Text 97, 2387 rader
Skriven 2005-01-28 22:59:00 av KURT WISMER (1:123/140)
Ärende: News, Jan. 27 2005
==========================
[cut-n-paste from sophos.com]

Name   W32/Forbot-DR

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * Backdoor.Win32.Wootbot.gen

Prevalence (1-5) 2

Description
W32/Forbot-DR is a network worm with backdoor Trojan functionality 
accessible via IRC.

W32/Forbot-DR spreads through network shares and by exploiting the LSASS 
(MS04-011) software vulnerability. The Trojan may also spread through 
backdoors left open by other malware.

Advanced
W32/Forbot-DR is a network worm with backdoor Trojan functionality 
accessible via IRC.

W32/Forbot-DR spreads through network shares and by exploiting the LSASS 
(MS04-011) software vulnerability. The Trojan may also spread through 
backdoors left open by other malware.

When first run the worm moves itself to the Windows system folder as 
lmas.exe and creates the following registry entries so as to auto-run on 
user logon or computer reboot:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Management
lmas.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Microsoft Management
lmas.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Management
lmas.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Management
lmas.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Microsoft Management
lmas.exe

W32/Forbot-DR creates a service named "Microsoft Management" with the 
display name "Microsoft Management".

The worm runs continuously in the background providing backdoor access 
to the infected computer through IRC channels.

W32/Forbot-DR can provide various functionality to an attacker using the 
backdoor component as follows:

start an FTP server.
delete network shares.
start a SOCKS4, SOCKS5, HTTP, TCP and GRE proxy.
list and stop existing processes and services.
download, run and delete files.
modify the registry.
add and delete services.
steal the product keys of popular games and applications.
scan other computers for open ports and attempt to exploit them.
take part in distributed denial of service (DDoS) attacks.
flush the DNS cache.
logoff, reboot and shut down the computer.

W32/Forbot-DR may delete the ADMIN$, IPC$, C$ and D$ network shares.

W32/Forbot-DR is capable of stealing product keys from games and 
applications as well as harvesting email addresses from the infected 
computer.

W32/Forbot-DR may alter the following registry entries in order to 
enable/disable DCOM:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM





Name   W32/Wurmark-F

Type  
    * Worm

How it spreads  
    * Email messages
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Uses its own emailing engine

Aliases  
    * Email-Worm.Win32.Wurmark.g
    * W32/Mugly.h@MM
    * WORM_MUGLY.H

Prevalence (1-5) 2

Description
W32/Wurmark-F is a mass mailing worm which sends itself as a zip 
attachment to email addresses found on the infected computer.

When run the worm displays the image uglym.jpg as it installs itself on 
the computer.

W32/Wurmark-F drops several files to the Windows system folder. 
W32/Wurmark-F will drop attached.zip, which is a zip file containing 
W32/Wurmark-F, and xxz.tmp, which is a copy of the worm. W32/Wurmark-F 
will also drop the following clean files:

ANSMTP.DLL
bszip.dll
uglym.jpg

W32/Wurmark-F will drop a file belonging to the W32/Rbot family of worms 
filename svchosts.exe.

W32/Wurmark-F harvests email addresses from files with the extensions:

WAB
ADB
TBB
DBX
ASP
PHP
HTM
HTML
SHT
TXT
DOC

The worm will skip email addresses containing the following strings:

.gov
ada
avg
gri
icro
lavat
mcae
nod
panda
rsky
soph
sophos
symac

The zip file containing W32/Wurmark-F called attached.zip is attached to 
emails sent by the worm appearing to originate from the listed addresses 
containing those below and taking the following forms along with others:

adead_poet@hotmail.com
alex_edwards2000@msn.com
romeorichard@google.com
apiffany@cnet.com

Subject: Hhahahah lol!!!!

Body:

i found this on my computer from ages ago
download it and see if you can remember it
lol i was lauging like mad when i saw it! :D
email me back haha...

Subject: Your Pic On A Website!!

Body:

I was looking at a website and came across
this pic they look just like you! infact im sure
it is lol , did you send this pic into them ? or
is it someonce else :S ? Ive Added the pic in
a zip so download it and check & email me back!

The file within the attachement can have one of the following
names:

Pic_001.jpg.scr
Sexy_09.jpg.scr
Scan_04.jpg.scr

Advanced
W32/Wurmark-F is a mass mailing worm which sends itself as a zip 
attachment to email addresses found on the infected computer.

When run the worm displays the image uglym.jpg as it installs itself on 
the computer.

W32/Wurmark-F drops several files to the Windows system folder. 
W32/Wurmark-F will drop attached.zip, which is a zip file containing 
W32/Wurmark-F, and xxz.tmp, which is a copy of the worm. W32/Wurmark-F 
will also drop the following clean files:

ANSMTP.DLL
bszip.dll
uglym.jpg

W32/Wurmark-F will drop a file belonging to the W32/Rbot family of worms 
filename svchosts.exe.

W32/Wurmark-F harvests email addresses from files with the extensions:

WAB
ADB
TBB
DBX
ASP
PHP
HTM
HTML
SHT
TXT
DOC

The worm will skip email addresses containing the following strings:

.gov
ada
avg
gri
icro
lavat
mcae
nod
panda
rsky
soph
sophos
symac

The zip file containing W32/Wurmark-F called attached.zip is attached to 
emails sent by the worm appearing to originate from the listed addresses 
below and taking the following forms:

adead_poet@hotmail.com
alex_edwards2000@msn.com
romeorichard@google.com
apiffany@cnet.com
sexy_lil_thing@no-ip.com
cutie_pie@ogrish.com
easy_lay666@lovenet.com
hunk_hogan78@hallmark.com
britany_slut56@sex.com
tit_fuck_909@gmail.com
good_fuck12@yahoo.com
blowjob_lips666@romance.com
tit_fuck_909@paltalk.com
sexy_guy88@aol.com
mucle_bound_hunk892@download.com

Subject: Hhahahah lol!!!!

