Text 81, 1444 rader
Skriven 2005-10-15 13:49:00 av KURT WISMER (1:123/140)
Ärende: News, October 15 2005
=============================
[cut-n-paste from sophos.com]

Name   W32/Forbot-CI

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes

Aliases  
    * WORM_WOOTBOT.CJ

Prevalence (1-5) 2

Description
W32/Forbot-CI is an IRC backdoor Trojan and network worm for the 
Windows platform.

Advanced
W32/Forbot-CI is an IRC backdoor Trojan and network worm for the 
Windows platform.

In order to run automatically when Windows starts up the worm moves 
itself to the Windows system folder as svshost.exe and creates the 
following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows Update = svshost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoft Windows Update = svshost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Windows Update = svshost.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Windows Update = svshost.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoft Windows Update = svshost.exe

W32/Forbot-CI also creates its own service named "Microsoft Update", 
with the display name "Microsoft Windows Update".

Once installed, W32/Forbot-CI connects to a preconfigured IRC server 
and joins a channel from which an attacker can issue further commands. 
These commands can cause the infected machine to perform any of the 
following actions:

flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files

The worm can spread to unpatched machines affected by the LSASS 
vulnerability (see MS04-011) and through backdoors left open by the 
Troj/Optix Trojans.





Name   W32/Alasrou-A

Type  
    * Spyware Worm

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Net-Worm.Win32.Small.d
    * W32/Alasrou

Prevalence (1-5) 2

Description
W32/Alasrou-A is an email address harvesting worm for the Windows 
platform.

W32/Alasrou-A spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including LSASS (MS04-011).

W32/Alasrou-A includes functionality to download, install and run new 
software.

Advanced
W32/Alasrou-A is an email address harvesting worm for the Windows 
platform.

W32/Alasrou-A spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including LSASS (MS04-011).

W32/Alasrou-A includes functionality to download, install and run new 
software.

When W32/Alasrou-A is installed the following files are created:

<Temp>\file1.exe
<System>\searchpage.htm

File1.exe is downloaded from a remote server, and searchpage.htm is 
set as the default search page for Internet Explorer.

W32/Alasrou-A also searches for the file thebat.abd, and files with 
the following extensions, harvesting email addresses:

.tbb
.dbx
.nk2
.wab

The collected emails are then uploaded to a remote FTP server.

The following registry entry is created to run W32/Alasrou-A on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Instance 001
<pathname of the worm executable>

W32/Alasrou-A changes settings for Microsoft Internet Explorer, 
including the Start Page and Search Page, by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Security\
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page





Name   W32/Mytob-DW

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine

Aliases  
    * Net-Worm.Win32.Mytob.t
    * W32.Mytob.AH@mm
    * WORM_MYTOB.HO

Prevalence (1-5) 2

Description
W32/Mytob-DW is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Mytob-DW spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including LSASS (MS04-011), and by 
sending itself as an email attachment to address harvested from the 
infected computer.

Emails sent by the worm have the following characteristics:

Possible Subject lines:

Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
body
message
test
data
file
text
readme
document

Possible Message texts:

Mail transaction failed. Partial message is available.

The message contains Unicode characters and has been sent as a binary 
attachment.

The message cannot be represented in 7-bit ASCII encoding and has 
been sent as a binary attachment.

The original message was included as an attachment.

Here are your banks documents.

<random characters>

W32/Mytob-DW runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Mytob-DW is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Mytob-DW spreads to other network computers by exploiting common 
buffer overflow vulnerabilites, including LSASS (MS04-011), and by 
sending itself as an email attachment to address harvested from the 
infected computer.

Emails sent by the worm have the following characteristics:

Possible Subject lines:

Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
body
message
test
data
file
text
readme
document

Possible Message texts:

Mail transaction failed. Partial message is available.

The message contains Unicode characters and has been sent as a binary 
attachment.

The message cannot be represented in 7-bit ASCII encoding and has 
been sent as a binary attachment.

The original message was included as an attachment.

Here are your banks documents.

<random characters>

W32/Mytob-DW runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Mytob-DW copies itself to:

\funny_pic.scr
\my_photo2005.scr
\see_this!!.scr
<System>\taskgmr.exe

and creates the file \hellmsn.exe.

The file hellmsn.exe is detected as W32/Mytob-D.

