Text 184, 1188 rader
Skriven 2007-04-16 00:26:00 av KURT WISMER
Ärende: News, April 16 2007
===========================
[cut-n-paste from sophos.com]
Name Troj/DwnLdr-GTK
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Trojan-Downloader.Win32.Nurech.bf
* Downloader-AAP
Prevalence (1-5) 3
Description
Troj/DwnLdr-GTK is a Trojan for the Windows platform.
Advanced
Troj/DwnLdr-GTK is a Trojan for the Windows platform.
Troj/DwnLdr-GTK includes functionality to access the internet and
communicate with a remote server via HTTP. The Trojan also has the
functionality to download and execute files from a remote location.
When first run Troj/DwnLdr-GTK copies itself to <System>\isca.exe and
creates the file <System>\drivers\qas.tx. The file qas.tx is harmless
and may be safely deleted.
The following registry entry is created to run isca.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
gtydf
iscca.exe
The following registry entry is also set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
wef
505
Name W32/Dref-AG
Type
* Worm
How it spreads
* Email messages
* Email attachments
Affected operating systems
* Windows
Aliases
* Win32/Nuwar.gen worm
* Email-Worm.Win32.Zhelatin.cs
Prevalence (1-5) 3
Description
W32/Dref-AG is a worm for the Windows platform.
Advanced
W32/Dref-AG is an email worm for the Windows platform.
W32/Dref-AG harvests email addresses from the infected computer and
attempts to send itself to all non .mil or .gov address that it finds.
W32/Dref-AG tries to send itself in an email with the following
characteristics:
Subject line (one of the following):
A Dream is a Wish
A Is For Attitude
A Kiss So Gentle
A Precious Gift
A Rose
A Rose for My Love
A Toast My Love
A Token of My Love
Come Dance with Me
Come Relax with Me
Destiny
Dream of You
Eternal Love
Eternity of Your Love
Falling In Love with You
For You....My Love
Happy I'll Be Your Bride
Heavenly Love
Hugging My Pillow
I am Complete
I Dream of you
I Love Thee
I Love You Because
I Love You Soo Much
I Love You with All I Am
I Would Dream
If Loving You
In Your Arms
Inside My Heart
Kisses Through E-mail
Last Night
Love Is...
Love Remains
Magic Power Of Love
Memories of You
Miracle of Love
My Love
Our Journey
Our Love is Free
Our Love is Strong
Our Love Nest
Our Love Will Last
Pages from My Heart
Path We Share
Sending You All My Love
Sending You My Love
Sent with Love
Special Romance
Surrounded by Love
The Dance of Love
The Miracle of Love
The Mood for Love
The Moon & Stars
The Time for Love
When I'm With You
When Love Comes Knocking
When You Fall in Love
Why I Love You
Words in my Heart
Wrapped in Your Arms
You're in my Soul
You're In My Thoughts
You're my Dream
You're the One
You... In My Dreams
Your Friend and Lover
Your Love Has Opened
Attachment filename (one of the following):
postcard.exe
Greeting Card.exe
Greeting Postcard.exe
Flash Postcard.exe
With Love.exe
Love Postcard.exe
My Love.exe
When W32/Dref-AG is installed the following files are created:
<current folder>\<Random>.exe
<System>\wincom32.ini
<System>\wincom32.sys
The file wincom32.sys is detected as Troj/Dorf-Fam and the file
<Random>.exe is detected as W32/Dref-AB.
W32/Dref-AG deletes the following registry entry to stop the file
referenced from running on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Agent
W32/Dref-AG sets the following registry entry, disabling the
automatic startup of the SharedAccess service:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
W32/Dref-AG terminates processes certain processes and windows
related to security and anti-virus applications, including windows
names "Registry Editor".
Name Troj/Sadelphi-A
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Records keystrokes
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Sadelphi-A is a Trojan for the Windows platform.
Advanced
Troj/Sadelphi-A is a keystroke-logging Trojan that contains
functionality to communicate with a remote server via FTP.
When first run, Troj/Sadelphi-A copies itself to:
<Windows>\swchost.exe
Troj/Sadelphi-A adds the following registry entry to run itself at
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe
<Windows>\swchost.exe
Troj/Sadelphi-A records all keystrokes to a randomly named file with
a SYS extension, in the same folder that Troj/Sadelphi-A is executed
from.
