Text 130, 1057 rader
Skriven 2006-07-30 23:56:00 av KURT WISMER (1:123/140)
Ärende: News, July 30 2006
==========================
[cut-n-paste from sophos.com]
Name Troj/Zlob-PV
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Reduces system security
* Installs itself in the Registry
* Dropped by malware
Aliases
* Trojan-Downloader.Win32.Zlob.aac
* Win32/TrojanDownloader.Zlob.VN
* TROJ_ZLOB.AIJ
Prevalence (1-5) 2
Description
Troj/Zlob-PV is a downloader Trojan for the Windows platform.
Troj/Zlob-PV may be dropped by Troj/Zlob-PU.
Advanced
Troj/Zlob-PV is a downloader Trojan for the Windows platform.
Troj/Zlob-PV may be dropped by Troj/Zlob-PU.
When Troj/Zlob-PV is installed the following files are created:
<System>\simpole.tlb
<System>\hp100.tmp
<System>\stdole3.tlb - clean file
The file hp100.tmp is registered as a COM object and Browser Helper
Object (BHO) for Microsoft Internet Explorer, creating registry
entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\(f7d40011-29bb-43eb-9c97-875ce89e9e36)
HKCR\CLSID\(f7d40011-29bb-43eb-9c97-875ce89e9e36)
Troj/Zlob-PV changes Start Page and search settings for Microsoft
Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Search\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objecta\(f7d40011-29bb-43eb-9c97-875ce89e9e36)\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objecta\(f7d40011-29bb-43eb-9c97-875ce89e9e36)\(default)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
dcomcfg.exe
dcomcfg.exe
Name Troj/FakeVNC-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
Prevalence (1-5) 2
Description
Troj/FakeVNC-A is a Trojan.
Troj/FakeVNC-A is a hacked WinVNC server, which allows an intruder
remote access to the computer.
Advanced
Troj/FakeVNC-A is a Trojan.
Troj/FakeVNC-A is a hacked WinVNC server, which allows an intruder
remote access to the computer.
Troj/FakeVNC-A contains modified resource information which says it
is "System Kernel Check for Win32" from Microsoft Corporation.
Name Troj/Haxdoor-CP
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Haxdoor.ga
Prevalence (1-5) 2
Description
Troj/Haxdoor-CP is a Trojan for the Windows platform.
Troj/Haxdoor-CP runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/Haxdoor-CP includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security
related applications
Advanced
Troj/Haxdoor-CP is a Trojan for the Windows platform.
Troj/Haxdoor-CP runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/Haxdoor-CP includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security
related applications
Troj/Haxdoor-CP may arrive in email with the following characteristics:
Subject line: Confirmation for Order WC2905036
Message text: "Dear Sir/Madam,
Thank you for shopping with our internet shop. Your order, WC2905036,
has been received. Summary of your order you can see in the
attachment file.
This email is to confirm the receipt of your order. Please do not
reply as this email was sent from our automated confirmation system.
Please Note: There is no need to re-send your request or call our
customer service department for status or tracking number, this will
only delay our response time to you. Rest assured, we are making
every effort to process and ship your order within 1 to 2 business
days. We appreciate your understanding and patience and do value your
business.
Once your order has been processed and shipped a FEDEX Tracking
number will be automatically emailed to the address provided.
Please Note: Tracking information will be available in FedEx's system
only after 10pm EST Monday thru Friday. If you receive a tracking
number on Sunday, you will be able to track it Monday evening after
10pm EST.
All orders placed including 1-2 or 2-3 business day options are
shipped within 48 hours providing the merchandise is in stock.
All FedEx Ground orders will take 7-10 business days to arrive.
Some packages may require a signature upon delivery. These packages
will not be left without a signature. For your convenience, we will
email you a FedEx tracking number on all successfully processed and
shipped orders.
All Plasma TVs, DVD players, Scanners, Fax Machines, Receivers, Home
Theater, and Printers are not returnable after box is opened.
To insure the best handling of your order please allow 24-48 business
hours for the processing and the shipping of your order. Thank you
for your cooperation.
We hope you enjoy your order! Thank you for shopping with us!"
Attached file: WC2905036.zip
When Troj/Haxdoor-CP is installed the following files are created:
<System>\kgctini.dat
<System>\lps.dat
<System>\qo.dll
<System>\qo.sys
<System>\ycsvga.sys
<System>\yvsvga.dll
<System>\yvsvga.sys
The files qo.dll, qo.sys, ycsvga.sys, yvsvga.dll and yvsvga.sys are
detected as Troj/Haxdor-Fam.