The following registry entries are created to run taskgmr.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINTASK
taskgmr.exe

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe

HKCU\Software\Microsoft\OLE
WINTASK
taskgmr.exe

HKLM\SOFTWARE\Microsoft\Ole
WINTASK
taskgmr.exe





Name   W32/Lebreat-A

Type  
    * Worm

How it spreads  
    * Email attachments
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Reduces system security

Aliases  
    * Net-Worm.Win32.Lebreat.gen

Prevalence (1-5) 2

Description
W32/Lebreat-A is a worm with a backdoor component for the Windows 
platform.

W32/Lebreat-A spreads by exploiting the LSASS vulnerablity.

W32/Lebreat-A will send itself to email addresses harvested from the 
infected computer. These emails will have the following properties:

Subject:

**WARNING** Your Account Currently Disabled.
Email
Error
Hello
Importnat Information
info
Mail Delivery System
Message could not be delivered
Password

Message text:

Your credit card was charged for $500 USD. For additional information 
see the attachment.

Binary message is available.

The message contains Unicode characters and has been sent as a binary 
attachment.

Here are your banks documents

The original message was included as an attachment.

We have temporarily suspended your email account checkout the 
attachment for more info.

You have successfully updated the password of your domain account 
checkout the attachment for more info.

Important Notification checkout the attachment for more info.

Your Account Suspended checkout the document.

Your password has been updated checkout the document.

checkout the attachment.

Hello,
I was in a hurry and I forgot to attach an important
document. Please see attached.

Advanced
W32/Lebreat-A is a worm with a backdoor component for the Windows 
platform.

W32/Lebreat-A spreads by exploiting the LSASS vulnerablity.

W32/Lebreat-A will send itself to email addresses harvested from the 
infected computer. These emails will have the following properties:

Subject:

**WARNING** Your Account Currently Disabled.
Email
Error
Hello
Importnat Information
info
Mail Delivery System
Message could not be delivered
Password

Message text:

Your credit card was charged for $500 USD. For additional information 
see the attachment.

Binary message is available.

The message contains Unicode characters and has been sent as a binary 
attachment.

Here are your banks documents

The original message was included as an attachment.

We have temporarily suspended your email account checkout the 
attachment for more info.

You have successfully updated the password of your domain account 
checkout the attachment for more info.

Important Notification checkout the attachment for more info.

Your Account Suspended checkout the document.

Your password has been updated checkout the document.

checkout the attachment.

Hello,
I was in a hurry and I forgot to attach an important
document. Please see attached.

The attachment will have one of the following names:

about.cpl
about.doc<several spaces>.bat
about.scr
account-report.exe
admin.bat
archive.cpl
archive.exe
box.bat
box.scr
data.bat
data.scr
doc.pif
docs.cpl
docs.scr
document.cpl
document.exe
file.cpl
help.doc<several spaces>.exe
inbox.cpl
inbox.exe
order.cpl
order.exe
payment.doc<several spaces>.scr
read.cpl
read.exe
readme.cpl
readme.scr

The email will appear to come from a combination of one of these 
usernames:

adam
admin
alerts
alex
brenda
brent
david
fred
helen
jack
jane
jerry
john
josh
linda
mary
matt
michael
mike
paul
robert
root
sales
steve
support

and these domains:

antivirus.com
aol.com
arcor.com
ca.com
gmail.com
google.com
hotmail.com
matrix.com
mcafee.com
microsoft.com
msn.com
nai.com
support.com
symantec.com
trendmicro.com
yahoo.com

W32/Lebreat-A will avoid sending to email addresses containing the 
following strings:

icrosof
.gov
panda
f-secur
icrosoft
winrar
winzip
@mcafee
@trendmicro
@noreply
@sopho
@norman
@virusli
@norton
@fsecure
@panda
@avp
@microsoft
@symantec

W32/Lebreat-A will also open a ftp backdoor on port 8885 and attempt 
to perform a Distributed Denial of Service attack on www.symantec.com.

W32/Lebreat-A will copy itself to the Windows system folder as 
ccapp.exe and attach.tmp and create the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Symantec
<Windows system folder>\ccapp.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Symantec
<Windows system folder>\ccapp.exe

W32/Lebreat-A will also create or modify the following registry 
entries:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
DisableSR
1

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
DisableSR
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
1

HKCU\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
1

HKCU\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
1

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate
1

HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate
1

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
AUOptions
1

HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
AUOptions
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKCU\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKCU\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKCU\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

W32/Lebreat-A may create a file named xzy6.tmp in the Windows folder 
which is a list of the collected email addresses. This file can be 
safely removed and is harmless.

W32/Lebreat-A will attempt to download and execute the file 
update3.exe from a predefined URL.