When the infected computer shuts down, Troj/Sadelphi-A attempts to
send the SYS file to a remote server via FTP.
Name Troj/Agent-ENV
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/Agent-ENV is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Advanced
Troj/Agent-ENV is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
When first installed, the Trojan copies itself to <Windows>\task.exe
and sets the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
taskmgr
<path of Trojan executable>
Name W32/Vetor-B
Type
* Virus
How it spreads
* Infected files
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
W32/Vetor-B is an executable file virus for the Windows platform.
Name W32/Dref-AH
Type
* Spyware Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Sends itself to email addresses found on the infected computer
* Steals information
* Drops more malware
* Forges the sender's email address
* Uses its own emailing engine
Aliases
* Email-Worm.Win32.Zhelatin.ct
* Win32/Nuwar.Gen worm
Prevalence (1-5) 2
Description
W32/Dref-AH is an email worm for the Windows platform.
W32/Dref-AH tries to send itself in an email with the following
characteristics:
Attachment filename (one of the following):
Flash Postcard.exe
flash postcard.exe
greeting card.exe
Greeting Card.exe
Greeting Postcard.exe
greeting postcard.exe
Love Card.exe
Love Postcard.exe
My Love.exe
postcard.exe
Postcard.exe
With Love.exe
Subject line (one of the following):
A Dream is a Wish
A Is For Attitude
A Kiss So Gentle
A Precious Gift
A Rose
A Rose for My Love
A Toast My Love
A Token of My Love
Come Dance with Me
Come Relax with Me
Destiny
Dream of You
Eternal Love
Eternity of Your Love
Falling In Love with You
For You....My Love
Heavenly Love
Hugging My Pillow
I am Complete
I Dream of you
I Love Thee
I Love You Because
I Love You Soo Much
I Love You with All I Am
I Would Dream
If Loving You
In Your Arms
Inside My Heart
Kisses Through E-mail
Last Night
ll Be Your Bride
Love Is...
Love Remains
m With You
Magic Power Of Love
Memories of You
Miracle of Love
My Love
Our Journey
Our Love is Free
Our Love is Strong
Our Love Nest
Our Love Will Last
Pages from My Heart
Path We Share
re in my Soul
re In My Thoughts
re my Dream
re the One
Sending You All My Love
Sending You My Love
Sent with Love
Special Romance
Surrounded by Love
The Dance of Love
The Miracle of Love
The Mood for Love
The Moon & Stars
The Time for Love
When Love Comes Knocking
When You Fall in Love
Why I Love You
Words in my Heart
Wrapped in Your Arms
You... In My Dreams
Your Friend and Lover
Your Love Has Opened
Advanced
W32/Dref-AH is an email worm for the Windows platform.
W32/Dref-AH harvests email addresses from the infected computer and
attempts to send itself to them, though due to a bug in the code will
usually send a file detected as W32/Dref-Dam.
W32/Dref-AH tries to send itself in an email with the following
characteristics:
Attachment filename (one of the following):
Flash Postcard.exe
flash postcard.exe
greeting card.exe
Greeting Card.exe
Greeting Postcard.exe
greeting postcard.exe
Love Card.exe
Love Postcard.exe
My Love.exe
postcard.exe
Postcard.exe
With Love.exe
Subject line (one of the following):
A Dream is a Wish
A Is For Attitude
A Kiss So Gentle
A Precious Gift
A Rose
A Rose for My Love
A Toast My Love
A Token of My Love
Come Dance with Me
Come Relax with Me
Destiny
Dream of You
Eternal Love
Eternity of Your Love
Falling In Love with You
For You....My Love
Heavenly Love
Hugging My Pillow
I am Complete
I Dream of you
I Love Thee
I Love You Because
I Love You Soo Much
I Love You with All I Am
I Would Dream
If Loving You
In Your Arms
Inside My Heart
Kisses Through E-mail
Last Night
ll Be Your Bride
Love Is...