Body:

i found this on my computer from ages ago
download it and see if you can remember it
lol i was lauging like mad when i saw it! :D
email me back haha...

Subject: Your Pic On A Website!!

Body:

I was looking at a website and came across
this pic they look just like you! infact im sure
it is lol , did you send this pic into them ? or
is it someonce else :S ? Ive Added the pic in
a zip so download it and check & email me back!

Subject: Rate My Pic.......

Body:

Hi ive sent 5 emails now and nobody will rate
my pic!! :( please download and tell me what you
think out of 10 , dont worry if you dont like it
just say i wont be offended p.s i was drunk when
it was taken :P

Subject: You have an Admirer

Body:

Someone has asked us on there behalf to send
you this email and tell you they think you are
wonderfull!!! All the The mystery persons details
you need are enclosed in the attachment :)
please download and respond telling us if you
would like to make further contact with this
person.
Regards Hallmark Admirer Mail Admin.

The file within the attachement can have one of the following
names:

Pic_001.jpg.scr
Sexy_09.jpg.scr
Scan_04.jpg.scr
Photo_01.jpg.scr
admire_001.jpg.scr
is_this_you.jpg.scr
love_04.jpg.scr
for_you.pif





Name   W32/Bagle-BK

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * W32/Bagle.bk@MM
    * Email-Worm.Win32.Bagle.ay
    * WORM_BAGLE.AZ

Prevelance (1-5) 2

Description
W32/Bagle-BK is an email and P2P worm.

W32/Bagle-BK will scan through an infected computer and send itself out 
as an email attachment to any email addresses found.

The emails have the following characteristics:

Subject line:

Delivery service mail
Delivery by mail
Registration is accepted
Is delivered mail
You are made active

Message text:

Thanks for use of our software.
Before use read the help

Advanced
W32/Bagle-BK is an email and P2P worm.

The dropper component of W32/Bagle-BK drops the main file to the Windows 
folder with the filename CJECTOR.EXE. The dropped component then copies 
itself to the Windows system folder with the filename SYSFORMAT.EXE. In 
order to run automatically each time a user logs in, W32/Bagle-BK 
periodically sets the following registry entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
sysformat
<Windows system folder>\sysformat.exe

W32/Bagle-BK also copies itself to folders on the infected computer 
which contain the string "shar" in the name, copying itself with the 
following filenames:

1.exe
2.exe
3.exe
4.exe
5.scr
6.exe
7.exe
8.exe
9.exe
10.exe
ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Matrix 3 Revolution English Subtitles.exe
Opera 8 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
XXX hardcore images.exe

W32/Bagle-BK may also copy itself to the Windows system folder with the 
filenames SYSFORMAT.EXEOPEN and SYSFORMAT.EXEOPENOPEN.

W32/Bagle-BK attempts to delete entries in the registry located at

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
and
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

which have the following values, so as to disable other malware 
variants:

My AV
ICQ Net

W32/Bagle-BK attempts to disable services with the display name of 
"SharedAccess" or "wscsvc".

W32/Bagle-BK sets the following time-related registry entry:

HKCU\Software\Microsoft\Params\riga

W32/Bagle-BK attempts to download and execute a number of files from 
remote websites to RE_FILE.EXE in the Windows system folder. At the time 
of writing, these files were unavailable for download.

W32/Bagle-BK attempts to send itself via email to addresses harvested 
from files found on the infected computer with the following extensions:

WAB, TXT, MSG, HTM, SHTM, STM, XML, DBX, MBX, MDX, EML, NCH, MMF, ODS, 
CFG, ASP, PHP, PL, WSH, ADB, TBB, SHT, XLS, OFT, UIN, CGI, MHT, DHTM, 
JSP

The emails have the following characteristics:

Subject line:

Delivery service mail
Delivery by mail
Registration is accepted
Is delivered mail
You are made active

Message text:

Thanks for use of our software.
Before use read the help

Attached filename:

wsd01
viupd02
siupd02
guupd02
zupd02
upd02
Jol03

Attachment extension:

EXE
SCR
COM
CPL

W32/Bagle-BK will not send itself to addresses containing the following 
strings:

@avp., @foo, @iana, @messagelab, @microsoft, abuse, admin, anyone@, bsd, 
bugs@, cafee, certific, contract@, f-secur, feste, free-av, gold-certs@, 
google, help@, icrosoft, info@, kasp, linux, listserv, local, news, 
nobody@, noone@, noreply, ntivi, panda, pgp, postmaster@, rating@, 
root@, samples, sopho, spam, support, unix, update, winrar, winzip

W32/Bagle-BK attempts to terminate the following processes:

alogserv.exe, APVXDWIN.EXE, ATUPDATER.EXE, ATUPDATER.EXE, AUPDATE.EXE, 
AUTODOWN.EXE, AUTOTRACE.EXE, AUTOUPDATE.EXE, Avconsol.exe, AVENGINE.EXE, 
AVPUPD.EXE, Avsynmgr.exe, AVWUPD32.EXE, AVXQUAR.EXE, AVXQUAR.EXE, 
bawindo.exe, blackd.exe, ccApp.exe, ccEvtMgr.exe, ccProxy.exe, 
ccPxySvc.exe, CFIAUDIT.EXE, DefWatch.exe, DRWEBUPW.EXE, ESCANH95.EXE, 
ESCANHNT.EXE, FIREWALL.EXE, FrameworkService.exe, ICSSUPPNT.EXE, 
ICSUPP95.EXE, LUALL.EXE, LUCOMS~1.EXE, mcagent.exe, mcshield.exe, 
MCUPDATE.EXE, mcvsescn.exe, mcvsrte.exe, mcvsshld.exe, navapsvc.exe, 
navapsvc.exe, navapsvc.exe, navapw32.exe, NISUM.EXE, nopdb.exe, 
NPROTECT.EXE, NPROTECT.EXE, NUPGRADE.EXE, NUPGRADE.EXE, OUTPOST.EXE, 
PavFires.exe, pavProxy.exe, pavsrv50.exe, Rtvscan.exe, RuLaunch.exe, 
SAVScan.exe, SHSTAT.EXE, SNDSrvc.exe, symlcsvc.exe, UPDATE.EXE, 
UpdaterUI.exe, Vshwin32.exe, VsStat.exe, VsTskMgr.exe

W32/Bagle-BK contains a backdoor that can be used to run executable 
files sent to the infected machine.





