Text 89, 1785 rader
Skriven 2005-12-04 11:28:00 av KURT WISMER (1:123/140)
Ärende: News, December 4 2005
=============================
[cut-n-paste from sophos.com]
Name W32/Mytob-FY
Type
* Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
* Uses its own emailing engine
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Mytob-FY is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC)
network.
W32/Mytob-FY runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
Emails sent by W32/Mytob-FY sends emails in the following format,
with details filled in to make the email look more
authentic:
Subject line chosen from:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text chosen from (the worm will insert the username and the
email domain of the addressee into the email):
'Dear user <UserName>,
You have successfully updated the password of your <domain> account.
If you did not authorize this change or if you need assistance with
your account, please contact <domain> customer
service at: <sender@domain>
Thank you for using <domain>!
The Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear user <UserName>,
It has come to our attention that your <domain> User Profile ( x )
records are out of date. For further details see
the attached document.
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
We have temporarily suspended your email account <UserEmailAddress>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our
processors.
See the details to reactivate your <domain> account.
Sincerely,The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could
please take 5-10 minutes out of your online experience and confirm
the attached document so you will not run into any
future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <domain> Support Team
+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>'
The attached file consists of a base name followed by the extension
ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The
base filenames are randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
<random characters>
The zip file will contain the worm with double extension. The first
extension will be one of DOC, HTM, TXT followed by
spaces and the second extension is EXE, SCR or PIF.
W32/Mytob-FY harvests email addresses from files on the infected
computer and from the Windows address book.
Advanced
W32/Mytob-FY is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC)
network.
W32/Mytob-FY runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
When first run W32/Mytob-FY copies itself to <System>\expI0rer.exe.
The following registry entries are created to run expI0rer.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDOWS SYSTEM
expI0rer.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SYSTEM
expI0rer.exe
W32/Mytob-FY sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Emails sent by W32/Mytob-FY sends emails in the following format,
with details filled in to make the email look more
authentic:
Subject line chosen from:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text chosen from (the worm will insert the username and the
email domain of the addressee into the email):
'Dear user <UserName>,
You have successfully updated the password of your <domain> account.
If you did not authorize this change or if you need assistance with
your account, please contact <domain> customer
service at: <sender@domain>
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear user <UserName>,
It has come to our attention that your <domain> User Profile ( x )
records are out of date. For further details see
the attached document.
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
We have temporarily suspended your email account .
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our
processors.
See the details to reactivate your <domain> account.
Sincerely,The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could
please take 5-10 minutes out of your online experience and confirm
the attached document so you will not run into any
future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <domain> Support Team
+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>'
The attached file consists of a base name followed by the extension
ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The
base filenames are randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
<random characters>
The zip file will contain the worm with double extension. The first
extension will be one of DOC, HTM, TXT followed by
spaces and the second extension is EXE, SCR or PIF.
W32/Mytob-FY harvests email addresses from files on the infected
computer and from the Windows address book.
Name W32/Francette-Y
Type
* Spyware Worm
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Delf.abc
Prevalence (1-5) 2
Description
W32/Francette-Y is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Francette-Y spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including
RPC-DCOM (MS04-012).
W32/Francette-Y runs continuously in the background, providing a
backdoor server which allows a remote intruder to
gain access and control over the computer via IRC channels.
W32/Francette-Y includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Francette-Y is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Francette-Y spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including
RPC-DCOM (MS04-012).
W32/Francette-Y runs continuously in the background, providing a
backdoor server which allows a remote intruder to
gain access and control over the computer via IRC channels.
W32/Francette-Y includes functionality to access the internet and
communicate with a remote server via HTTP.