Love Remains
m With You
Magic Power Of Love
Memories of You
Miracle of Love
My Love
Our Journey
Our Love is Free
Our Love is Strong
Our Love Nest
Our Love Will Last
Pages from My Heart
Path We Share
re in my Soul
re In My Thoughts
re my Dream
re the One
Sending You All My Love
Sending You My Love
Sent with Love
Special Romance
Surrounded by Love
The Dance of Love
The Miracle of Love
The Mood for Love
The Moon & Stars
The Time for Love
When Love Comes Knocking
When You Fall in Love
Why I Love You
Words in my Heart
Wrapped in Your Arms
You... In My Dreams
Your Friend and Lover
Your Love Has Opened
When W32/Dref-AH is installed the following files are created:
<Current Folder>\<random characters>.exe
<System>\wincom32.ini
<System>\wincom32.sys
The file wincom32.sys is detected as Troj/Dorf-Fam and the file
<random characters>.exe is detected as W32/Dref-AB. The file
wincom.ini is not malicious and can safely be deleted manually.
W32/Dref-AH deletes the following registry entry to stop the file
referenced from running on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Agent
W32/Dref-AH sets the following registry entry, disabling the
automatic startup of the SharedAccess service:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
W32/Dref-AH terminates processes certain processes and windows
related to security and anti-virus applications, including windows
names "Registry Editor".
Name W32/Looked-DA
Type
* Virus
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Worm.Win32.Viking.kl
* W32/HLLP.Philis.jk
* Win32/Viking.CH
Prevalence (1-5) 2
Description
W32/Looked-DA is a prepending virus for the Windows platform.
Advanced
W32/Looked-DA is a prepending virus for the Windows platform.
When W32/Looked-DA is installed the following files are created:
<Windows>\Logo1_.exe
<Windows>\uninstall\rundl132.exe
The files Logo1_.exe and rundl132.exe are detected as W32/Looked-DA.
The following registry entry is created to run rundl132.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe
Name Troj/PWS-AMJ
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
Prevalence (1-5) 2
Description
Troj/PWS-AMJ is a password stealing Trojan for the Windows platform.
Advanced
Troj/PWS-AMJ is a password stealing Trojan for the Windows platform.
Troj/PWS-AMJ will attempt to steal passwords from a series of
applications and sends them to a remote address.
Name W32/GlueBot-A
Type
* Spyware Worm
How it spreads
* Removable storage devices
* Network shares
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
* Leaves non-infected files on computer
* Monitors system activity
* Enables remote access
Prevalence (1-5) 2
Description
W32/GlueBot-A is a worm with backdoor functionality for the Windows
platform.
Advanced
W32/GlueBot-A is a worm with backdoor functionality for the Windows
platform.
W32/GlueBot-A includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/GlueBot-A copies itself to:
<Windows>\Recycled.exe
<System>\winlogin.exe
and creates the file <Temp>\r.reg.
W32/GlueBot-A attempts to spread by copying itself to the root folder
of removable drives and adding an AUTORUN.INF to automatically run
itself when the drive is mounted next.
W32/GlueBot-A has the functionality to spread via chat programs and
open network shares.
W32/GlueBot-A attempts to change the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogin
winlogin.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Clip
Recycled.exe -mon
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
00000002
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFi
leExt
00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSu
perHidden
00000000
Name W32/RabbitLuv-B
Type
* Worm
How it spreads
* Network shares
* Web downloads
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Deletes files off the computer
Prevalence (1-5) 2
Description
W32/RabbitLuv-B is a worm for the windows platform.
Advanced
W32/RabbitLuv-B is a worm for the windows platform.
W32/RabbitLuv-B spreads by copying itself to network shares and may
entice the user to travel to a maliciously crafted website to
download and run a copy of itself.
W32/RabbitLuv-B will attempt to copy itsef to the root folders of
network drives.
W32/RabbitLuv-B will also create a file AutoRun.inf in those drives
in an attempt to run itself automatically when the drive is accessed.
W32/RabbitLuv-B will also attempt to overwrite all files with the
extension EXE on network drives and the C:\<Program Files> folder
with itself.
W32/RabbitLuv-B includes functionality to inject its code into
WINLOGON.EXE.
W32/RabbitLuv-B includes functionality to disable the registry editor.
When W32/RabbitLuv-B is installed the following files are created:
<System>\MS006TZ.dll.exe - detected as W32/RabbitLuv-B.