Microsoft provides a patch for the LSASS vulnerablity at the 
following URL:

MS04-011





Name   W32/Rbot-ARH

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Rbot.afg

Prevalence (1-5) 2

Description
W32/Rbot-ARH is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ARH runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Rbot-ARH is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ARH runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-ARH copies itself to <System>\mswi32.pif.

The following registry entries are created to run mswi32.pif on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Wind Security
mswi32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Wind Security
mswi32.pif

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Wind Security
mswi32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Wind Security
mswi32.pif

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Wind Security
mswi32.pif

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Wind Security
mswi32.pif

HKCU\Software\Microsoft\OLE
Wind Security
mswi32.pif

HKLM\SOFTWARE\Microsoft\Ole
Wind Security
mswi32.pif





Name   W32/Rbot-ARI

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Rbot.aff

Prevalence (1-5) 2

Description
W32/Rbot-ARI is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ARI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Rbot-ARI is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-ARI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-ARI copies itself to <System>\up32.pif.

The following registry entries are created to run up32.pif on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Up Service
up32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Up Service
up32.pif

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Up Service
up32.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Up Service
up32.pif

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Up Service
up32.pif

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Up Service
up32.pif

HKCU\Software\Microsoft\OLE
Up Service
up32.pif

HKLM\SOFTWARE\Microsoft\Ole
Up Service
up32.pif





Name   W32/Sdbot-ADY

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.IRCBot.hg

Prevalence (1-5) 2

Description
W32/Sdbot-ADY is a network worm and IRC backdoor Trojan for the 
Windows platform.

W32/Sdbot-ADY runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-ADY includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Sdbot-ADY is a network worm and IRC backdoor Trojan for the 
Windows platform.

W32/Sdbot-ADY runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Sdbot-ADY includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Sdbot-ADY copies itself to <Windows>\smsc.exe.

The file smsc.exe is registered as a new system driver service named 
"SMSC", with a display name of "System Manager Service" and a startup 
type of automatic, so that it is started automatically during system 
startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\SMSC\

W32/Sdbot-ADY sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Istbar-BT

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.IstBar.is
    * TROJ_ISTBAR.EP

Prevalence (1-5) 2

Description
Troj/Istbar-BT is a downloader Trojan for the Windows platform.

Troj/Istbar-BT includes functionality to download, install and run new
software.

When Troj/Istbar-BT is installed it creates the non-malicious text 
file <Temp>\jfghjfgudk.exe which can be deleted.





Name   W32/Mytob-EX

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer

Aliases  
    * Net-Worm.Win32.Mytob.dc

Prevalence (1-5) 2

Description
W32/Mytob-EX is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-EX runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Mytob-EX can spread by sending itself as an email attachment to 
email addresses harvested from the infected computer.

Emails sent by the worm have characteristics from the following:

Subject lines:

Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation

or random characters

Message text - one of the following:

The worm will insert the username and the email domain of the 
adresssee into the email.

Dear user <UserName>,

You have successfully updated the password of your <domain> account.

If you did not authorize this change or if you need assistance with 
your account, please contact <domain> customer service at: 
<sender@domain>
Thank you for using <domain>!
The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear user <UserName>,

It has come to our attention that your <domain> User Profile ( x ) 
records are out of date. For further details see the attached document.
Thank you for using <domain>!
The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear <domain> Member,

We have temporarily suspended your email account <UserEmailAddress>.

This might be due to either of the following reasons:

1. A recent change in your personal information (i.e. change of 
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of 
subscription due to an internal error within our processors.
See the details to reactivate your <domain> account.

Sincerely,The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear <domain> Member,

Your e-mail account was used to send a huge amount of unsolicited 
spam messages during the recent week. If you could please take 5-10 
minutes out of your online experience and confirm the attached 
document so you will not run into any future problems with the online 
service.
If you choose to ignore our request, you leave us no choice but to 
cancel your membership.

Virtually yours,
The <domain> Support Team

+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>

Attachment name:

updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report

or random characters

The zip file will contain the worm with double extension. The first 
extension will be one of doc, htm, txt followed by spaces and the 
second extension is exe, scr or pif.

Advanced
W32/Mytob-EX is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-EX runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Mytob-EX copies itself to <System>\picx.exe.

The following registry entries are created to run picx.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PIC SYSTEM
picx.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
PIC SYSTEM
picx.exe

W32/Mytob-EX sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

W32/Mytob-EX can spread by sending itself as an email attachment to 
email addresses harvested from the infected computer.

Emails sent by the worm have characteristics from the following:

Subject lines:

Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation

or random characters

Message text - one of the following:

The worm will insert the username and the email domain of the 
adresssee into the email.

Dear user <UserName>,

You have successfully updated the password of your <domain> account.

