Text 259, 1513 rader
Skriven 2007-01-28 22:08:00 av KURT WISMER (1:123/140)
Ärende: News, January 28 2007
=============================
[cut-n-paste from sophos.com]
Name W32/Dref-X
Type
* Virus
How it spreads
* Email attachments
* Infected files
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Modifies data on the computer
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
* Leaves non-infected files on computer
Aliases
* Trojan.Peacomm
Prevalence (1-5) 3
Description
W32/Dref-X is a mass-mailing virus for the Windows platform.
Advanced
W32/Dref-X is a mass-mailing virus for the Windows platform.
W32/Dref-X spreads to other network computers and via email.
When first run W32/Dref-X copies itself to <System>\alsys.exe and
creates the following files:
<current folder>\e2McBB3.exe - detected as W32/Dref-X
<System>\wincom32.ini - can be removed
<System>\wincom32.sys - can be removed
W32/Dref-X also includes functionality to infect files. The infected
files are detected as W32/Dref-L.
Name Troj/Clagger-AS
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 3
Description
Troj/Clagger-AS is a Trojan for the Windows platform.
Troj/Clagger-AS includes functionality to download and execute code
from the internet.
Advanced
Troj/Clagger-AS is a Trojan for the Windows platform.
Troj/Clagger-AS includes functionality to download and execute code
from the internet.
When first run Troj/Clagger-AS copies itself to the following location:
<system>\iptb.exe
The following registry entry is created to ensure that iptb.exe is
run on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iptb
iptb.exe
Name Troj/Dloadr-ASI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 3
Description
Troj/Dloadr-ASI is a Trojan for the Windows platform.
The Trojan includes functionality to download, install and run new
software.
Name Troj/DwnLdr-FZI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 3
Description
Troj/DwnLdr-FZI is a worm for the Windows platform.
Troj/DwnLdr-FZI includes functionality to download, install and run
new software.
When Troj/DwnLdr-FZI is installed it creates the file <Windows>\1.exe.
Name Troj/DwnLdr-FYG
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* TROJ_DLOADER.AH
Prevalence (1-5) 2
Description
Troj/DwnLdr-FYG is a downloader Trojan for the Windows platform.
Name W32/SillyFDC-M
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/SillyFDC-M is a worm for the Windows platform.
Advanced
W32/SillyFDC-M is a worm for the Windows platform.
W32/SillyFDC-M also creates the following files on the infected
computer;
<Windows>\cmd.com
<Windows>\svchost.com
<System>\driver.exe
<Windows>\wuaucll.exe
W32/SillyFDC-M attempts to periodically copy itself to removeable
drives, including floppy drives and USB keys. The worm will attempt
to create a hidden file Autorun.inf on the removeable drive and copy
itself to the same location as the filename music.exe
The file Autorun.inf is designed to start the worm once the
removeable drive is connected to a uninfected computer.
The following registry entry is changed to run wuaucll.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe wuaucll.exe
The following registry entry is set or modified, so that wuaucll.exe
is run when files with extensions of EXE are opened/launched:
HKCR\exefile\shell\open\command
(default)
wuaucll.exe "%1" %*
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
3030
Name Troj/Agent-EAB
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Agent-EAB is a DLL Helper Trojan for the Windows platform.
Troj/Agent-EAB includes functionality to download code from the
internet and to inject code into system processes.
Advanced
Troj/Agent-EAB is a DLL Helper Trojan for the Windows platform.
Troj/Agent-EAB includes functionality to download code from the
internet and to inject code into system processes.
Once installed Troj/Agent-EAB registers itself under the following
registry entries as a DLL helper component to run itself when
EXPLORER.EXE starts up:
HKCR\CLSID\(087FC023-DC5B-41E6-9286-953D382070C1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHoo
ks
(087FC023-DC5B-41E6-9286-953D382070C1)
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\<original filename without file
extension>
Name Troj/Cimuz-BM
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
* Dropped by malware
* Installs a browser helper object
Aliases
* TROJ_BZUB.CQ
* Trojan-Spy.Win32.BZub.fz
Prevalence (1-5) 2
Description
Troj/Cimuz-BM is a Trojan for the Windows platform.
Advanced
Troj/Cimuz-BM is a Trojan for the Windows platform.