<System>\loveRabbit~.exe - detected as W32/RabbitLuv-B.
<System>\JK~.exe - detected as W32/RabbitLuv-B.
<Windows>\dll.bat - may be deleted.
<Windows>\gho.bat - may be deleted.
<Windows>\iltz.bat - may be deleted.
<Windows>\iotz.bat - may be deleted.
<Windows>\ILTZ.inf - may be deleted.
<Windows>\IOTZ.inf - may be deleted.
<Windows>\GHO.inf - may be deleted.
Name W32/Sohana-S
Type
* Worm
How it spreads
* Removable storage devices
* Chat programs
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Win32/Sohanad.NAM worm
* IM-Worm.Win32.Sohanad.t
Prevalence (1-5) 2
Description
W32/Sohana-S is a worm for the Windows platform.
W32/Sohana-S spreads
- via Yahoo Messenger.
- by copying itself to all mapped drives and removable storage
devices.
W32/Sohana-S includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Sohana-S is a worm for the Windows platform.
W32/Sohana-S spreads
- via Yahoo Messenger.
- by copying itself to all mapped drives and removable storage
devices.
W32/Sohana-S includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Sohana-S copies itself to:
<Windows>\SVICHOSST.exe
<System>\SVICHOSST.exe
and creates the following files:
<System>\autorun.ini
<System>\setting.ini
These files are harmless and can be deleted.
The following registry entry is created to run SVICHOSST.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Yahoo Messengger
<System>\SVICHOSST.exe
The following registry entry is changed to run SVICHOSST.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe SVICHOSST.exe
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
The following registry entry is set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NofolderOptions
1
Name W32/Tiotua-G
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
* Modifies browser settings
Aliases
* IM-Worm.Win32.Sohanad.ak
Prevalence (1-5) 2
Description
W32/Tiotua-G is a worm for the Windows platform.
W32/Tiotua-G spreads by copying itself to mapped disk drives and
removable storage devices.
When run, the worm opens various programs like Notepad, Solitaire,
Pinball, Windows Media Player etc. It also tries to open and close
the CD drive. It pretends to select and delete all shortcuts on the
Desktop. After this it displays a fake message "The 'USB Mass Storage
Device' device can now be safely removed from the system." and forces
a reboot.
W32/Tiotua-G creates a number of WIndows Schedules Tasks to run
itself at various times everyday.
Advanced
W32/Tiotua-G is a worm for the Windows platform.
W32/Tiotua-G spreads by copying itself to mapped disk drives and
removable storage devices.
When W32/Tiotua-G is installed, it copies itself to all mapped drives
as TinyVirusCleaner.exe and creates the following files:
<Root>\autorun.inf
<Root>\pantun teka teki.txt
<Windows>\Tempt\talk.bat
The following registry entry is created to run talk.bat on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
talk
<Windows>\Tempt\talk.bat
All the above text files are harmless and can be deleted.
The worm then opens various programs like Notepad, Solitaire,
Pinball, Windows Media Player etc. It also tries to open and close
the CD drive. It pretends to select and delete all shortcuts on the
Desktop. After this it displays a fake message "The 'USB Mass Storage
Device' device can now be safely removed from the system." and forces
a reboot.
W32/Tiotua-G creates a number of WIndows Schedules Tasks to run
itself at various times everyday.
W32/Tiotua-G changes settings for Microsoft Internet Explorer by
modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
1
Registry entries are also set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoViewContextMenu
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoViewContextMenu
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\ Hidden\SHOWALL
CheckedValue
0
Name Troj/QQHelp-DX
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/QQHelp-DX is a Trojan for the Windows platform.
Advanced
Troj/QQHelp-DX is a Trojan for the Windows platform.
When Troj/QQHelp-DX is installed the following files are created:
<Favorites>\<non-english characters>.url
<Common Files>\system\Updaterun.exe
<Windows>\bar.exe
<Windows>\f2.exe
<System>\advport.dll
<System>\rundll2000.exe
<System>\uaomd.dll
<System>\wbem\gzjdq.dll
<System>\wbem\ocmor.dll
The following registry entry is created to run Updaterun.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System
<Common Files>\System\Updaterun.exe
Name W32/Sober-AD
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Sends itself to email addresses found on the infected computer
* Uses its own emailing engine
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Sober.aa
* WORM_SOBER.AX
Prevalence (1-5) 2
Description
W32/Sober-AD is a mass-mailing worm for the Windows platform.