If you did not authorize this change or if you need assistance with 
your account, please contact <domain> customer service at: 
<sender@domain>
Thank you for using <domain>!
The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear user <UserName>,

It has come to our attention that your <domain> User Profile ( x ) 
records are out of date. For further details see the attached document.
Thank you for using <domain>!
The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear <domain> Member,

We have temporarily suspended your email account <UserEmailAddress>.

This might be due to either of the following reasons:

1. A recent change in your personal information (i.e. change of 
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of 
subscription due to an internal error within our processors.
See the details to reactivate your <domain> account.

Sincerely,The <domain> Support Team

+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>

Dear <domain> Member,

Your e-mail account was used to send a huge amount of unsolicited 
spam messages during the recent week. If you could please take 5-10 
minutes out of your online experience and confirm the attached 
document so you will not run into any future problems with the online 
service.
If you choose to ignore our request, you leave us no choice but to 
cancel your membership.

Virtually yours,
The <domain> Support Team

+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>

Attachment name:

updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report

or random characters

The zip file will contain the worm with double extension. The first 
extension will be one of doc, htm, txt followed by spaces and the 
second extension is exe, scr or pif.

W32/Mytob-EX attempts to terminate a large number of processes 
related to security and anti-virus programs.

W32/Mytob-EX also modifies the Windows hosts file in order to block 
access to the following websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 pandasoftware.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.microsoft.com
127.0.0.1 microsoft.com
127.0.0.1 www.virustotal.com
127.0.0.1 virustotal.com
127.0.0.1 www.amazon.com
127.0.0.1 www.amazon.co.uk
127.0.0.1 www.amazon.ca
127.0.0.1 www.amazon.fr
127.0.0.1 www.paypal.com
127.0.0.1 paypal.com
127.0.0.1 moneybookers.com
127.0.0.1 www.moneybookers.com
127.0.0.1 www.ebay.com
127.0.0.1 ebay.com





Name   W32/Agobot-TU

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Agobot.gen
    * W32/Gaobot.worm.gen.d
    * W32.HLLW.Gaobot.gen
    * WORM_AGOBOT.AMK

Prevalence (1-5) 2

Description
W32/Agobot-TU is a worm and IRC backdoor for the Windows platform.

W32/Agobot-TU spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including RPC-DCOM (MS04-012) and by 
copying itself to network shares protected by weak passwords.

W32/Agobot-TU runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Agobot-TU is a worm and IRC backdoor for the Windows platform.

W32/Agobot-TU spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including RPC-DCOM (MS04-012) and by 
copying itself to network shares protected by weak passwords.

W32/Agobot-TU runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Agobot-TU copies itself to 
<Windows system folder>\winjava.exe.

The following registry entries are created to run winjava.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NeroUpdater6.8
winjava.exe





Name   W32/Rbot-ARX

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Deletes files off the computer
    * Downloads code from the internet
    * Records keystrokes
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Rbot-ARX is a network worm with backdoor Trojan functionality for 
the Windows platform.

W32/Rbot-ARX spreads using a variety of techniques including 
exploiting weak passwords on computers and SQL servers, exploiting 
operating system vulnerabilities (including DCOM-RPC and LSASS) and 
using backdoors opened by other worms or Trojans.

W32/Rbot-ARX can be controlled by a remote attacker over IRC channels.

Advanced
W32/Rbot-ARX is a network worm with backdoor Trojan functionality for 
the Windows platform.

The worm copies itself to a file named wurmgrd32.exe in the Windows 
system folder and may create the following registry entries:

HKCU\Software\Microsoft\OLE
Microsoft ConfgKeys
"wurmgrd32.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft ConfgKeys
"wurmgrd32.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft ConfgKeys
"wurmgrd32.exe"

HKLM\SOFTWARE\Microsoft\OLE
Microsoft ConfgKeys
"wurmgrd32.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft ConfgKeys
"wurmgrd32.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft ConfgKeys
"wurmgrd32.exe"

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Microsoft ConfgKeys
"wurmgrd32.exe"

W32/Rbot-ARX spreads using a variety of techniques including 
exploiting weak passwords on computers and SQL servers, exploiting 
operating system vulnerabilities (including DCOM-RPC and LSASS) and 
using backdoors opened by other worms or Trojans.

W32/Rbot-ARX can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-ARX can be instructed by a 
remote user to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

The following patches for the operating system vulnerabilities 
exploited by W32/Rbot-ARX can be obtained from the Microsoft website:

MS04-011
MS04-012

 
--- MultiMail/Win32 v0.43
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)