/Tilebot-B copies itself to the Windows folder with the filename 
tsecure.exe and creates a service named "tsecure" in order to run 
itself on system startup, to which it gives the fake description 
"Terminal Security".

W32/Tilebot-B allows a remote user to perform a wide range of actions 
on the infected computer including downloading further files, setting 
registry entries and stealing information from the computer including 
from protected storage areas.

W32/Tilebot-B attempts to terminate services with the following names 
in order to disrupt various security processes including the Windows 
firewall and Windows critical updates:

Tlntsvr
RemoteRegistry
Messenger
SharedAccess
wscsvc

W32/Tilebot-B attempts to set the following registry entries to 
disrupt various security processes:

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\
AutoUpdate
AUOptions
1

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restictanonymous
1

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAlloxXPSP2
1

HKLM\SOFTWARE\Microsoft\OLE
EnableDCOM
"N"

W32/Tilebot-B may also set entries in the registry at the following 
locations:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
MeltMe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Installed Time

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Record

HKLM\SYSTEM\CurrentControlSet\Control
WaitToKillServiceTimeout

W32/Tilebot-B attempts to remove network shares from the infected 
computer, as well as changing the policy for SeNetworkLogonRight for 
the computer.

W32/Tilebot-B may attempt to contact scripts hosted on the following 
domains:

cgi14.plala.or.jp
hpcgi1.nifty.com
www.age.ne.jp
www.kinchan.net
www2.dokidoki.ne.jp
yia.s22.xrea.com

W32/Tilebot-B may attempt to drop the file RDRIV.SYS and set up a 
service for it named RDRIV. This file is currently detected by 
Sophos's anti-virus products as Troj/Rootkit-W.





Name   Troj/Bardus-A

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Deletes files off the computer
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Bardus-A is a backdoor and keylogging Trojan for the Windows 
platform.

Troj/Bardus-A can also be registered as a service, steal product 
registration keys, retrieve system information, and delete system 
files 

Advanced
Troj/Bardus-A is a backdoor and keylogging Trojan for the Windows 
platform.

When first run Troj/Bardus-A copies itself to <Windows>\msnmsgr.exe.

The following registry entry is created to run msnmsgr.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSN Messenger
<Windows>\msnmsgr.exe

Troj/Bardus-A can also be registered as a service, steal product 
registration keys, retrieve system information, and delete system 
files.





Name   W32/Dref-D

Type  
    * Worm

How it spreads  
    * Email attachments
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Uses its own emailing engine
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Drefir.f

Prevalence (1-5) 2

Description
W32/Dref-D is a worm for the Windows platform that spreads via IRC 
channels and by emailing itself to email addresses harvested from the 
infected computer.

W32/Dref-D may arrive in the email message with the following 
characteristics:

Subject line: chosen from
Resume
Your Files
Your Stuff
My Story
Re:

Message text: chosen from
here are the pictures you asked me to send you.
please read again what i have written to you !
here are the programms you asked me to mail you
for any help,mail me back
here are the porn screen saver you asked me to show you...
just read it,its fantastic

Attached file: chosen from
pictures.rar
info.rar
package1.rar
porn.rar
My Life.rar
pictures.JPG...pif
mail_READ.txt...scr
musicbox.MP3.pif
linda.scr
Story.scr

W32/Dref-D also attempts to establish a connection with the one of 
the following IRC servers, using a nickname randomly chosen from a 
predefined list:

us.undernet.org
eu.undernet.org
irc.dal.net
irc.rizon.net
irc.us.ircnet.net
random.ircd.de
irc.ircnet.ee
irc.fr.ircnet.net
irc.quakenet.org

If a connection is successfully established,, W32/Dref-D sends a 
message with a link to a site that contains a copy of the worm with a 
filename chosen from the following:

AsianPorno4Free.scr
DivXPorno.pif
DivXPorno.pif
DixPorno.scr
EuroSex4Free.pif
Extream-Hardcore-XXX.pif
Family_Sex.com
Family_Sex.com
Fix_Mirc.exe
FreeAmateurPorno.pif
Free-Hardcore-Sex.rar
Free-Porno-Gallery.exe
HardCore-XXX-Pictures.scr
Hardcore-XXX-Porno.rar
HiddenXXXPhotos.rar
Hot_Girls_Sucking_Dicks.scr
Hot-XXX-Pictures-Collection.rar
jenna_family.scr
JennaAndKelly.com
MircSecurity.exe
nude-gallery.com
porno.pif
PornPicturesCollection.rar
SecurityUpdate.exe
Sex4Free.pif
sex-cum-4free.pif
SEX-mirc-Access.rar
SystemFix.exe
SystemRepair.exe
Tiny_Woman_Swallows.pif
TrialXXXView.scr
Trojan-Remover.exe
Vivid_Sex_Trial.exe
Vivid-Sex.com
Webcam.com
Windows_Update.exe
WinXP_Mirc_Fix.exe
XXX-PORNO-LIBRARY.com
YoungFreshPussy.exe

The message sent is constructed from the following strings:

a full galery of
a full library of
and tell me what is your opinion
and tell me what you think,please
AsianPorno4Free
check out
check out -->
DivXPorno.pif
DixPorno
do you want to get yourself
download the free viewer at >
EuroSex4Free
ever wanted to have access to
excuse me,but its seems that
Extream-Hardcore-XXXFreeAmateurPorno
family
Family_Sex.com
for free porn galerys...
free europen porn ! get it now from ===>>>
free porno movies
Free-Hardcore-Sex
FreeMp3Downloader
gallery
good quality
hardcore porno
hardcore xxx porno for free !
HardCore-XXX-Pictures
Hardcore-XXX-Porno
hey,how you doing?
hey,i think that
hi,i can see that
HiddenXXXPhotos
high resolution
HomeWork
Hot-XXX-Pictures-Collection
how is my
hundred of
if so,just download the free trial viewer from ->
intersting in porno ?,wanna get free access,check out -->
its looking like that
jenna_family
JennaAndKelly
just double click on :
just download the free movie from
looking for
looking for some hot porn ?
LoveMe
Mp3B0x
need free porn ?
no need to wait,get the access now from ->
nude pictures
nude-gallery
Photos
please download a fix from ->
please download repair tool from ->
please install the new patch so you will be protected
please install this security update ->
please visit my
porn movie
porn pictures
PornPicturesCollection
searching for
Sex4Free
sex-cum-4free
SEX-mirc-Access
short porno movies
so get yourself ASAP this repair from
take a look at
take a look at ->
take a look at my
Tiny_Woman_Swallows
TrialXXXView
Vivid_Sex_Trial
Vivid-SexFree-Porno-Gallery
wanna have a free trial at porn sites all over the world ?,get this =>
wanna see hot girls for free ?
wants free 30 days trial at porn gallerys ?,check out >
wants to have access to free DVD porn download =>
web site
webcam pictures
WebcamHot_Girls_Sucking_Dicks
what do you think about my
whats up?
would you like to download
xxx movies
XXX-PORNO-LIBRARY
you are infected with a trojan...
you are using a vulnerable version of mirc
You can find DVD Quality Amateur Porn Movies here =>
YoungFreshPussy
your computer is vulnerable to the new mirc exploit
your mirc is sending spam
your windows is not patched...
Your_Search

Advanced
W32/Dref-D is a worm for the Windows platform that spreads via IRC 
channels and by emailing itself to email addresses harvested from the 
infected computer.