When Troj/Cimuz-BM is installed it creates the file
<System>\ipv6monl.dll. This file is also detected as Troj/Cimuz-BM.
The file ipv6monl.dll is registered as a COM object and Browser
Helper Object (BHO) for Microsoft Internet Explorer, creating
registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\browser
helper objects\{21384D29-1240-2d4f-A15C-17E42823D523}
HKCR\CLSID\{21384D29-1240-2d4f-A15C-17E42823D523}
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\StandardProfile\AuthorizedApplications\List
<Program Files>\Internet Explorer\IEXPLORE.EXE
<Program Files>\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet
Explorer
The following registry entry is set:
HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
yes
Name Troj/Lineag-AIV
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Uses its own emailing engine
* Dropped by malware
Aliases
* Trojan-PSW.Win32.Gamec.bw
* PWS-Lineage.dll
* Win32/PSW.Lineage.NEE
* TSPY_LINEAGE.DUL
Prevalence (1-5) 2
Description
Troj/Lineag-AIV is a Trojan for the Windows platform.
Advanced
Troj/Lineag-AIV is a Trojan for the Windows platform.
Troj/Lineag-AIV is a DLL component that contains functionality to
steal information and send it to a remote user by email.
Troj/Lineag-AIV is likely to be installed by other malware.
Name W32/Rbot-GCE
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
* Scans network for vulnerabilities
* Scans network for weak passwords
* Scans network for open ports
Aliases
* Backdoor.Win32.Rbot.bvz
* W32/Sdbot.worm.gen.q
Prevalence (1-5) 2
Description
W32/Rbot-GCE is a worm with IRC backdoor functionality for the
Windows platform.
W32/Rbot-GCE runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Rbot-GCE spreads
- to computers vulnerable to common exploits, including: LSASS
(MS04-011), RPC-DCOM (MS04-012) and WKS (MS03-049)
- to network shares protected by weak passwords
Advanced
W32/Rbot-GCE is a worm with IRC backdoor functionality for the
Windows platform.
W32/Rbot-GCE runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Rbot-GCE copies itself to <System>\zaq.exe.
The following registry entries are created to run zaq.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32
zaq.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32
zaq.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win32
zaq.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
Name Troj/FakeAle-AI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/FakeAle-AI is a Trojan for the Windows platform.
Troj/FakeAle-AI includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/FakeAle-AI is a Trojan for the Windows platform.
Troj/FakeAle-AI includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/FakeAle-AI copies itself to
<Windows>\xpupdate.exe and creates the file <User>\Application
Data\Install.dat.
The following registry entries are created to run Troj/FakeAle-AI on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows update loader
<Windows>\xpupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
con
<pathname of the application executable>
Registry entries are created under:
HKCU\Software\Install
Name Troj/DwnLdr-FYH
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Win32/TrojanDownloader.Nurech.G
Prevalence (1-5) 2
Description
Troj/DwnLdr-FYH is a Trojan for the Windows platform.
Troj/DwnLdr-FYH includes functionality to;
- access the internet and communicate with a remote server via HTTP.
- download, install and run new software.
Advanced
Troj/DwnLdr-FYH is a Trojan for the Windows platform.
Troj/DwnLdr-FYH includes functionality to;
- access the internet and communicate with a remote server via HTTP.
- download, install and run new software.
When first run Troj/DwnLdr-FYH copies itself to <System>\ipcbt.exe
and creates the file <System>\drivers\onud.dat. This file can be
deleted.
The following registry entry is created to run ipcbt.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ipcbt
<System>\ipcbt.exe
Name W32/Rbot-GCI
Type
* Worm
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Enables remote access
Aliases
* Backdoor.Win32.Agent.rk
* W32/Backdoor.AAMZ
Prevalence (1-5) 2
Description
W32/Rbot-GCI is a worm with IRC backdoor functionality for the
Windows platform.
W32/Rbot-GCI spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS (MS04-011), SRVSVC
(MS06-040), RPC-DCOM (MS04-012) and ASN.1 (MS04-007).
W32/Rbot-GCI runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Rbot-GCI is a worm with IRC backdoor functionality for the
Windows platform.
W32/Rbot-GCI spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS (MS04-011), SRVSVC
(MS06-040), RPC-DCOM (MS04-012) and ASN.1 (MS04-007).