W32/Francette-Y sets the following registry entry to run itself
automatically on log-on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Microsoft IIS
<path to the worm file>
W32/Francette-Y attempts to log details from banking applications
related to the following sites:
www.halifax-online.co.uk
ibank.barclays.co.uk
online.lloydstsb.co.uk
online-business.lloydstsb.co.uk
www.ukpersonal.hsbc.co.uk
banesnet.banesto.es
extranet.banesto.es
ebanking.bccbrescia.it
www.bankofscotlandhalifax-online.co.uk
oi.cajamadrid.es
bancae.caixapenedes.com
banking.postbank.de
meine.deutsche-bank.de
myonlineaccounts2.abbeynational.co.uk
ibank.cahoot.com
webbank.openplan.co.uk
bancopostaonline.poste.it
mybank.bybank.it
ibank.internatio
W32/Francette-Y modifies an infected computer's Hosts to redirect
access to the above sites to a pre-specified IP
address.
Name W32/Sdranck-V
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Drops more malware
Aliases
* Trojan.Dropper
Prevalence (1-5) 2
Description
W32/Sdranck-V is a multi-component network worm.
Advanced
W32/Sdranck-V is a multi-component network worm.
W32/Sdranck-V drops the following files:
<Windows system folder>\msstill.exe - detected as Troj/Ranck-Fam
<Windows system folder>\rapking.exe - detected as W32/Sdbot-Fam
<Windows system folder>\richword.exe - detected as W32/Sdbot-Fam
The files rapking.exe and richword.exe spread W32/Sdranck-V to
network shares with weak passwords and via network
security exploits.
Name W32/Mytob-FZ
Type
* Worm
How it spreads
* Email attachments
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Forges the sender's email address
* Uses its own emailing engine
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Net-Worm.Win32.Mytob.cu
* WORM_MYTOB.NB
Prevalence (1-5) 2
Description
W32/Mytob-FZ is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC)
network.
W32/Mytob-FZ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
W32/Mytob-FZ spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS
(MS04-011) and ASN.1 (MS04-007).
W32/Mytob-FZ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
Emails sent by W32/Mytob-FZ sends emails in the following format,
with details filled in to make the email look more
authentic:
Subject line chosen from:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text chosen from (the worm will insert the username and the
email domain of the addressee into the email):
'Dear user <UserName>,
You have successfully updated the password of your <domain> account.
If you did not authorize this change or if you need assistance with
your account, please contact <domain> customer
service at: <sender@domain>
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear user <UserName>,
It has come to our attention that your <domain> User Profile ( x )
records are out of date. For further details see
the attached document.
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
We have temporarily suspended your email account <UserEmailAddress>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our
processors.
See the details to reactivate your <domain> account.
Sincerely,The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could
please take 5-10 minutes out of your online experience and confirm
the attached document so you will not run into any
future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <domain> Support Team
+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>'
The attached file consists of a base name followed by the extension
ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The
base filenames are randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
<random characters>
The zip file will contain the worm with double extension. The first
extension will be one of DOC, HTM, TXT followed by
spaces and the second extension is EXE, SCR or PIF.
W32/Mytob-FZ harvests email addresses from files on the infected
computer and from the Windows address book.
Advanced
W32/Mytob-FZ is a mass-mailing worm and backdoor Trojan that can be
controlled through the Internet Relay Chat (IRC)
network.
W32/Mytob-FZ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
W32/Mytob-FZ spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS
(MS04-011) and ASN.1 (MS04-007).
W32/Mytob-FZ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
When first run W32/Mytob-FZ copies itself to <System>\msconfgh.exe.
The following registry entries are created to run msconfgh.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32 Cnfg32
msconfgh.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32 Cnfg32
msconfgh.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Win32 Cnfg32
msconfgh.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Win32 Cnfg32
msconfgh.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win32 Cnfg32
msconfgh.exe
The file msconfgh.exe is registered as a new file system driver
service named "Win32 Cnfg32", with a display name of
"Win32 Cnfg32". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Win32 Cnfg32\
Emails sent by W32/Mytob-FZ sends emails in the following format,
with details filled in to make the email look more
authentic:
Subject line chosen from:
Your password has been updated
Your password has been successfully updated
You have successfully updated your password
Your new account password is approved
Your Account is Suspended
*DETECTED* Online User Violation
Your Account is Suspended For Security Reasons
Warning Message: Your services near to be closed.