W32/Dref-D may arrive in the email message with the following 
characteristics:

Subject line: chosen from
Resume
Your Files
Your Stuff
My Story
Re:

Message text: chosen from
here are the pictures you asked me to send you.
please read again what i have written to you !
here are the programms you asked me to mail you
for any help,mail me back
here are the porn screen saver you asked me to show you...
just read it,its fantastic

Attached file: chosen from
pictures.rar
info.rar
package1.rar
porn.rar
My Life.rar
pictures.JPG...pif
mail_READ.txt...scr
musicbox.MP3.pif
linda.scr
Story.scr

W32/Dref-D also attempts to establish a connection with the one of 
the following IRC servers, using a nickname randomly chosen from a 
predefined list:

us.undernet.org
eu.undernet.org
irc.dal.net
irc.rizon.net
irc.us.ircnet.net
random.ircd.de
irc.ircnet.ee
irc.fr.ircnet.net
irc.quakenet.org

If a connection is successfully established,, W32/Dref-D sends a 
message with a link to a site that contains a copy of the worm with a 
filename chosen from the following:

AsianPorno4Free.scr
DivXPorno.pif
DivXPorno.pif
DixPorno.scr
EuroSex4Free.pif
Extream-Hardcore-XXX.pif
Family_Sex.com
Family_Sex.com
Fix_Mirc.exe
FreeAmateurPorno.pif
Free-Hardcore-Sex.rar
Free-Porno-Gallery.exe
HardCore-XXX-Pictures.scr
Hardcore-XXX-Porno.rar
HiddenXXXPhotos.rar
Hot_Girls_Sucking_Dicks.scr
Hot-XXX-Pictures-Collection.rar
jenna_family.scr
JennaAndKelly.com
MircSecurity.exe
nude-gallery.com
porno.pif
PornPicturesCollection.rar
SecurityUpdate.exe
Sex4Free.pif
sex-cum-4free.pif
SEX-mirc-Access.rar
SystemFix.exe
SystemRepair.exe
Tiny_Woman_Swallows.pif
TrialXXXView.scr
Trojan-Remover.exe
Vivid_Sex_Trial.exe
Vivid-Sex.com
Webcam.com
Windows_Update.exe
WinXP_Mirc_Fix.exe
XXX-PORNO-LIBRARY.com
YoungFreshPussy.exe

The message sent is constructed from the following strings:

a full galery of
a full library of
and tell me what is your opinion
and tell me what you think,please
AsianPorno4Free
check out
check out -->
DivXPorno.pif
DixPorno
do you want to get yourself
download the free viewer at >
EuroSex4Free
ever wanted to have access to
excuse me,but its seems that
Extream-Hardcore-XXXFreeAmateurPorno
family
Family_Sex.com
for free porn galerys...
free europen porn ! get it now from ===>>>
free porno movies
Free-Hardcore-Sex
FreeMp3Downloader
gallery
good quality
hardcore porno
hardcore xxx porno for free !
HardCore-XXX-Pictures
Hardcore-XXX-Porno
hey,how you doing?
hey,i think that
hi,i can see that
HiddenXXXPhotos
high resolution
HomeWork
Hot-XXX-Pictures-Collection
how is my
hundred of
if so,just download the free trial viewer from ->
intersting in porno ?,wanna get free access,check out -->
its looking like that
jenna_family
JennaAndKelly
just double click on :
just download the free movie from
looking for
looking for some hot porn ?
LoveMe
Mp3B0x
need free porn ?
no need to wait,get the access now from ->
nude pictures
nude-gallery
Photos
please download a fix from ->
please download repair tool from ->
please install the new patch so you will be protected
please install this security update ->
please visit my
porn movie
porn pictures
PornPicturesCollection
searching for
Sex4Free
sex-cum-4free
SEX-mirc-Access
short porno movies
so get yourself ASAP this repair from
take a look at
take a look at ->
take a look at my
Tiny_Woman_Swallows
TrialXXXView
Vivid_Sex_Trial
Vivid-SexFree-Porno-Gallery
wanna have a free trial at porn sites all over the world ?,get this =>
wanna see hot girls for free ?
wants free 30 days trial at porn gallerys ?,check out >
wants to have access to free DVD porn download =>
web site
webcam pictures
WebcamHot_Girls_Sucking_Dicks
what do you think about my
whats up?
would you like to download
xxx movies
XXX-PORNO-LIBRARY
you are infected with a trojan...
you are using a vulnerable version of mirc
You can find DVD Quality Amateur Porn Movies here =>
YoungFreshPussy
your computer is vulnerable to the new mirc exploit
your mirc is sending spam
your windows is not patched...
Your_Search