W32/Rbot-GCI runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Rbot-GCI copies itself to <System>\soundman.exe.
The following registry entries are created to run soundman.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Sounds
soundman.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Sounds
soundman.exe
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\ StandardProfile\AuthorizedApplications\List
<System>\soundman.exe
<System>\soundman.exe:*:Enabled:Microsoft Sounds
W32/Rbot-GCI sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
The following registry entry is set:
HKCU\Software\Microsoft\OLE
Microsoft Sounds
soundman.exe
Name W32/Dzan-A
Type
* Worm
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Enables remote access
Aliases
* Virus.Win32.Dzan.a
* W32/Dzan
* Win32/Dzan.A
* Infostealer.QQRob.A
* PE_DZAN.A
Prevalence (1-5) 2
Description
W32/Dzan-A is a worm for the Windows platform.
W32/Dzan-A runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer.
Advanced
W32/Dzan-A is a worm that spreads via removable storage devices.
W32/Dzan-A runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer.
When W32/Dzan-A is installed it creates the files \mmc.exe and
\ufdata2000.log.
The file mmc.exe is registered as a new system driver service named
"mmc", with a display name of "Smart Card Supervisor" and a startup
type of automatic, so that it is started automatically during system
startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\mmc
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0
Name W32/Sohana-G
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Sohana-G is a worm for the Windows platform.
W32/Sohana-G has the functionalities to spread via Instant Messaging
protocols and to download, install and run new software.
Advanced
W32/Sohana-G is a worm for the Windows platform.
W32/Sohana-G has the functionalities to spread via Instant Messaging
protocols and to download, install and run new software.
When first run W32/Sohana-G copies itself to:
<Windows>\lsass.exe
<System>\lsass.exe
The following registry entries are changed to run lsass.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe <System>\lsass.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
userinit.exe,<System>\lsass.exe
W32/Sohana-G changes settings for Microsoft Internet Explorer by
modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableConfig
1
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1
Registry entries are created under:
HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast
HKCU\Software\Yahoo\pager\View\YMSGR_buzz
Name W32/Sohana-H
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Sohana-H is a worm for the Windows platform.
W32/Sohana-H has the functionalities to spread via Instant Messaging
protocols and to download, install and run new software.
Advanced
W32/Sohana-H is a worm for the Windows platform.
W32/Sohana-H has the functionalities to spread via Instant Messaging
protocols and to download, install and run new software.
When W32/Sohana-H is installed the following files are created:
<System>\svchost.exe
<System>\svchost32.exe
The following registry entries are created to run W32/Sohana-H on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Task Manager
<System>\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Yahoo Messenger
<System>\svchost32.exe
W32/Sohana-H changes settings for Microsoft Internet Explorer by
modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1
Registry entries are created under:
HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast
HKCU\Software\Yahoo\pager\View\YMSGR_buzz
Name Troj/Raser-AS
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
* Dropped by malware
* Enables remote access
Aliases
* Trojan-Proxy.Win32.Delf.cb
Prevalence (1-5) 2
Description
Troj/Raser-AS is a Trojan for the Windows platform.
Advanced
Troj/Raser-AS is a multi-component proxy Trojan for the Windows
platform.
Troj/Raser-AS allows unauthorized remote access to the computer via a
network.
Troj/Raser-AS comprises the following files
<System>\ msiexecu.exe
<System>\<DRIVERS>\SndSystem.sys
The file msiexexcu.exe is installed as a the service called "HID
Input Service WIN32".
The file SndSystem.sys is registered as a system driver service with
a display name of "Sndsystem". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Sndsystem\
Name Troj/FuiFrame-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Downloads code from the internet
Aliases
* Trojan.Win32.Zytric.d
* Win32/TrojanDownloader.Delf.NPQ
* TROJ_DLOADER.ETB
Prevalence (1-5) 2
Description
Troj/Fuiframe-A is a Trojan for the Windows platform.
Troj/Fuiframe-A includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Fuiframe-A is a Trojan for the Windows platform.
Troj/Fuiframe-A includes functionality to access the internet and
communicate with a remote server via HTTP.
Troj/Fuiframe-A searches the local file system for files with
extensions starting PHP, ASP or HTM which it then infects with
Troj/Psyme-DO or Troj/Fujif-Fam.
