Text 339, 398 rader
Skriven 2007-11-25 19:31:00 av KURT WISMER (1:123/140)
Ärende: News, November 25 2007
==============================
[cut-n-paste from sophos.com]

Name   Troj/Agent-GGU

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Agent-GGU is a Trojan for the Windows platform.

Advanced
Troj/Agent-GGU is a Trojan for the Windows platform.

Troj/Agent-GGU includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/Agent-GGU copies itself to <System>\<Hexadecimal 
digits A>.exe and creates the file <System>\<Hexadecimal digits 
B>\<Hexadecimal digits C> which contains non-malicious data.

The following registry entry is created to run <Hexadecimal digits 
A>.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<Hexadecimal digits D>
<Hexadecimal digits A>.exe

Registry entries are created under:

HKLM\SOFTWARE\8B8B948F8E95929897





Name   Troj/Agent-GGS

Type  
    * Trojan

Affected operating systems  
    * Windows

Prevalence (1-5) 2

Description
Troj/Agent-GGS is a Trojan for the Windows platform.





Name   W32/Virut-W

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer

Aliases  
    * Win32.Virut.av
    * PE_VIRUT.AV
    * Win32/Virut.AC

Prevalence (1-5) 2

Description
W32/Virut-W is a virus for the Windows platform.

Advanced
W32/Virut-W is a virus for the Windows platform.

W32/Virut-W attempts to hook the operating system and infect files with 
an EXE or SCR extension.

W32/Virut-W may also attempt to connect to a remote IRC server, and may 
download and execute further files if instructed to do so.

W32/Virut-W may modify the following registry entry in order to bypass 
the Windows firewall:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPo
licy\
StandardProfile\AuthorizedApplications\List





Name   Troj/DRClick-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Monitors browser activity
    * Opens links to websites

Prevalence (1-5) 2

Description
Troj/DRClick-A is a script that inteferes with right mouse clicks on 
web pages.

Web pages containing Troj/DRClick-A may also open links to other 
websites without the users consent.





Name   Troj/Kaiten-W

Type  
    * Trojan

Affected operating systems  
    * Unix

Side effects  
    * Allows others to access the computer

Aliases  
    * Linux/DDoS-Kaiten
    * Backdoor.Kaitex

Prevalence (1-5) 2

Description
Troj/Kaiten-W is a backdoor Trojan for the Linux platform.

Advanced
Troj/Kaiten-W is a backdoor Trojan for the Linux platform.

Troj/Kaiten-W allows a remote attacker to control the infected computer 
through IRC channels.





Name   Troj/RSTDoor-B

Type  
    * Trojan

Affected operating systems  
    * Unix

Side effects  
    * Allows others to access the computer

Prevalence (1-5) 2

Description
Troj/RSTDoor-B is a backdoor Trojan for Unix based platforms running 
PHP and HTTPD.

Advanced
Troj/RSTDoor-B is a backdoor Trojan for Unix based platforms running 
PHP and HTTPD.

The Trojan accepts commands via HTTP request strings and allows remote 
attackers the ability to access and control the infected computer. 
Troj/RSTDoor-B also allows web based interface to control the backdoor 
functionality.

The Trojan can be instructed by remote attackers to perform various 
tasks, including:

- collect information from the infected computer, such as database 
servers, directory structures, files and permissions, etc.
- open a remote shell (BASH)
- upload/download arbitrary files
- execute arbitrary files
- scan for vulnerabilities
- change file attributes (owner, permissions)
- run arbitrary SQL commands
- send email
- start and FTP server





Name   Troj/KillAV-EC

Type  
    * Trojan

Affected operating systems  
    * Windows

Prevalence (1-5) 2

Description
Troj/KillAV-EC is a Trojan for the Windows platform.

Troj/KillAV-EC attempts to disable anti-virus and other security 
software.





Name   Troj/StraDr-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Warezov.ud

Prevalence (1-5) 2

Description
Troj/StraDr-A is a Trojan for the Windows platform.