W32/Dref-D chooses a nickname from the following list:
Aretina
Amorita
Alysia
Aldora
Barbra
Briana
Bridget
Blenda
Bettina
Caitlin
Chelsea
Clarissa
Carmen
Camille
Damita
Danielle
Evelyn
Gloria
Isabel
Juliet
Joanna
Katrina
Kassia
Lolita
Melody
Natalie
Nicole
Olivia
Pamela
Rachel
Silver
Sharon
Vanessa
Valora
Violet
Vivian
Xandra

When first run W32/Dref-D copies itself to <System>\SysDref.exe.

The following registry entries are created to run SysDref.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
DrefIW
<System>\SysDref.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DrefIW
<System>\SysDref.exe

W32/Dref-D sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Dref-D terminates a number of anti-virus and security-related 
applications.





Name   Troj/Keylog-AM

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Records keystrokes

Aliases  
    * Trojan.PWS.QQPass
    * Spy-Agent.dll

Prevalence (1-5) 2

Description
Troj/Keylog-AM is a Trojan DLL that provides keylogging functionality.

Troj/Keylog-AM may in particular attempt to steal passwords and 
monitor internet usage.

Advanced
Troj/Keylog-AM is a Trojan DLL that provides keylogging functionality.

Troj/Keylog-AM may in particular attempt to steal passwords and 
monitor internet usage.

Stolen information may be stored in the following files:

<System>\sys32me.ini
<System>\sys32bin.ini





Name   W32/Rbot-ALG

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * W32.Spybot.UOL

Prevalence (1-5) 2

Description
W32/Rbot-ALG is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ALG spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: PNP (MS05-039), LSASS 
(MS04-011) and RPC-DCOM (MS04-012) and by copying itself to network 
shares protected by weak passwords.

W32/Rbot-ALG runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

The following patches for the operating system vulnerabilities 
exploited by W32/Rbot-ALG can be obtained from the Microsoft website:

MS04-011
MS04-012
MS05-039

Advanced
W32/Rbot-ALG is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ALG spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: PNP (MS05-039), LSASS 
(MS04-011) and RPC-DCOM (MS04-012) and by copying itself to network 
shares protected by weak passwords.

W32/Rbot-ALG runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-ALG copies itself to <System>\qsecue.exe.

The following registry entries are created to run qsecue.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Quantifier Security
qsecue.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Quantifier Security
qsecue.exe

Registry entries are set as follows:

HKCU\Software\Microsoft\OLE
Quantifier Security
qsecue.exe

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Once installed, W32/Rbot-ALG will attempt to perform the following 
actions when instructed to do so by a remote attacker:

capture keystrokes
terminate threads and processes
perform port scanning on IP addresses
steal computer system hardware information
copy itself to network shared folders
download files from the Internet and run them
participate in denial of service (DoS) attacks
perform DCC file transfers over IRC channels
act as a HTTP proxy
setup a SOCKS4 server

The following patches for the operating system vulnerabilities 
exploited by W32/Rbot-ALG can be obtained from the Microsoft website:

MS04-011
MS04-012
MS05-039





Name   Troj/PurScan-W

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Drops more malware

Aliases  
    * Trojan-Dropper.Win32.PurityScan.l

Prevalence (1-5) 2

Description
Troj/PurScan-W is a dropper Trojan for the Windows platform that also 
changes the browser security settings and attempts to open predefined 
URL.

Advanced
Troj/PurScan-W is a dropper Trojan for the Windows platform that also 
changes the browser security settings and attempts to open predefined 
URL.

Once executed Troj/PurScan-W drops to the Temp folder and runs 
installer.exe and mt-uninstaller.exe which are adware related 
installer and uninstaller.