Name   W32/Bagle-AY

Type  
    * Worm

How it spreads  
    * Email attachments
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet

Aliases  
    * Email-Worm.Win32.Bagle.ax
    * W32/Bagle.bj@MM
    * WORM_BAGLE.AY

Prevalence (1-5) 3

Description
W32/Bagle-AY is a mass-mailing and peer-to-peer worm.

Advanced
W32/Bagle-AY is a mass-mailing and peer-to-peer worm.

When first run the worm copies itself to the Windows system folder as 
sysformat.exe and creates the following registry entry so as to 
auto-start on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
sysformat
%SYSTEM%\sysformat.exe

W32/Bagle-AY will also attempt to copy itself to any folder with the 
word 'shar' in the name using all of the following filenames:

1.exe
10.exe
2.exe
3.exe
4.exe
5.scr
6.exe
7.exe
8.exe
9.exe
ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Matrix 3 Revolution English Subtitles.exe
Opera 8 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
XXX hardcore images.exe

The worm will search any local drives for files with the following 
extensions from which it will harvest email addresses:

ADB
ASP
CFG
CGI
DBX
DHTM
EML
HTM
JSP
MBX
MDX
MHT
MMF
MSG
NCH
ODS
OFT
PHP
PL
SHT
SHTM
STM
TBB
TXT
UIN
WAB
WSH
XLS
XML

Emails generated by the worm have the following characteristics:

Subject line chosen from:

Delivery service mail
Delivery by mail
Registration is accepted
Is delivered mail
You are made active

Message text chosen from:

Thanks for use of our software.
Before use read the help

Attachment name chosen from the following with an extension chosen
from these (EXE, SCR, CPL and COM):

guupd02
guupd02
Jol03
Jol03
siupd02
siupd02
upd02
upd02
viupd02
viupd02
wsd01
zupd02
zupd02

W32/Bagle-AY will also attempt to terminate various anti-virus and 
security related processes and attempt to download components from 
various websites into re_file.exe in the Windows system folder.





Name   W32/Kassbot-A

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * Backdoor.Win32.Delf.vb

Prevalence (1-5) 2

Description
W32/Kassbot-A is a network worm with backdoor functionality.

W32/Kassbot-A will attempt to spread by exploiting the following 
vulnerabilities:

DCOM (MS04-012)
LSASS (MS04-011)
Unicode Directory Traversal exploit on Microsoft IIS Web servers

Advanced
W32/Kassbot-A is a network worm with backdoor functionality.

W32/Kassbot-A will attempt to spread by exploiting the following 
vulnerabilities:

DCOM (MS04-012)
LSASS (MS04-011)
Unicode Directory Traversal exploit on Microsoft IIS Web servers

W32/Kassbot-A will connect to an IRC server and provide backdoor access 
to the infected computer.

On Windows 95/98/ME, W32/Kassbot-A will set the following registry entry 
in order to run automatically each time a user logs on:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Network Host Controller
<path to worm>

On Windows NT-based systems (NT/2000/XP), W32/Kassbot-A will run itself 
as a service named "nethost" with a display name of "Network Host 
Controller" and a Startup type of automatic, so that the service is run 
automatically each time a new Windows session is started.

Registry entries will be created under the following branch:

HKLM\SYSTEM\CurrentControlSet\Services\nethost

W32/Kassbot-A will add the following registry entry:

HKLM\SYSTEM\CurrentControlSet\Services\RpcSs
DependOnService
nethost





Name   W32/MyDoom-AN

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Uses its own emailing engine
    * Downloads code from the internet

Aliases  
    * WORM_MYDOOM.C

Prevalence (1-5) 2

Description
W32/MyDoom-AN is a mass mailing worm which also attempts to spread via 
ICQ.

The worm may also attempt to dowload files from a predefined list of 
remote websites.

In addition W32/MyDoom-AN attempts to disable firewall applications and 
attempts to prevent access to regedit.

Advanced
W32/MyDoom-AN is a mass mailing worm which also attempts to spread via 
ICQ.

W32/MyDoom-AN copies itself to the Windows folder as services.exe and 
runs the copy as a service process under the process names services.exe, 
winlogon.exe, csrss.ex and smss.exe. The worm may also create the 
following registry entry to run itself on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RPCserv32
<Windows>\services.exe

W32/MyDoom-AN attempts to retrieve target addresses to which to email 
itself via google.com or files on the infected computer but avoids 
addresses containing the following strings:

"avp."
"syman"
"icrosof"
"panda"
"sopho"
"borlan"
"inpris"
"example"
"mydomai"
"nodomai"
"ruslis"
"icrosoft"
".gov"
"gov."
".mil"
"@foo."
"@iana"
"spam"
"unix"
"linux"
"kasp"
"antivi"
"messagelabs"
"support"
"berkeley"
"unix"
"math"
"mit.e"
"gnu"
"fsf."
"ibm.com"
"google"
"kernel"
"linux"
"fido"
"usenet"
"iana"
"ietf"
"rfc-ed"
"sendmail"
"arin."
"ripe."
"isi.e"
"isc.o"
"secur"
"acketst"
"pgp"
"tanford.e"
"utgers.ed"
"mozilla"
"icq.com"
"admin"
"icrosoft"
"support"
"ntivi"
"unix"
"bsd"
"linux"
"listserv"
"certific"
"google"
"accoun"
"abuse"
"upport"
"www"
"root"
"info"
"samples"
"postmaster"
"rating"
"root"
"news"
"webmaster"
"noone"
"noreply"
"nobody"
"nothing"
"anyone"
"someone"
"rating"
"site"
"contact"
"support"
"somebody"
"privacy"
"service"
"help"
"submit"
"feste"
"gold-certs"
"avp"

Emails have the following characteristics:

Subject:

Remember me?
Hi again
Me again
Me and you :)
Important, see attchmnt
My secret
Secret message
For your eyes only!
Look whos naked =)
Is it your girl?
My girl, for your eyes only
Office jokes /-))
Whoah! Very/-very big thing! Take a look!
Your friend lying to you..
Find yourself on picture :/-D
Party photos
Youre next :) take a look
Sex in office, funny :]
Birthday Party Invitation!
<first name from predefined list> !!!
<first name from predefined list> and You!!!
Hi, <first name from predefined list> has sent you an christmas postcard.
Merry X/-Mas!
Happy New Year!
Postcard for you
New Year Postcard from your friend
New Year Postcard from <first name from predefined list>
Happy holidays! :)
Christmas ePostCard
Christmas ePostCard from <first name from predefined list>
Merry/-Christmas!
Merry/-Christmas from <first name from predefined list>
Christmas card
Christmas Postcard!
Christmas Greeting Card Waiting For You
An e/-postcard is waiting for you
A card from <first name from predefined list>

Message text (may be absent):

"You're only moments away from viewing your Doozy CARDtoon. Simply click 
on the "Get Macromedia FlashPlayer" graphic to the left.It's a cinch to 
install!Once you've finished, click HERE to view your CARDToon. If you 
need any help, we're just an email away.

Sincerely,
The Doozy Team"

"Hello! <first name from predefined list> has just sent you a greeting 
card from TakingITGlobal.org! You can pick up your personal message 
here: <URL>
http://d.takingitglobal.org/express/ecards/pickup.html?card<number>

Best Regards,
TakingITGlobal Member Services

mailto:memberservices@takingitglobal.org
http://www.takingitglobal.org"

"Hello:
There is an e-postcard waiting for you at teenpregnancy.org.
You have been sent an e-postcard from <first name from predefined list>.
To see your card go to
http://www.teenpregnancy.org/support/postcard/?mode=3DVIEW&<number>

Thank you,

The National Campaign to Prevent Teen Pregnancy"

"You have a postcard from <first name from predefined list>
To retreive this postcard point your web browser at <URL>

Your postcard will be removed in two weeks if you have not got it by
then."

Note, <URL> may point to a malicious web page.

Attached file:

<first name from predefined list>flashepostcard.exe
christmasscreenfrom<first name from predefined list>.scr
merry/-christmas.scr
<first name from predefined list>_nude.pif
flash x/-mas game.exe
photos.zip
shitpix.zip
shit.zip
fotos.zip
images.zip
<first name from predefined list>.zip

W32/MyDoom-AN may also attempt to download files from a predefined list 
of remote URLs.

W32/MyDoom-AN may create the following registry entries to attempt to 
disable any firewall protection and render regedit inaccessible:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
DisableRegistryTools
0

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
DisableRegistryTools
0

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List
EnableFirewall
0

HKLM\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List
EnableFirewall
0

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List
EnableFirewall
0

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\List
EnableFirewall
0

(Please note that the setting of these entries will not disable 
regedit.)

W32/MyDoom-AN creates the following registry entry:

HKLM\SOFTWARE\Microsoft\Internet Explorer
Mshdfg
<System time>

W32/MyDoom-AN also creates a BAT file which runs ten thousand times 
attempting to delete itself.

W32/MyDoom-AN attempts to terminate the following anti-virus, 
security-related and other processes and attempts to delete the 
corresponding files in certain cases:

SweepNet
SWEEPSRV.SYS
_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ADAWARE.EXE
ADVXDWIN.EXE
AGENTSVR.EXE
AGENTW.EXE
ALERTSVC.EXE
ALEVIR.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ARR.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATWATCH.EXE
AU.EXE
AUPDATE.EXE
AUTO-PROTECT.NAV80TRY.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGNT.EXE
AVGSERV.EXE
AVGSERV9.EXE
AVGUARD.EXE
AVGW.EXE
AVKPOP.EXE
AVKSERV.EXE
AVKSERVICE.EXE
AVKWCTl9.EXE
AVLTMAIN.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVSYNMGR.EXE
AVWIN95.EXE
AVWINNT.EXE
AVWUPD.EXE
AVWUPD32.EXE
AVWUPSRV.EXE
AvxIni
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
backdoor.rbot.gen.exe
backdoor.rbot.gen_(17).exe
BackWeb Client - 7681197
BACKWEB.EXE
BARGAINS.EXE
BD_PROFESSIONAL.EXE
BEAGLE.EXE
BELT.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BlackICE
BLACKICE.EXE
BLSS.EXE
BOOTCONF.EXE
BOOTWARN.EXE
BORG2.EXE
BPC.EXE
BRASIL.EXE
BS120.EXE
BUNDLE.EXE
BVT.EXE
CCAPP.EXE
CCEVTMGR.EXE
CCPXYSVC.EXE
CDP.EXE
CFD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
Claw95.EXE
CLAW95CF.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLICK.EXE
CMD32.EXE
CMESYS.EXE
CMGRDIAN.EXE
CMON016.EXE
CONNECTIONMONITOR.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CTRL.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
d3dupdate.exe
dailin.exe
DATEMANAGER.EXE
DCOMX.EXE
DEFALERT.EXE
DEFSCANGUI.EXE
DEFWATCH.EXE
DEPUTY.EXE
DLLCACHE.EXE
DLLREG.EXE
DOORS.EXE
DPF.EXE
DPFSETUP.EXE
DPPS2.EXE
DRWATSON.EXE
DRWEB32.EXE
DRWEBUPW.EXE
DSSAGENT.EXE
DVP95.EXE
DVP95_0.EXE
dvpapi
dvpinit
ECENGINE.EXE
EFPEADM.EXE
EMSW.EXE
ENT.EXE
ESAFE.EXE
ESCANH95.EXE
ESCANHNT.EXE
ESCANV95.EXE
ESPWATCH.EXE
ETHEREAL.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXANTIVIRUS-CNET.EXE
EXE.AVXW.EXE
EXPERT.EXE
EXPLORE.EXE
F-AGNT95.EXE
F-AGOBOT.EXE
F-PROT.EXE
F-PROT95.EXE
F-Secure Gatekeeper Handler Starter
F-STOPW.EXE
FAMEH32.EXE
FAST.EXE
FCH32.EXE
FIH32.EXE
FINDVIRU.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FNRB32.EXE
FP-WIN.EXE
FP-WIN_TRIAL.EXE
FPROT.EXE
FRW.EXE
FSAA.EXE
FSAV.EXE
FSAV32.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
FSGK32.EXE
FSM32.EXE
FSMA32.EXE
FSMB32.EXE
fvprotect.exe
GATOR.EXE
GBMENU.EXE
GBPOLL.EXE
GENERICS.EXE
GfxAcc.exe
GMT.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HBINST.EXE
HBSRV.EXE
HIJACKTHIS.EXE
HOTACTIO.EXE
HOTPATCH.EXE
HTLOG.EXE
HTPATCH.EXE
HWPE.EXE
hxdef.exe
HXDL.EXE
HXIUL.EXE
IAMAPP.EXE
IAMSERV.EXE
IAMSTATS.EXE
IAOIN.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IDLE.EXE
IEDLL.EXE
IEDRIVER.EXE
IFACE.EXE
IFW2000.EXE
INETLNFO.EXE
INFUS.EXE
INFWIN.EXE
INIT.EXE
INTDEL.EXE
INTREN.EXE
IOMON98.EXE
IPARMOR.EXE
IRIS.EXE
ISASS.EXE
ISRV95.EXE
ISTSVC.EXE
JAMMER.EXE
jammer2nd.exe
JDBGMRG.EXE
JEDI.EXE
KAVLITE40ENG.EXE
KAVMonitorService
KAVPERS40ENG.EXE
KAVPF.EXE
KEENVALUE.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KERNEL32.EXE
KILLPROCESSSETUP161.EXE
LAUNCHER.EXE
LDNETMON.EXE
LDPRO.EXE
LDPROMENU.EXE
LDSCAN.EXE
LNETINFO.EXE
LOADER.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LORDPE.EXE
LSETUP.EXE
LUALL.EXE
LUAU.EXE
LUCOMSERVER.EXE
LUINIT.EXE
LUSPT.EXE
MAPISVC32.EXE
McAfee Firewall
MCAGENT.EXE
MCMNHDLR.EXE
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MD.EXE
MFIN32.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MGUI.EXE
MINILOG.EXE
MMOD.EXE
MONITOR.EXE
MOOLIVE.EXE
MOSTAT.EXE
MPFAGENT.EXE
MPFSERVICE.EXE
MPFTRAY.EXE
MRFLUX.EXE
MSAPP.EXE
MSBB.EXE
MSBLAST.EXE
MSCACHE.EXE
MSCCN32.EXE
MSCMAN.EXE
MSCONFIG.EXE
MSDM.EXE
MSDOS.EXE
MSIEXEC16.EXE
MSINFO32.EXE
MSLAUGH.EXE
MSMGT.EXE
MSMSGRI32.EXE
MSSMMC32.EXE
msssss.exe
MSSYS.EXE
MSVXD.EXE
MU0311AD.EXE
MWATCH.EXE
N32SCANW.EXE
NAV.EXE
NAVAP.NAVAPSVC.EXE
navapsvc
NAVAPSVC.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVENGNAVEX15.NAVLU32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVSTUB.EXE
NAVW32.EXE
NAVWNT.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NEOWATCHLOG.EXE
NETARMOR.EXE
NETD32.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSKY
NETSPYHUNTER-1.2.EXE
NETUTILS.EXE
NISSERV
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NOD32.EXE
NOD32ControlCenter
NOD32Service
Norman NJeeves
Norman ZANDA
NORMIST.EXE
Norton Antivirus Server
NORTON_INTERNET_SECU_3.0_407.EXE
NOTSTART.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NProtectService
NPSCHECK.EXE
NPSSVC.EXE
NSCHED32.EXE
NSSYS32.EXE
NSTASK32.EXE
NSUPDATE.EXE
NT.EXE
NTRTSCAN.EXE
NTXconfig.EXE
NUI.EXE
NUPGRADE.EXE
NVARCH16.EXE
NVC95.EXE
nvcoas
NVCScheduler
NWINST4.EXE
NWService
NWSERVICE.EXE
NWTOOL16.EXE
OLLYDBG.EXE
ONSRVR.EXE
OPTIMIZE.EXE
OSTRONET.EXE
OTFIX.EXE
OUTPOST.EXE
OutpostFirewall
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PASSRV
PATCH.EXE
PAVCL.EXE
PAVPROXY.EXE
PAVSCHED.EXE
PAVW.EXE
PCCIOMON.EXE
PCCNTMON.EXE
PCCPFW
PCCWIN97.EXE
PCCWIN98.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCSCAN.EXE
PDSETUP.EXE
PENIS.EXE
PERISCOPE.EXE
PersFW
PERSFW.EXE
PERSWF.EXE
PF2.EXE
PFWADMIN.EXE
PGMONITR.EXE
PINGSCAN.EXE
PLATIN.EXE
POP3TRAP.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
POWERSCAN.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PRIZESURFER.EXE
PRMT.EXE
PRMVR.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
PROCEXPLORERV1.0.EXE
PROGRAMAUDITOR.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
PUSSY.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAPAPP.EXE
rasmngr.exe
RAV7.EXE
RAV7WIN.EXE
RAV8WIN32ENG.EXE
ravmon8
RAVMOND.exe
RAY.EXE
RB.EXE
RB32.EXE
RCSYNC.EXE
REALMON.EXE
REGED.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCAN.EXE
RTVSCN95.EXE
RULAUNCH.EXE
RUNDLL.EXE
RUNDLL16.EXE
RUXDLL32.EXE
SAFEWEB.EXE
SAHAGENT.EXE
SAVE.EXE
SAVENOW.EXE
SBSERV.EXE
SC.EXE
SCAM32.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
schscnt
SCRSCAN.EXE
SCRSVR.EXE
SD.EXE
SERV95.EXE
SERVLCE.EXE
SERVLCES.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SHOWBEHIND.EXE
SMC.EXE
SmcService
SMS.EXE
SMSS32.EXE
SOAP.EXE
SOFI.EXE
SPERM.EXE
SPF.EXE
SPHINX.EXE
SPOOLCV.EXE
SPOOLSV32.EXE
SPYXX.EXE
SREXE.EXE
SRNG.EXE
SS3EDIT.EXE
SSGRATE.EXE
ssgrate.exe
ST2.EXE
START.EXE
STCLOADER.EXE
SUPFTRL.EXE
SUPPORT.EXE
SUPPORTER5.EXE
SVC.EXE
SVCHOSTC.EXE
SWEEP95.EXE
SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
SYMPROXYSVC.EXE
SYMTRAY.EXE
SYSEDIT.EXE
SYSTEM.EXE
SYSTEM32.EXE
Systra.exe
SYSUPD.EXE
sysxp.exe
taskmanagr.exe
TASKMO.EXE
TASKMON.EXE
TAUMON.EXE
TBSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TDS2-98.EXE
TDS2-NT.EXE
TEEKIDS.EXE
TFAK.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
Tmntsrv
TRACERT.EXE
TRICKLER.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
TSADBOT.EXE
TVMD.EXE
TVTMD.EXE
UNDOBOOT.EXE
UPDAT.EXE
UPDATE.EXE
UPGRAD.EXE
UTPOST.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VET32.EXE
VET95.EXE
VETTRAY.EXE
VexiraAntivirus
VFSETUP.EXE
VIR-HELP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VisualGuard.exe
VNLAN300.EXE
VNPC3000.EXE
VPC32.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCAN40.EXE
VSCENU6.02D30.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
vsmon
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBDAV.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WFINDV32.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
WIMMUN32.EXE
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINPPR32.EXE
WINRECON.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
WINTSK32.EXE
WINUPDATE.EXE
winxp.exe
WKUFIND.EXE
WNAD.EXE
WNT.EXE
wowpos32.exe
WRADMIN.EXE
WRCTRL.EXE
wuamga.exe
wuamgrd.exe
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE

W32/MyDoom-AN overwrites the HOSTS file with the following lines to 
effectively prevent access to the listed URLs:

127.0.0.1 www.avp.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.symantec.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.networkassociates.com
127.0.0.1 us.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 avp.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.f-secure.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 update.symantec.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 kaspersky.com
127.0.0.1 www.trendmicro.com





Name   W32/Rbot-AIX

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Steals information
    * Downloads code from the internet

Prevalence (1-5) 2

Description
W32/Rbot-AIX is a network worm with backdoor functionality for the 
Windows platform.

W32/Rbot-AIX spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

W32/Rbot-AIX can be controlled by a remote attacker over IRC channels.

Advanced
W32/Rbot-AIX is a network worm with backdoor functionality for the 
Windows platform.

The worm copies itself to a file named trass.exe in the Windows system 
folder and creates the following registry entries:

HKCU\Software\Microsoft\Ole
Microsoft Legacy Device
trass.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Legacy Device
trass.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Legacy Device
trass.exe

W32/Rbot-AIX spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

W32/Rbot-AIX can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-AIX can be instructed by a remote 
user to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

Patches for the operating system vulnerabilities exploited by 
W32/Rbot-AIX can be obtained from Microsoft at:

http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx





Name   W32/Codbot-A

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Codbot-A is a backdoor which contains functionality to spread via 
network shares.

W32/Codbot-A contains backdoor functionality which is likely to include 
packet sniffing and downloading further code.

W32/Codbot-A may attempt to exploit a number of vulnerabilities.

Advanced
W32/Codbot-A is a backdoor which contains functionality to spread via 
network shares.

When first run, W32/Codbot-A copies itself to the Windows system folder 
as NETMON.EXE and installs this file as a service with servicename 
"Netmon" and display name "Network Monitoring Service". The worm 
attempts to connect to an IRC channen and listens for backdoor commands 
from a remote attacker.

W32/Codbot-A contains backdoor functionality which is likely to include 
packet sniffing and downloading further code.

W32/Codbot-A may create Run and RunServices registry entries in order to 
run itself on system startup.