The following registry entries are created to run code exported by
yvsvga.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\yvsvga
DllName
yvsvga.dll
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\yvsvga
Startup
XFD00Safex
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\yvsvga
Impersonate
1
The file ycsvga.sys is registered as a new system driver service
named "ycsvga", with a display name of "NDIS OSI". Registry entries
are created under:
HKLM\SYSTEM\CurrentControlSet\Services\ycsvga\
Name W32/Tilebot-GA
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Prevalence (1-5) 2
Description
W32/Tilebot-GA is a worm and IRC backdoor for the Windows platform.
W32/Tilebot-GA spreads to other network computers by:
exploiting common buffer overflow vulnerabilities, including WKS
(http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx)
(CAN-2003-0812), PNP
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
and ASN.1
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
copying itself to network shares protected by weak passwords
W32/Tilebot-GA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-GA includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Tilebot-GA is a worm and IRC backdoor for the Windows platform.
W32/Tilebot-GA spreads to other network computers by:
exploiting common buffer overflow vulnerabilities, including WKS
(http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx)
(CAN-2003-0812), PNP
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
and ASN.1
(http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx)
copying itself to network shares protected by weak passwords
W32/Tilebot-GA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-GA includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-GA copies itself to <Windows system
folder>\sysdriver.exe.
The file sysdriver.exe is registered as a new system driver service
named "systemdriver", with a display name of "System Driver Service"
and a startup type of automatic, so that it is started automatically
during system startup.
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\systemdriver\
W32/Tilebot-GA may sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
The following registry entries may be modified:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Dloadr-AKL
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/Dloadr-AKL is a downloader Trojan for the Windows platform.
Troj/Dloadr-AKL may attempt to download a file to
"C:\28348177711.exe" and execute it. The downloaded file is detected
as Troj/FireSpy-A.
Troj/Dloadr-AKL also attempts to inject itself into "explorer.exe" to
avoid detection.
Name W32/Tilebot-GB
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Tilebot-GB is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-GB runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-GB spreads:
- to other network computers by exploiting the buffer overflow
vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
- Weak password MSSQL server spread
- AOL Instant Messenger spread
Advanced
W32/Tilebot-GB is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-GB runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-GB spreads:
- to other network computers by exploiting the buffer overflow
vulnerabilities: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
- Weak password MSSQL server spread
- AOL Instant Messenger spread
W32/Tilebot-GB includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-GB copies itself to
<Windows>\sqlmanagement.exe.
The file sqlmanagement.exe is registered as a new system driver
service named "sqlmanagement", with a display name of "sqlmanagement"
and a startup type of automatic, so that it is started automatically
during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\sqlmanagement\
The following registry entries are set, disabling the registry editor
(regedit) and the Windows task manager (taskmgr):
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
W32/Tilebot-GB sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/AdClick-CR
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Clicker.Win32.Agent.al
* AdClicker-BH
Prevalence (1-5) 2
Description
Troj/AdClick-CR is a Trojan for the Windows platform.
Troj/AdClick-CR runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/AdClick-CR includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/AdClick-CR is a Trojan for the Windows platform.
Troj/AdClick-CR runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
Troj/AdClick-CR includes functionality to access the internet and
communicate with a remote server via HTTP.
When Troj/AdClick-CR is installed the following files are created:
<Desktop>\Click to Remove Spyware.lnk
<Desktop>\Remove Spyware Now!.lnk
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
ButtonText
Your PC is infected with Spyware - click here to fix your PC
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
clsid
{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Default Visible
Yes
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Exec
https://www.spydeleter.com/order2.php?KBID=1062
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
HotIcon
<Windows folder>\sd.ico
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Extensions\{FB74C951-ACA1-4e33-A94C-A9261EB2CCB7}
Icon
<Windows folder>\sd.ico
Name Troj/Delf-CXN
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Delf.zt
Prevalence (1-5) 2
Description
Troj/Delf-CXN is a Trojan for the Windows platform.
Troj/Delf-CXN includes functionality to download, install and run new
software.
Name W32/Yurist-B
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Yurist.v
Prevalence (1-5) 2
Description
W32/Yurist-B is a network worm and information stealing Trojan for
the Windows platform.
W32/Yurist-B includes functionality to access the internet and
communicate with a remote server via HTTP. When W32/Yurist-B runs, it
collects the email password information and uploads it to a website.
Advanced
W32/Yurist-B is a network worm and information stealing Trojan for
the Windows platform.