Also Troj/PurScan-W changes the browser security settings by 
modifying registry entries under the following entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings\Zones\3

Troj/PurScan-W tries to establish an internet connection in attempt 
to download files from the predefined web location.





Name   Troj/Nailpol-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Nailpol-A is a Trojan for the Windows platform.

Troj/Nailpol-A contains functionality to download further malicious 
code.

Troj/Nailpol-A may monitor the internet usage of an infected computer.

Advanced
Troj/Nailpol-A is a Trojan for the Windows platform.

When first run Troj/Nailpol-A copies itself to the Windows system 
folder using randomly generated filenames.

Troj/Nailpol-A may inject code into other processes in order to stay 
active. When a Trojan process is terminated, the Trojan may be 
restarted under a new filename.

Troj/Nailpol-A contains functionality to download further malicious 
code.

Troj/Nailpol-A may monitor the internet usage of an infected computer.

Troj/Nailpol-A creates a randomly named registry entry in the 
following location in order to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run





Name   Troj/Litebot-D

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Litebot-D is a Trojan for the Windows platform.

Troj/Litebot-D runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
Troj/Litebot-D is a Trojan for the Windows platform.

Troj/Litebot-D runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run Troj/Litebot-D copies itself to the Windows system 
folder and creates the file \%CurrentFolder%\uninst.bat.

The following registry entry is created to run Troj/Litebot-D on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
support-reverse-smileys
<System>\<original Trojan filename>





Name   W32/Tilebot-M

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Aimbot.ae
    * W32.Spybot.Worm

Prevalence (1-5) 2

Description
W32/Tilebot-M is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-M spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including PNP (MS05-039).

W32/Tilebot-M runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-M includes functionality to access the internet and 
communicate with a remote server via HTTP.

W32/Tilebot-M drops a file detected as Troj/Rootkit-W.

The following patch for the operating system vulnerability exploited 
by W32/Tilebot-M can be obtained from the Microsoft website:

MS05-039

Advanced
W32/Tilebot-M is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-M spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including PNP (MS05-039).

W32/Tilebot-M runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-M includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-M copies itself to 
<Windows folder>\msdnupdate32 and creates the file 
<Windows system folder>\rdriv.sys.

The file rdriv.sys is detected as Troj/Rootkit-W.

The file rdriv.sys is registered as a new system driver service named 
"rdriv", with a display name of "rdriv". Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

The file msdnupdate32 is registered as a new system driver service 
named "msdnupdate32", with a display name of "Msdn Update 32" and a 
startup type of automatic, so that it is started automatically during 
system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\msdnupdate32\

W32/Tilebot-M sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

The following patch for the operating system vulnerability exploited 
by W32/Tilebot-M can be obtained from the Microsoft website:

MS05-039





Name   Troj/Dloader-SK

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Pechkin.a
    * Downloader-AAP

Prevalence (1-5) 2

Description
Troj/Dloader-SK is a Trojan for the Windows platform.

Troj/Dloader-SK includes functionality to download, install and run 
new software.

Advanced
Troj/Dloader-SK is a Trojan for the Windows platform.

Troj/Dloader-SK includes functionality to download, install and run 
new software.

When first run Troj/Dloader-SK copies itself to the Windows folder 
and creates the file <System>\dllsys.dll(harmless).

The following registry entry is created to run Troj/Dloader-SK on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SVCHOST
<Windows>\<original Trojan filename>





Name   W32/PrsKey-A

Type  
    * Spyware Worm

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/PrsKey-A is a password stealing and keylogging worm aimed at the 
Priston Tale game and Yahoo! web email accounts.

The worm silently monitors keyboard activity waiting for the user to 
either play Priston Tale or access Yahoo! email accounts and begins 
keylogging information once access is found.

W32/PrsKey-A includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location

Advanced
W32/PrsKey-A is a password stealing and keylogging worm aimed at the 
Priston Tale game and Yahoo! web email accounts.