Name Troj/Rincux-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Used in DOS attacks
* Dropped by malware
Aliases
* Win32/Delf.NDZ
* BKDR_HUPIGON.GEN
* Backdoor.Win32.Agent.fs
Prevalence (1-5) 2
Description
Troj/Rincux-A is a Trojans for the Windows platform.
Once running Troj/Rincux-A has the functionality to perform denial of
service attacks against remote computers.
Name W32/Tilebot-IO
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Enables remote access
Aliases
* Backdoor.Win32.VanBot.as
* IRC/SdBot
* W32.Spybot.Worm
* WORM_SPYBOT.UX
Prevalence (1-5) 2
Description
W32/Tilebot-IO is a worm for the Windows platform.
W32/Tilebot-IO may spread by exploiting the RealVNC vulnerability
(CVE-2006-2369) or by copying itself to remote network shares with
weak passwords.
W32/Tilebot-IO runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Tilebot-IO is a worm for the Windows platform.
W32/Tilebot-IO may spread by exploiting the RealVNC vulnerability
(CVE-2006-2369) or by copying itself to remote network shares with
weak passwords.
W32/Tilebot-IO runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-IO includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-IO copies itself to \mstinit.exe.
The file mstinit.exe is registered as a new system driver service
named "Mstinit", with a display name of "Scheduling Agent" and a
startup type of automatic, so that it is started automatically during
system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Mstinit
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d
he worm may also change the following files:
<System>\ftp.exe
<System>\sfc_os.dll
<System>\tftp.exe
The modified file sfc.dll is the potentially unwanted application
"Disabled System File Check DLL". The files ftp.exe and tftp.exe are
replaced by dummy files that contain no executable code.
Name W32/Fujacks-L
Type
* Virus
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Fujacks-L spreads to other network computers.
W32/Fujacks-L runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer.
W32/Fujacks-L includes functionality to access the internet and
communicate
with a remote server via HTTP.
Advanced
W32/Fujacks-L is a virus with backdoor functionality for the Windows
platform.
W32/Fujacks-L spreads to other network computers.
W32/Fujacks-L runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer.
W32/Fujacks-L includes functionality to access the internet and
communicate
with a remote server via HTTP.
When W32/Fujacks-L is installed the following files are created:
<System>\drivers\ncscv32.exe
The following registry entry is created to run ncscv32.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
nvscv32
<System>\drivers\ncscv32.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\S
HOWALL
CheckedValue
0
The virus may infect ASP and HTML files, which are detected by
Troj/Fujif-B.
Name Troj/VB-CXT
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
* Monitors system activity
Prevalence (1-5) 2
Description
Troj/VB-CXT is a Trojan for the Windows platform.
Troj/VB-CXT tries to disguise itself as Microsoft DirectX Diagnostic
Tool.
Advanced
Troj/VB-CXT is a Trojan for the Windows platform.
Troj/VB-CXT tries to disguise itself as Microsoft DirectX Diagnostic
Tool.
When first run Troj/VB-CXT copies itself to <System>\dxdlg32.exe and
may create the file \show.bat. The batch file can be deleted.
The following registry entry is created to run dxdlg32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DxDialog
<System>\dxdlg32.exe
Name RK
Type
* Adware
Affected operating systems
* Windows
Side effects
* Monitors browser activity
* Monitors system activity
Aliases
* AdWare.Win32.RK.k
* Win32/Adware.RK
Prevalence (1-5) 2
Description
RK provides detection for the components of RelevantKnowledge
application.
Name W32/Tilebot-IP
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aad
Prevalence (1-5) 2
Description
W32/Tilebot-IP is a worm with IRC Backdoor functionality for the
Windows platform.
W32/Tilebot-IP spreads to other network computers
- by exploiting common buffer overflow vulnerabilities, including:
LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1
(MS04-007).
- via network shares.
Advanced
W32/Tilebot-IP is a worm with IRC Backdoor functionality for the
Windows platform.
W32/Tilebot-IP spreads to other network computers
- by exploiting common buffer overflow vulnerabilities, including:
LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1
(MS04-007).
- via network shares.
When first run W32/Tilebot-IP copies itself to \symon.exe.