W32/Codbot-A makes the following change to the system registry:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
"N"

W32/Codbot-A may attempt to exploit a number of vulnerabilities.





Name   Troj/Agent-ZC

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * TrojanProxy.Win32.Agent.z

Prevalence (1-5) 2

Description
Troj/Agent-ZC is a Trojan for the Windows platform that can be used for 
sending unsolicited commercial email (spam) as a result of instructions 
downloaded from a preconfigured website.

Advanced
Troj/Agent-ZC is a Trojan for the Windows platform that can be used for 
sending unsolicited commercial email (spam).

When executed Troj/Agent-ZC initiates a background process that attempts 
to download instructions from a preconfigured website that will define 
spam features including recipient addresses.

Troj/Agent-ZC harvests email addresses stored on the infected machine 
and includes them in the list of spam recipients.

Troj/Agent-ZC sends status reports to the same site using HTTP POST.

Troj/Agent-ZC may set the follwoing registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
crash0001
restorecrashwin32.bat

where restorecrashwin32.bat is a script created by the Trojan.





Name   W32/Forbot-DV

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Wootbot.ad

Prevalence (1-5) 2

Description
W32/Forbot-DV is a member of the Forbot family of network worms with 
backdoor functionality.

The backdoor component connects to an IRC channel and awaits commands 
from a remote user.

Advanced
W32/Forbot-DV is a member of the Forbot family of network worms with 
backdoor functionality.

The backdoor component connects to an IRC channel and awaits commands 
from a remote user that include the following:

take part in DDoS attacks
steal product registration information
scan other machines for vulnerabilities
harvest information from files on the hard disk
act as a server (FTP, HTTP, SOCKS4)

W32/Forbot-DV copies itself to the Windows system folder with the 
filename MsConfiG.exe, and in order to be able to run automatically when 
Windows starts up sets the registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Java Virtual Machine
MsConfiG.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Microsoft Java Virtual Machine
MsConfiG.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Java Virtual Machine
MsConfiG.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Java Virtual Machine
MsConfiG.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Microsoft Java Virtual Machine
MsConfiG.exe

W32/Forbot-DV also modifies the registry settings by adding a number of 
entries related to the established background service under the 
following entries:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRAECO.
SYTES.NET

HKLM\SYSTEM\CurrentControlSet\Services\draeco.sytes.net
HKLM\SYSTEM\CurrentControlSet\Services\draeco.sytes.net\Enum
HKLM\SYSTEM\CurrentControlSet\Services\draeco.sytes.net\Security





Name   W32/Patco-A

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.VB.nd

Prevalence (1-5) 2

Description
W32/Patco-A is a worm for the Windows platform.

W32/Patco-A copies itself to C:\windows\system\patch802.exe and 
C:\windows\codeme.exe. W32/Patco-A will periodically copy itself to A: 
and C:\my documents, replacing doc files with a file of the same name 
but and exe extension.

Advanced
W32/Patco-A is a worm for the Windows platform.

W32/Patco-A copies itself to C:\windows\system\patch802.exe and 
C:\windows\codeme.exe. W32/Patco-A will periodically copy itself to A: 
and C:\my documents, replacing doc files with a file of the same name 
but and exe extension.

W32/Patco-A creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NortorUpdate
C:\windows\system\patch802.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Myvirus
C:\windows\codeme.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Update
C:\windows\system\patch802.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Hpscanner
C:\windows\codeme.exe





Name   W32/Sdbot-TW

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry
    * Used in DOS attacks

Prevalence (1-5) 2

Description
W32/Sdbot-TW is a network worm with backdoor functionality.

W32/Sdbot-TW attempts to spread to network shares with weak passwords. 
The worm also connects to an IRC server and runs in the background 
listening for backdoor commands from a remote attacker.

The backdoor functionality of the worm includes being able to download 
and run code and participate in DDoS attacks.

Advanced
W32/Sdbot-TW is a network worm with backdoor functionality.

W32/Sdbot-TW attempts to spread to network shares with weak passwords. 
The worm also connects to an IRC server and runs in the background 
listening for backdoor commands from a remote attacker.

The backdoor functionality of the worm includes being able to download 
and run code and participate in DDoS attacks.

When first run the worm copies itself to the Windows system folder as 
IEXPLORE.EXE and creates the following registry entries in order to run 
itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Internet Explorer Configuration
IEXPLORE.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Internet Explorer Configuration
IEXPLORE.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Internet Explorer Configuration
IEXPLORE.EXE





Name   W32/MyDoom-AM

Type  
    * Worm

How it spreads  
    * Email attachments
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/MyDoom-AM is a mass-mailing and peer-to-peer worm which emails 
itself as an attachment to addresses found on the infected computer.

When first run the worm will launch notepad with garbage which serves as 
a decoy.

Advanced
W32/MyDoom-AM is a mass-mailing and peer-to-peer worm which emails 
itself as an attachment to addresses found on the infected computer.

When first run the worm will launch notepad with garbage, then copy 
itself to the Windows system folder as lsasrv.exe and then creates the 
following registry entry so as to auto-start on computer reboot:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
lsass
%SYSTEM%\lsasrv.exe

On Windows 2000 and Windows XP systems the worm will also modify the 
Explorer shell association by changing the following registry entry 
from:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer

to:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer %SYSTEM%\lsasrv.exe

W32/MyDoom-AM may also create a file hserv.sys in the Windows system 
folder. This file is non-malicious and can be safely deleted.