The worm silently monitors keyboard activity waiting for the user to 
either play Priston Tale or access Yahoo! email accounts and begins 
keylogging information once access is found.

When run W32/PrsKey-A attempts to copy itself to the location:

<Program Files>\Common Files\Winllogo.exe
<Program Files>\Common Files\Win.exe

W32/PrsKey-A creates the registry entry to run Winllogo.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SpyEx
<Program Files>\Common Files\Winllogo.exe

Once installed, W32/PrsKey-A will begin keylogging information and 
store the logged information to the file C:\text.txt. This file is 
harmless and can be deleted.

W32/PrsKey-A includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location

W32/PrsKey-A spreads by attempting to copy itself to network shared 
folders at the following location:

\Documents and Settings\All Users\Start 
Menu\Programs\Startup\winllogo.exe





Name   Troj/Whistler-F

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Deletes files off the computer
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Trojan.Win32.Dire.c
    * QDel247
    * Win32/Dire.C
    * TROJ_QDEL247.A

Prevalence (1-5) 2

Description
Troj/Whistler-F is a destructive Trojan for the Windows platform.

Troj/Whistler-F will attempt to delete files on the user's computer. 
The Trojan will also create a file at C:\WXP and copy it over other 
files. The file contains the message "You did a piracy, you deserve 
it."

Advanced
Troj/Whistler-F is a destructive Trojan for the Windows platform.

Troj/Whistler-F will attempt to delete files on the user's computer. 
The Trojan will also create a file at C:\WXP and copy it over other 
files. The file contains the message "You did a piracy, you deserve 
it."

When first run the Trojan copies itself to <SYSTEM>\whismng.exe.

The following registry entry is created to run whismng.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Whistler
<SYSTEM>\whismng.exe -n





Name   Troj/SDM-C

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Prevalence (1-5) 2

Description
Troj/SDM-C is a Trojan for the Windows platform.

The Trojan exploits a vulnerability in Microsoft Access (JET) files. 
The Trojan creates the file ms.exe and then runs it. Sophos's 
anti-virus products detect the ms.exe file as Troj/Bdoor-CSY.





Name   Troj/Sacrep-A

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Uses its own emailing engine
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Spy-Agent.p
    * Trojan.Sacrep
    * TROJ_DELF.MZ

Prevalence (1-5) 2

Description
Troj/Sacrep-A is a keylogger Trojan.

Troj/Sacrep-A saves recorded keystrokes to a preconfigured filename. 
The contents of this file are periodically submitted to the author by 
email, FTP or posting to a website.

Advanced
Troj/Sacrep-A is a keylogger Trojan.

Troj/Sacrep-A saves recorded keystrokes to a preconfigured filename. 
The contents of this file are periodically submitted to the author by 
email, FTP or posting to a website.

Troj/Sacrep-A includes functionality to prevent itself being 
terminated and prevent itself being deleted.

The following registry entry is created to run the Trojan on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<filename>
<path to Trojan>

Registry entries are also created under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\drv32





Name   Troj/Deld-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Deld-A is a Trojan for the Windows platform.

When run, the Trojan attempts to download files from a remote site 
and then run them.

Advanced
Troj/Deld-A is a Trojan for the Windows platform.

When run, the Trojan attempts to download files from a remote site 
and then run them. The files are downloaded to the following locations:

C:\Windows\svchost.exe
C:\Windows\lsass.exe

At the time of writing, Sophos's anti-virus products detect the 
svchost.exe file as Troj/Bancban-ES and the lsass.exe file as 
Troj/Mdrop-AW.





Name   Troj/Nethief-P

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Agent.fx

Prevalence (1-5) 2

Description
Troj/Nethief-P is a backdoor Trojan for the Windows platform that 
provides unauthorized remote access to the infected computer.

Troj/Nethief-P includes functionality to:

- silently download, install and run new software
- steal and capture information

Advanced
Troj/Nethief-P is a backdoor Trojan for the Windows platform that 
provides unauthorized remote access to the infected computer.