Important Notification
Members Support
Security measures
Email Account Suspension
Notice of account limitation
<random characters>
Message text chosen from (the worm will insert the username and the
email domain of the addressee into the email):
'Dear user <UserName>,
You have successfully updated the password of your <domain> account.
If you did not authorize this change or if you need assistance with
your account, please contact <domain> customer
service at: <sender@domain>
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear user <UserName>,
It has come to our attention that your <domain> User Profile ( x )
records are out of date. For further details see
the attached document.
Thank you for using <domain>!
The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
We have temporarily suspended your email account <UserEmailAddress>.
This might be due to either of the following reasons:
1. A recent change in your personal information (i.e. change of
address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of
subscription due to an internal error within our
processors.
See the details to reactivate your <domain> account.
Sincerely,The <domain> Support Team
+++ Attachment: No Virus (Clean)
+++ <domain> Antivirus - www.<domain>'
'Dear <domain> Member,
Your e-mail account was used to send a huge amount of unsolicited
spam messages during the recent week. If you could
please take 5-10 minutes out of your online experience and confirm
the attached document so you will not run into any
future problems with the online service.
If you choose to ignore our request, you leave us no choice but to
cancel your membership.
Virtually yours,
The <domain> Support Team
+++ Attachment: No Virus found
+++ <domain> Antivirus - www.<domain>'
The attached file consists of a base name followed by the extension
ZIP. The worm may optionally create double
extensions where the first extension is DOC, TXT or HTM and the final
extension is BAT, CMD, PIF, SCR, EXE or ZIP. The
base filenames are randomly chosen from:
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
<random characters>
The zip file will contain the worm with double extension. The first
extension will be one of DOC, HTM, TXT followed by
spaces and the second extension is EXE, SCR or PIF.
W32/Mytob-FZ harvests email addresses from files on the infected
computer and from the Windows address book.
Name Troj/Iefeat-AR
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Agent.bc
* AdClicker-AJ.gen
Prevalence (1-5) 2
Description
Troj/Iefeat-AR is a downloader and browser hijacking Trojan.
Troj/Iefeat-AR will attempt to download and run files from a remote
site.
Troj/Iefeat-AR may drop a file, detected as Troj/Dloader-AQ.
Troj/Iefeat-AR changes settings for Internet Explorer and intercepts
attempts to view the home and search pages,
instead showing a file dropped by the Trojan.
Advanced
Troj/Iefeat-AR is a downloader and browser hijacking Trojan.
Troj/Iefeat-AR will attempt to download and run files from a remote
site.
Troj/Iefeat-AR may drop a file, detected as Troj/Dloader-AQ.
Troj/Iefeat-AR changes settings for Internet Explorer and intercepts
attempts to view the home and search pages,
instead showing a file dropped by the Trojan.
Troj/Iefeat-AR will make the following registry changes:
HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
about:blank
HKCU\Software\Microsoft\Internet Explorer\Main
Search Page
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
HKCU\Software\Microsoft\Internet Explorer\Main
Search Bar
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
HKCU\Software\Microsoft\Internet Explorer\Main
Use Search Asst
no
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Start Page
about:blank
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Search Page
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Search Bar
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search
SearchAssistant
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Use Search Asst
no
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Default_Page_URL
about:blank
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Default_Search_URL
res://<SYSTEM>\<Trojan DLL name>/sp.html#<numbers>
In order to run automatically each time Internet Explorer runs,
Troj/Iefeat-AR will install itself as a Browser Help
Object. The following registry branches will be created:
HKCR\CLSID\<Random CLSID>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\<Random CLSID>
HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\<Random CLSID>
In particular, the following registry entry will be created:
HKCR\<Random CLSID>\InProcServer32
(default)
<path to Trojan DLL>
Troj/Iefeat-AR may also attempt to disable a number of applications
by deleting files and registry entries.