Advanced
Troj/StraDr-A is a Trojan for the Windows platform.

Troj/StraDr-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/StraDr-A is installed the following files are created:

<Current Folder>l\fash.exe
<System>\e1.dll
<System>\keymnetc.exe
<System>\ntdlcdfv.dll
<System>\rnr2msft.dll
<System>\sccbxenr.exe

The files fash.exe and sccbxenr.exe are also detected as Troj/StraDr-A. 
The files e1.dll, keymnetc.exe, ntdlcdfv.dll and rnr2msft.dll are 
detected as W32/Strati-Gen.

The following registry entry is created to run sccbxenr.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
sccbxenr
<System>\sccbxenr.exe





Name   Troj/KillFil-BR

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/KillFil-BR is a Trojan for the Windows platform.

Advanced
Troj/KillFil-BR is a Trojan for the Windows platform.

When run, Troj/KillFil-BR displays the following message:

"APAGANDO EL PC EL VIRUS I
 LOVE YOU DESTROYER HA
 HECHO PRESENCIA EN TU PC
 LO SIENTO PERO TU PC ESTA
 ENFERMO Xd :)"

and attempts to delete the following directories and their contents

C:\DOWNLOADS
C:\juegos
C:\Mis Documentos
C:\Archivos de programa\emule
C:\documentos
C:\peliculas
C:\musica
C:\FOTOS
C:\videos
C:\descargas
C:\windows\System32\config\system
C:\SystemRoot\System32\Config\SOFTWARE
C:\SystemRoot
C:\windows\System32\config\software
C:\windows\SoftwareDistribution
C:\windows\help
C:\windows\addins
C:\windows\apppatch
C:\windows\assembly
C:\windows\cursores
C:\windows\cursors
C:\windows\Downloaded Program Files
C:\windows\debug
C:\windows\fonts
C:\windows\msagent
C:\windows\Microsoft.NET
C:\windows\options
C:\windows\pss
C:\windows\RegisteredPackages
C:\windows\Registration
C:\windows\Repair
C:\windows\pchealth
C:\windows\provisioning
C:\windows\profiles
C:\windows\security
C:\windows\sun
C:\windows\system32\restore
C:\windows\system32\data
C:\windows\SYSBCKUP
C:\windows\system32\ac
C:\windows\system32\defaults
C:\windows\system32\config\systemprofile
C:\windows\system32\grouppolicy
C:\windows\system32\ntmsdata
C:\windows\system32\oobe
C:\windows\system32\mui
C:\windows\system32\dllcache
C:\windows\system32\reinstallbackups
C:\windows\system32\spool
C:\Archivos de programa\Archivos comunes
C:\Archivos de programa\Codec Pack de ELISOFT
C:\Archivos de programa\messenger
C:\Archivos de programa\Outlook Express
C:\Archivos de programa\Prime95
C:\Archivos de programa\Windows Media Player
C:\Archivos de programa\Winamp
C:\Archivos de programa\Winrar
C:\Archivos de programa\Winzip
C:\Archivos de programa\MSN Messenger
C:\Archivos de programa\Microsoft Visual Studio .NET
C:\Archivos de programa\Microsoft Visual Studio
C:\Archivos de programa\macromedia
C:\Archivos de programa\boinc
C:\windows\command
C:\Archivos de programa\Kaspersky Lab
C:\Archivos de programa\azureus
C:\Archivos de programa\abc
C:\windows\GroupPolicy
C:\windows\CatRoot2
C:\windows\CatRoot
C:\windows\system32\directx
C:\programas
C:\windows\resources
C:\windows\installer
C:\apache
C:\utilidades
C:\Documents and Settings
C:\recycled
C:\System Volume Information
C:\_restore
C:\windows\Men
C:\windows\Application Data
C:\Documents and Settings\all users
C:\windows\All Users
C:\windows\inf
C:\Archivos de programa
C:\windows\system
C:\windows\system32
C:\windows

Troj/KillFil-BR also creates numerous folders of the following format:
<Root>\ILoveYou-<incremental number>

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)