W32/Yurist-B includes functionality to access the internet and
communicate with a remote server via HTTP. When W32/Yurist-B runs, it
collects the email password information and uploads it to a website.
When first run W32/Yurist-B copies itself to <System>\xflash.exe and
creates the file <System>\xflasett.
The following registry entry is created to run xflash.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
xflash
xflash.exe
Name Troj/Keylog-HD
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Agent.aec
Prevalence (1-5) 2
Description
Troj/Keylog-HD is a Trojan for the Windows platform.
Troj/Keylog-HD includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Keylog-HD is a Trojan for the Windows platform.
Troj/Keylog-HD includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/Keylog-HD displays a slideshow of 3 photos called
"Victoria Stasova" with three different pictures. The Trojan silently
copies itself to <Windows folder>\svchst.exe and creates the file
<Windows>\svchst<##>.dll, where <##> is a random two digit number.
The following registry entry is created to run svchst.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
svchst
<Windows folder>\svchst.exe
Registry entries are created under:
HKLM\SOFTWARE\Ezhik\
Name Troj/Agent-CIO
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Deletes files off the computer
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Agent.ael
Prevalence (1-5) 2
Description
Troj/Agent-CIO is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Troj/Agent-CIO includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Agent-CIO is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Troj/Agent-CIO includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/Agent-CIO copies itself to <Windows>\mcvswin.exe.
The following registry entries are created to run mcvswin.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
prnsyst
<Windows>\mcvswin.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
prnsyst
<Windows>\mcvswin.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
prnsyst
<Windows>\mcvswin.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL
udpg
2328426
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL
ver
Name W32/Looked-E
Type
* Virus
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Installs adware
Aliases
* Worm.Win32.Viking.p
* W32/HLLP.Philis
* Win32/Viking.P
* W32.Looked.P
* PE_LOOKED.AN
Prevalence (1-5) 2
Description
W32/Looked-E is a virus and backdoor for the Windows platform.
W32/Looked-E runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Looked-E attempts to copy itself to network shares and infect EXE
files. W32/Looked-E may attempt to disable certain Anti-virus
applications.
W32/Looked-E includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Looked-E is a virus and backdoor for the Windows platform.
W32/Looked-E runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Looked-E attempts to copy itself to network shares and infect EXE
files. W32/Looked-E may attempt to disable certain Anti-virus
applications.
W32/Looked-E includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Looked-E copies itself to <Windows>\rundl132.exe
and creates the file \%CurrentFolder%\viDll.dll.
The following registry entry is created to run rundl132.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe
Registry entries are created under:
HKLM\SOFTWARE\Soft\DownloadWWW\
Name Troj/Delf-EDE
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* PWS-LegMir.gen.e
Prevalence (1-5) 2
Description
Troj/Delf-EDE is a Trojan for the Windows platform.
Advanced
Troj/Delf-EDE is a Trojan for the Windows platform.
When first run Troj/Delf-EDE copies itself to <Windows system
folder>\svchoxt.exe.
The following registry entry is created to run svchoxt.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysDesk
<Windows system folder>\svchoxt.exe
Name W32/Spybot-LA
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Spybot-LA is a worm and IRC backdoor for the Windows platform.
W32/Spybot-LA runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
Advanced
W32/Spybot-LA is a worm and IRC backdoor for the Windows platform.
W32/Spybot-LA runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
When first run W32/Spybot-LA copies itself to <System>\wns.exe.
The following registry entries are created to run wns.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft DLL Verifier
wns.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft DLL Verifier
wns.exe
W32/Spybot-LA sets the following registry entries, disabling the
automatic
startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft
Internet Connection Firewall (ICF).
Registry entries are set as follows:
HKCU\Software\Microsoft\OLE
Microsoft DLL Verifier
wns.exe
HKLM\SOFTWARE\Microsoft\Ole
EnableRemoteConnect
N
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPer1_0Server
50
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPerServer
50
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name W32/Tilebot-GD
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.SdBot.aad
Prevalence (1-5) 2
Description
W32/Tilebot-GD is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-GD spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), PNP ( MS05-039) and ASN.1 (MS04-007).
W32/Tilebot-GD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Tilebot-GD copies itself to <System>\smsc.exe.
Advanced
W32/Tilebot-GD is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-GD spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007).
W32/Tilebot-GD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Tilebot-GD copies itself to <System>\smsc.exe.
The file smsc.exe is registered as a new Windows service named
"Window Services Connection", with a display name of "Window Services
Connection" and a startup type of automatic, so that it is started
automatically during system startup. Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\Window Services Connection\
W32/Tilebot-GD sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|