Name Troj/Rasdoor-D
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Rasdoor-D is a backdoor Trojan for the Windows platform.
Advanced
Troj/Rasdoor-D is a backdoor Trojan for the Windows platform.
When first run Troj/Rasdoor-D copies itself to <Temp>\dc.exe and
creates the file <Temp>\backdoor.log.
Name Troj/Bagle-AS
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Reduces system security
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Bagle.ev
Prevalence (1-5) 2
Description
Troj/Bagle-AS is a backdoor Trojan.
When the Trojan executes it will start a backdoor and send connection
information to a number of websites.
Advanced
Troj/Bagle-AS is a backdoor Trojan.
When the Trojan executes it will start a backdoor on a random port in
the range
2000 to 50000. The Trojan tries to send connection information to a
number of
websites.
It copies itself to the Windows system folder as wintems.exe. The
Trojan also
sets creates the following registry entry so that it is started on
user logon:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
german.exe
<System>\wintems.exe
The following registry entries are also created
HKCU\Software\DateTime4\uid
HKCU\Software\DateTime4\port
HKCU\Software\DateTime4\wdrn
Name W32/Ritdoor-D
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Ritdoor-D is a worm and backdoor Trojan for the Windows platform.
W32/Ritdoor-D spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), ASN.1 (MS04-007), and PNP
(MS05-039)
- by copying itself to network shares
W32/Ritdoor-D runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer.
W32/Ritdoor-D may modify an infected computer's Hosts file to deny
access to
security-related websites, as well as terminate security processes,
and setting
itself as an authorized application for the Windows Firewall.
W32/Ritdoor-D includes functionality to download, install and run new
software,
and may download a file detected by Sophos as Troj/Surila-H.
Advanced
W32/Ritdoor-D is a worm and backdoor Trojan for the Windows platform.
W32/Ritdoor-D spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), ASN.1 (MS04-007), and PNP
(MS05-039)
- by copying itself to network shares
W32/Ritdoor-D runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer.
W32/Ritdoor-D may modify an infected computer's Hosts file to deny
access to
security-related websites, as well as terminate security processes,
and setting
itself as an authorized application for the Windows Firewall.
W32/Ritdoor-D includes functionality to download, install and run new
software,
and may download a file detected by Sophos as Troj/Surila-H.
When first run W32/Ritdoor-D copies itself to:
<Windows>\msdef.exe
<Windows>\services.exe
and creates the file <Windows>\mstempf.exe.
The following registry entry is created to run W32/Ritdoor-D on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
RPCser32g
<Windows>\services.exe
W32/Ritdoor-D sets the following registry entries, disabling the
automatic
startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer
IEPgfsgdc
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
DisableRegistryTools
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
DisableRegistryTools
0
Name Troj/Krepper-S
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.CWS.gen
Prevalence (1-5) 2
Description
Troj/Krepper-S is a Trojan for the Windows platform.
Troj/Krepper-S includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
Troj/Krepper-S is a Trojan for the Windows platform.
Troj/Krepper-S includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run Troj/Krepper-S copies itself to
<Windows>\inet20066\services.exe.
The following registry entries are created to run Troj/Krepper-S on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run
<Windows>\inet20066\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20066\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20066\services.exe
The following registry entry is set:
HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
yes
Name W32/Ritdoor-F
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Packed.Win32.CryptExe
Prevalence (1-5) 2
Description
W32/Ritdoor-F is a worm and backdoor Trojan for the Windows platform.
W32/Ritdoor-F spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including:
LSASS (MS04-011), PNP (MS05-039) and ASN.1 (MS04-007).
W32/Ritdoor-F runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer.
W32/Ritdoor-F includes functionality to download, install and run new
software.
Advanced
W32/Ritdoor-F is a worm and backdoor Trojan for the Windows platform.