When first run Troj/Nethief-P copies itself to 
<System>\ShellExt\EXPLORER.exe.

The following registry entry is created to run EXPLORER.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EXPLORER
<System>\SHELLEXT\EXPLORER.exe

Troj/Nethief-P includes functionality to:

- silently download, install and run new software
- steal and capture information

Troj/Nethief-P is also capable of logging keystrokes entered into Web 
forms on the predefined website.

Troj/Nethief-P sends stolen data to the configurable predefined email 
address.

Registry entries are created under:

HKCR\.key\





Name   W32/Dumaru-AK

Type  
    * Worm

Aliases  
    * TrojanDropper.Win32.Mudrop.h
    * Worm.Win32.Plexus.a
    * W32.Explet.A@mm
    * I-Worm.Plexus.a

Prevalence (1-5) 2

Description
W32/Dumaru-AK consists of a dropper and a number of dropped files.

The dropper copies itself to the filename UPU.EXE in the Windows 
system folder. The dropper also drops the files SETUPEX.EXE to the 
same folder and SVCHOST.EXE to the Windows folder, running them both.

The dropper may display one of the following fake error messages:

CRC checksum failed.
Pace method not implemented.
Could not initialize installation. File size expected=26523, size 
returned=26344
File is corrupted.

SETUPEX.EXE runs as a service process, copying itself to SWCHOST.EXE 
and SVOHOST.EXE in the Windows system folder. It sets the following 
registry entry so as to run the SWCHOST.EXE copy on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32

SETUPEX.EXE sets an entry in the BOOT section of SYSTEM.INI with the 
key name SHELL in order to run the SWCHOST.EXE copy on system startup.

SETUPEX.EXE copies itself as SVCHOST.EXE to the folder found in the 
following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell 
Folders\Startup

and writes loopback values to the HOSTS file to block access to 
various anti-virus websites.

SETUPEX.EXE sets the following registry entries:

HKCU\Software\SARS\SocksPort
HKLM\System\CurrentControlSet\Services\SharedAccess\Start = 3
HKCU\Software\Microsoft\Internet Explorer\Main\AllowWindowReuse = 0

SETUPEX.EXE logs key strokes and window titles to a file in the 
Windows folder called PRNTK.LOG and logs information about certain 
files to RUNDLLN.SYS in the Windows folder.

SETUPEX.EXE drops PRNTSVR.DLL in the Windows folder. PRNTSVR.DLL is a 
backdoor program detected by Sophos Anti-Virus as Troj/Dumaru-B.

The SVCHOST.EXE file dropped by the dropper is an email and network 
share worm which also spreads by exploiting the RPC and LSASS 
vulnerabilities. For more information about these vulnerabilities see 
MS040-011 and MS03-026.

The email sent by the worm to the email addresses harvested from the 
PHP, TXT, TBB, HTML and HTM files, has characteristics chosen from 
the following lists.

Subject line :
RE: order
For you
Hi, Mike
Good offer.
RE:

Message text :
Hi.
Here is the archive with those information, you asked me.
And don't forget, it is strongly confidencial!!!
Seya, man.
P.S. Don't forget my fee ;)

Hi, my darling :)
Look at my new screensaver. I hope you will enjoy...
Your Liza

My friend gave me this account generator for http://www.pantyola.com I 
wanna share it with you :)
And please do not distribute it. It's private.

Greets! I offer you full base of accounts with passwords of mail 
server yahoo.com. Here is archive with small part of it . You can see 
that all information is real. If you want to b uy full base, please 
reply me..

Hi, Nick. In this archive you can find all those things, you asked me.
See you. Steve

Attached file :

release.exe
demo.exe
AGen1.03.exe
AtlantI.exe
SecUNCE.exe

The worm copies itself into the KaZaA transfer folder and available 
shared folders with the following filenames:

AVP5.xcrack.exe
InternetOptimizer1.05b.exe
Shrek_2.exe
UnNukeit9xNTICQ04noimageCrk.exe
YahooDBMails.exe
hx00def.exe
ICQBomber.exe

The worm adds the following registry entry so that it is run each 
time Windows starts:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NvClipRsv

The worm also modifies the HOSTS files in an attempt to prevent 
anti-virus updates.