The emails sent by W32/Sober-AD may have the following characteristics:
Subject line chosen from:
Ihr Passwort wurde geaendert!
Ihr Passwort wurde erfolgreich geaendert.
Ihre neuen Account-Daten und Passwort befinden sich gesichert im
Anhang!
PDaten Fehlerhafte Mailzustellung Diese Nachricht wurde Automatisch
generiert.
Ihre EMail konnte nicht empfangen oder gesendet werden.
Ihr Account wurde eingerichtet!
Danke das Sie sich fuer uns entschieden haben.
Passw_Data Um ihren neuen Account zu aktivieren, folgen sie der
kurzen Anleitung im Anhang.
Es sind nur 2 Schritte noetig!
Anleitung
Your eMail has occurred an unknown error on our Server.
Please read your mail and check the text.
The full email is attached!
Advanced
W32/Sober-AD is a mass-mailing worm for the Windows platform.
When W32/Sober-AD is installed it copies itself to:
<Windows>\PoolData\csrss.exe
<Windows>\PoolData\services.exe
<Windows>\PoolData\smss.exe
and creates the following files:
<Windows>\PoolData\WinD.osa
<Windows>\PoolData\runnor.ssy
<Windows>\PoolData\spxttx1.xnt
These files can be deleted.
The following registry entries are created to run W32/Sober-AD on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
_WinData
<Windows>\PoolData\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinData
<Windows>\PoolData\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
_WinData
<Windows>\PoolData\services.exe %1
The emails sent by W32/Sober-AD may have the following characteristics:
Subject line chosen from:
Ihr Passwort wurde geaendert!
Ihr Passwort wurde erfolgreich geaendert.
Ihre neuen Account-Daten und Passwort befinden sich gesichert im
Anhang!
PDaten Fehlerhafte Mailzustellung Diese Nachricht wurde Automatisch
generiert.
Ihre EMail konnte nicht empfangen oder gesendet werden.
Ihr Account wurde eingerichtet!
Danke das Sie sich fuer uns entschieden haben.
Passw_Data Um ihren neuen Account zu aktivieren, folgen sie der
kurzen Anleitung im Anhang.
Es sind nur 2 Schritte noetig!
Anleitung
Your eMail has occurred an unknown error on our Server.
Please read your mail and check the text.
The full email is attached!
Name Troj/PatchLs-B
Type
* Trojan
Affected operating systems
* Windows
Prevalence (1-5) 2
Description
Troj/PatchLs-B is a Trojan for the Windows platform.
Advanced
Troj/PatchLs-B is a Trojan for the Windows platform.
Troj/PatchLs-B attempts to inject code into the Lsass.exe process.
Name W32/Catcher-B
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Catcher-B is a worm for the Windows platform.
Advanced
W32/Catcher-B is a worm for the Windows platform.
W32/Catcher-B spreads by copying itself to the root of all mapped
drives.
When first run W32/Catcher-B copies itself to:
\Win32.dll.vbs
<Windows>\Win32.dll.vbs
and creates the file \autorun.inf.
The following registry entry is created to run Win32.dll.vbs on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mcafee
<Windows>\Win32.dll.vbs
W32/Catcher-B changes settings for Microsoft Internet Explorer by
modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\
Registry entries are created under:
HKCR\VBSFile
Name W32/Silov-B
Type
* Virus
How it spreads
* Infected files
Affected operating systems
* Windows
Side effects
* Modifies data on the computer
* Deletes files off the computer
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Silov-B is an overwriting virus for the Windows platform.
Advanced
W32/Silov-B is an overwriting virus for the Windows platform.
W32/Silov-B searches for files on the infected computer. Those it
finds with an EXE extension it deletes and replaces with a copy of
itself. Those without an EXE extension it also deletes, but copies
itself to <original filename>.EXE.
W32/Silov-B also copies itself to the file <System>\badvir.exe and
sets the following registry entry to run itself on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
good
<System>\badvir.exe
--- MultiMail/Win32 v0.43
* Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)
|