W32/Ritdoor-F spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including:
LSASS (MS04-011), PNP (MS05-039) and ASN.1 (MS04-007).
W32/Ritdoor-F runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer.
W32/Ritdoor-F includes functionality to download, install and run new
software.
W32/Ritdoor-F attempts to disable various security related
applications.
When first run W32/Ritdoor-F copies itself to:
<Windows>\msdef.exe
<Windows>\services.exe
and creates the file <Windows>\mstempf.exe.
The following registry entry is created to run W32/Ritdoor-F on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
RPCser32g
<Windows>\services.exe
W32/Ritdoor-F sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer
IEPgfsgdc
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
DisableRegistryTools
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
DisableRegistryTools
0
W32/Ritdoor-F attempts to disable the following processes:
Lien Van de Kelderrr.exe
winshost.exe
msnmsgr.exe
wfdmgr.exe
IAOIN.EXE
RB.EXE
backdoor.rbot.gen.exe
backdoor.rbot.gen_(17).exe
msssss.exe
rasmngr.exe
dailin.exe
wowpos32.exe
wuamgrd.exe
taskmanagr.exe
wuamga.exe
ATUPDATER.EXE
AVWUPD32.EXE
AVPUPD.EXE
LUALL.EXE
DRWEBUPW.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
UPDATE.EXE
NUPGRADE.EXE
ATUPDATER.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVXQUAR.EXE
CFIAUDIT.EXE
MCUPDATE.EXE
NUPGRADE.EXE
Systra.exe
RAVMOND.exe
GfxAcc.exe
VisualGuard.exe
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINPPR32.EXE
WINRECON.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
WINTSK32.EXE
WINUPDATE.EXE
WKUFIND.EXE
WNAD.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE
_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
HIJACKTHIS.EXE
F-AGOBOT.EXE
W32/Ritdoor-F also attempts to disable processes with names matching
the following strings:
NETSKY
navapsvc
NProtectService
Norton Antivirus Server
VexiraAntivirus
dvpinit
dvpapi
schscnt
BackWeb Client - 7681197
F-Secure Gatekeeper Handler Starter
KAVMonitorService
Norman NJeeves
NVCScheduler
nvcoas
Norman ZANDA
PASSRV
SweepNet
SWEEPSRV.SYS
NOD32ControlCenter
NOD32Service
PCCPFW
Tmntsrv
AvxIni
ravmon8
SmcService
BlackICE
PersFW
McAfee Firewall
NWService
NISSERV
W32/Ritdoor-F creates a new version of the HOSTS file which maps the
URLs of selected websites to a loopback IP
address or to its own IP addresses, in order to prevent access to
certain sites and to control/hijack browsing. The
new HOSTS file will typically contain the following:
127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 oxyd.fr
127.0.0.1 pandasoftware.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 t35.com
127.0.0.1 t35.net
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 virustotal.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.oxyd.fr
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.t35.com
127.0.0.1 www.t35.net
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.virustotal.com
Name Troj/Surila-I
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Drops more malware
* Reduces system security
* Installs itself in the Registry
Aliases
* BackDoor-CEB
Prevalence (1-5) 2
Description
Troj/Surila-I is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Troj/Surila-I includes functionality to access the internet and
communicate with a remote server via HTTP. It can act
as a proxy, allowing a remote intruder to route internet traffic
through the affected computer.
Troj/Surila-I attempts to disable various security related
applications.
Advanced
Troj/Surila-I is a backdoor Trojan which allows a remote intruder to
gain access and control over the computer.
Troj/Surila-I includes functionality to access the internet and
communicate with a remote server via HTTP. It can act
as a proxy, allowing a remote intruder to route internet traffic
through the affected computer.
When first run Troj/Surila-I copies itself to:
<Windows folder>\csrss.exe
<Windows folder>\msupdate.exe
and creates the following files:
<Windows folder>\dodrrr.exe
<Windows folder>\win32fxlpconf.ini
The file dodrrr.exe is detected as Troj/Surila-D.