W32/MyDoom-AM will attempt to copy itself to peer-to-peer folders of 
KaZaa, Morpheus, iMesh, eDonkey2000 and LimeWire using the following 
filenames:

NeroBROM6.3.1.27
avpprokey
Ad-awareref01R349
winxp_patch
adultpasswds
dcom_patches
K-LiteCodecPack2.34a
activation_crack
icq2004-final
winamp5

The worm also attempts to remove previous startup registry entries of 
other malware which may be installed, terminate various anti-virus and 
security applications and prevent access to related websites by 
modifying the HOSTS file with the following entries:

127.0.0.1 grisoft.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.trendmicro.com
127.0.0.1 rads.mcafee.com
127.0.0.1 customer.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 www.nai.com
127.0.0.1 secure.nai.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 mast.mcafee.com
127.0.0.1 ca.com
127.0.0.1 www.ca.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 kaspersky.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 viruslist.com
127.0.0.1 www.viruslist.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mcafee.com
127.0.0.1 www.mcafee.com
127.0.0.1 sophos.com
127.0.0.1 www.sophos.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 www.symantec.com

W32/MyDoom-AM will harvest email addresses from files found on the 
infected computer with the following extensions:

WAB PL ADB TBB DBX ASP EDM VBS WML JS TPL CONF VB CSP ASM ASC ASA DWT 
LBI RDF RSS XST XSD DLT XML JSP INC SSI STM XHT HTC HTA CGI PHP SHT HTM 
TXT

Emails generated by the worm have the following characteristics:

Subject lines are chosen from:

Good day
Do not reply to this email
hello
Mail Delivery System
Attention!!!
Mail Transaction Failed
Server Report
Status
Error

Message body is one of:

"Mail transaction failed. Partial message is available."

"The message contains Unicode characters and has been sent as
a binary attachment."

"The message cannot be represented in 7-bit ASCII encoding and
has been sent as a binary attachment."

"Attention! New self-spreading virus!

Be careful, a new self-spreading virus called "RTSW.Smash"
spreading very fast via e-mail and P2P networks. It's about
two million people infected and it will be more.

To avoid your infection by this virus and to stop it we
provide you with full information how to protect yourself
against it and also including free remover. Your can find it
in the attachment.

2004 Networks Associates Technology, Inc. All Rights Reserved"

"New terms and conditions for credit card holders

Here a new terms and conditions for credit card holders using a
credit cards for making purchase in the Internet in the attachment.
Please, read it carefully. If you are not agree with new terms
and conditions do not use your credit card in the World Wide Web.

Thank you,

The World Bank Group
2004 The World Bank Group, All Rights Reserved"

"Thank you for registering at WORLDXXXPASS.COM

All your payment info, login and password you can find in the
attachment file. It's a real good choise to go to
WORLDXXXPASS.COM"

"Attention! Your IP was logged by The Internet Fraud Complaint Center

Your IP was logged by The Internet Fraud Complaint Center. There was
a fraud attempt logged by The Internet Fraud Complaint Center from
your IP. This is a serious crime, so all records was sent to the FBI.
All information you can find in the attachment. Your IP was flagged
and if there will be anover attemption you will be busted.

This message is brought to you by the Federal Bureau of Investigation
and the National White Collar Crime Center"

"Here is your documents you are requested."

Attachment filenames are chosen from the following and can take one
of these extensions (pif, scr, exe, cmd, bat, zip):

document
readme
doc
rules
docs
message
body





Name   W32/Rbot-UH

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Uses its own emailing engine
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Rbot.gen

Prevalence (1-5) 2

Description
W32/Rbot-UH is a worm with backdoor functionality.

W32/Rbot-UH is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

W32/Rbot-UH will attempt to spread by exploiting the DCOM (MS04-012) and 
LSASS (MS04-011) software vulnerabilities and to computers running 
Microsoft SQL servers with weak passwords

Advanced
W32/Rbot-UH is a worm with backdoor functionality.

W32/Rbot-UH is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

W32/Rbot-UH will attempt to spread by exploiting the following 
vulnerabilities:

DCOM (MS04-012)
LSASS (MS04-011)
Microsoft SQL servers with weak passwords.

When first run, W32/Rbot-UH copies itself to the Windows system folder 
as MCAFESHIELD.EXE and runs this copy of the worm. The copy will then 
attempt to delete the original file. In order to run each time a user 
logs in, W32/Rbot-UH will set the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Mcafee Auto Protect
mcafeshield.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Mcafee Auto Protect
mcafeshield.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Mcafee Auto Protect
mcafeshield.exe

The worm runs continuously in the background providing backdoor access 
to the infected computer.

The backdoor component of W32/Rbot-UH can be used to:

Initiate Distributed Denial-of-Service (DDoS) attacks.
Redirect TCP and SOCKS4 traffic.
Provide a remote login command shell.
Download, upload, delete and execute files.
Set up an HTTP, TFTP and FTP file server.
Steal passwords (including PayPal account information).
Log key presses and clipboard data.
Capture screenshots, webcam pictures and videos.
List and kill processes.
Stop, start, pause and delete services.
Open and close vulnerabilities.
Port scan for vulnerabilities on other remote computers.
Send emails as specified by the remote user.
Flush the DNS and ARP caches.
Shut down and reboot the computer.
Add and delete network shares, groups and users.
Sniff network traffic for passwords.
Send Net Messages.

W32/Rbot-UH can be used to steal registration and key details from 
several computer games and applications including:

Battlefield 1942
Battlefield 1942 (Road To Rome)
Battlefield 1942 (Secret Weapons of WWII)
Battlefield Vietnam
Black and White
Chrome
Command and Conquer: Generals
Command and Conquer: Generals (Zero Hour)
Command and Conquer: Red Alert
Command and Conquer: Red Alert 2
Command and Conquer: Tiberian Sun
Counter-Strike
Far Cry
FIFA 2002
FIFA 2003
Freedom Force
Global Operations
Ground Control II
Gunman Chronicles
Half-Life
Hidden & Dangerous 2
IGI 2: Covert Strike
Industry Giant 2
James Bond 007: Nightfire
J