The file symon.exe is registered as a new system driver service named
"System Restore Manager", with a display name of "System Restore
Manager" and a startup type of automatic, so that it is started
automatically during system startup. Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\System Restore Manager
W32/Tilebot-IP sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center
Name W32/Fujet-A
Type
* Worm
How it spreads
* Removable storage devices
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Worm.Win32.Fujack.j
* W32.Fujacks.L
* WORM_FUJACK.X
Prevalence (1-5) 2
Description
W32/Fujet-A is a worm with backdoor functionality for the Windows
platform.
W32/Fujet-A spreads to other network computers.
W32/Fujet-A runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer.
W32/Fujet-A includes functionality to access the internet and
communicate with a remote server via HTTP, and attempts to download
and execute further files from remote websites.
W32/Fujet-A modifies or deletes certain files it finds on the
infected computer or available network shares.
W32/Fujet-A attempts to terminate processes and services, delete
registry entries, and close windows related to anti-virus and
security applications.
Advanced
W32/Fujet-A is a worm with backdoor functionality for the Windows
platform.
W32/Fujet-A spreads to other network computers.
W32/Fujet-A runs continuously in the background, providing a backdoor
server which allows a remote intruder to gain access and control over
the computer.
W32/Fujet-A includes functionality to access the internet and
communicate with a remote server via HTTP, and attempts to download
and execute further files from remote websites.
When first run W32/Fujet-A copies itself to
<System>\drivers\spoclsv.exe.
The following registry entry is created to run spoclsv.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spoclsv.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0
W32/Fujet-A attempts to copy itself as GameSetup.exe to the following
locations on network shares with weak passwords, and may attempt to
run the copy as well:
<Root>\Documents and Settings\All Users\Start Menu\Programs\Startup\
<Root>\Documents and Settings\All Users\bkbe\
<Root>\WINDOWS\Start Menu\Programs\Startup\
<Root>\WINNT\Profiles\All Users\Start Menu\Programs\Startup\
W32/Fujet-A searches all folders on all drives and network shares
with weak password on the infected computer. It avoids certain
predefined folders, while in all others it attempts to drop a clean
hidden file Desktop_.ini, attempts to delete files it finds with the
extension GHO, and attempts to append data to files it finds with an
extension of HTM, HTML, ASP, PHP, JSP and ASPX. Modified files are
detected as W32/Fujif-A, W32/Fujif-Fam or W32/Fujif-Gen.
W32/Fujet-A may also create the clean file C:\test.txt.
W32/Fujet-A attempts to copy itself to the root of certain drives as
setup.exe, also dropping the file autorun.inf in an attempt to run
the copy automatically.
W32/Fujet-A may delete network shares from the infected computer.
W32/Fujet-A attempts to terminate processes and services, delete
registry entries, and close windows related to anti-virus and
security applications.
Name W32/Sdbot-CXO
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Enables remote access
Aliases
* W32/Sdbot.worm.gen.ca
* W32/Backdoor.ZLO
* Backdoor.Win32.SdBot.bcf
Prevalence (1-5) 2
Description
W32/Sdbot-CXO is a worm with IRC backdoor functionality for the Windows
platform.
Advanced
W32/Sdbot-CXO is a worm with IRC backdoor functionality for the Windows
platform.
W32/Sdbot-CXO runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
When first run W32/Sdbot-CXO copies itself to <System>\msrdc.exe.
The following registry entries are created to run msrdc.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msrdc
<System>\msrdc.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
msrdc
<System>\msrdc.exe
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\St
andardProfile\AuthorizedApplications\List
<System>\msrdc.exe
<System>\msrdc.exe:*:Enabled:msrdc
The following registry entry is set:
HKCU\Software\Microsoft\OLE
msrdc
<System>\msrdc.exe
Name W32/Sohana-J
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Sohana-J is a worm for the Windows platform.
W32/Sohana-J may attempt to spread via instant messaging clients.
W32/Sohana-J includes functionality to download, install and run new
software.
Advanced
W32/Sohana-J is a worm for the Windows platform.
W32/Sohana-J may attempt to spread via instant messaging clients.
W32/Sohana-J includes functionality to download, install and run new
software.
When first run W32/Sohana-J copies itself to:
<Windows>\svichosst.exe
<System>\svichosst.exe
The following registry entry is changed to run svichosst.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe svichosst.exe
The following registry entry is set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
--- MultiMail/Win32 v0.43
* Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)
|