The worm listens on port 1250 for incoming connections which may 
contain updated copies of the worm or other files to install on the 
infected computer.





Name   W32/Tilebot-N

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aei
    * W32/Sdbot.worm.gen.g

Prevalence (1-5) 2

Description
W32/Tilebot-N is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-N spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including LSASS (MS04-011) and 
RPC-DCOM (MS04-012) and by copying itself to network shares protected 
by weak passwords.

W32/Tilebot-N runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-N includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Tilebot-N is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-N spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including LSASS (MS04-011) and 
RPC-DCOM (MS04-012) and by copying itself to network shares protected 
by weak passwords.

W32/Tilebot-N runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-N includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-N copies itself to &ltWindows>\csrs.exe 
and creates the file &ltSystem>\rdriv.sys.

The file rdriv.sys is detected as Troj/Rootkit-W.

The file rdriv.sys is registered as a new system driver service named 
"rdriv", with a display name of "rdriv". Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\rdriv\

The file csrs.exe is registered as a new system driver service named 
"wservtime", with a display name of "Windows Time Sync" and a startup 
type of automatic, so that it is started automatically during system 
startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\wservtime\

W32/Tilebot-N sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are modified or created or under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   W32/Mytob-EG

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address

Aliases  
    * Trojan.Win32.Delf.if

Prevalence (1-5) 2

Description
W32/Mytob-EG is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-EG spreads by sending itself as an email attachment. 
W32/Mytob-EG harvests email addresses from files on the infected 
computer and from the Windows address book. Email sent by W32/Mytob-EG 
have the following properties.

Subject line:

Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation

Message text:

Dear user &ltstr>,
You have successfully updated the password of your &ltstr> account.&ltBR>
If you did not authorize this change or if you need assistance with 
your account, please contact &ltstr> customer service at: &ltstr>
Thank you for using &ltstr>!
The &ltstr> Support Team
+++ Attachment: No Virus (Clean)
+++ &ltstr> Antivirus - www.&ltstr>

Dear user &ltstr>,
It has come to our attention that your &ltstr> User Profile ( x ) 
records are out of date. For further details see the attached document.
Thank you for using &ltstr>!
The &ltstr> Support Team
+++ Attachment: No Virus (Clean)
+++ &ltstr> Antivirus - www.&ltstr>

Dear &ltstr> Member,
We have temporarily suspended your email account &ltstr&gt.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of 
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of 
subscription due to an internal error within our processors.
See the details to reactivate your &ltstr> account.
Sincerely,The &ltstr> Support Team
+++ Attachment: No Virus (Clean)
+++ &ltstr> Antivirus - www.&ltstr>

Dear &ltstr> Member,
Your e-mail account was used to send a huge amount of unsolicited 
spam messages during the recent week. If you could please take 5-10 
minutes out of your online experience and confirm the attached 
document so you will not run into any future problems with the online 
service.&ltBR>
If you choose to ignore our request, you leave us no choice but to 
cancel your membership.
Virtually yours,
The &ltstr> Support Team
+++ Attachment: No Virus found
+++ &ltstr> Antivirus - www.&ltstr>

In the above text &ltstr> would be replaced with either the domain or 
username from user's email address.

The attached file consists of a base name followed by the extentions 
CMD, PIF, SCR, EXE or ZIP. The worm may optionally create double 
extensions where the first extension is DOC, TXT or HTM and the final 
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The base filenames are 
randomly chosen from:

updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report

The worm avoids sending email to addresses that contain the following:

.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your

Advanced
W32/Mytob-EG is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-EG spreads by sending itself as an email attachment. 
W32/Mytob-EG harvests email addresses from files on the infected 
computer and from the Windows address book. Email sent by 
W32/Mytob-EG have the following properties.

Subject line:

Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Mes