Troj/Surila-I modifies the system file sfc_os.dll or sfc.dll in an
attempt to disable the Windows System File Checker.
The Trojan may do this in order to modify further system files.
The following registry entries are created to run msupdate.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
msupdate
<Windows folder>\msupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msupdate
<Windows folder>\msupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
msupdate
<Windows folder>\msupdate.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer
mtxqwnm
vPRRTXN
HKCU\Software\Microsoft\Internet Explorer
veer
40047
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
DisableRegistryTools
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
DisableRegistryTools
0
HKLM\SOFTWARE\Microsoft\Ole
WINRUN
msupdate.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINRUN
msupdate.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d
Troj/Surila-I attempts to terminate any of the following processes:
amon.exe
armor2net.exe
atguard.exe
botzor.exe
ccapp.exe
csm.exe
firewall.exe
firewall_anti.exe
FirewallSvr.exe
kpf4gui.exewintbp.exe
kpf4ss.exe
llsrv.exe
mousebm.exe
MpfService.exe
mrt.exe
NPROTECT.EXE
outpost.exe
pnpsrv.exe
service32.exe
svnlitup32.exe
system32.exe
tpfw.exe
upnp.exe
windll2.exe
winpnp.exe
winshost.exe
wintbpx.exe
wintbpx.exe
ZAPRO.EXE
zapro.exe
ZONEALARM.EXE
zonealarm.exe
Troj/Surila-I creates a new version of the HOSTS file which maps the
URLs of selected websites to a loopback IP
address or the computer's own IP address, in order to prevent access
to certain sites and to control/hijack browsing.
The following websites will typically be listed:
avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
downloads-eu1.kaspersky-labs.com
downloads-us1.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads4.kaspersky-labs.com
f-secure.com
kaspersky-labs.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
microsoft.com
my-etrust.com
nai.com
networkassociates.com
oxyd.fr
pandasoftware.com
rads.mcafee.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
t35.com
t35.net
trendmicro.com
update.symantec.com
updates.symantec.com
us.mcafee.com
viruslist.com
virustotal.com
www.avp.com
www.ca.com
www.f-secure.com
www.grisoft.com
www.kaspersky.com
www.mcafee.com
www.microsoft.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.oxyd.fr
www.pandasoftware.com
www.sophos.com
www.symantec.com
www.t35.com
www.t35.net
www.trendmicro.com
www.viruslist.com
www.virustotal.com
Name W32/Rbot-BAF
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Rbot.gen
* W32/Sdbot.worm.gen.g
* W32.Spybot.Worm
* WORM_RBOT.CRO
Prevalence (1-5) 2
Description
W32/Rbot-BAF is a worm with backdoor functionality for the Windows
platform.
W32/Rbot-BAF spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812) and ASN.1
(MS04-007)
- to other network computers running MSSQL servers protected by weak
passwords
- by copying itself to network shares protected by weak passwords
W32/Rbot-BAF runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
W32/Rbot-BAF attempts to terminate certain processes related to
anti-virus and security programs.
W32/Rbot-BAF attempts to modify the HOSTS file, preventing access to
certain websites.
Advanced
W32/Rbot-BAF is a worm with backdoor functionality for the Windows
platform.
W32/Rbot-BAF spreads:
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812) and ASN.1
(MS04-007)
- to other network computers running MSSQL servers protected by weak
passwords
- by copying itself to network shares protected by weak passwords
W32/Rbot-BAF runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain
access and control over the computer via IRC channels.
When first run W32/Rbot-BAF copies itself to <Windows system
folder>\winscure.exe.
The following registry entries are created to run winscure.exe on
startup, and are reset every 4 seconds:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Security
winscure.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Security
winscure.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Security
winscure.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows Security
winscure.exe
Registry entries are set as follows, and reset every 4 seconds:
HKLM\SOFTWARE\Microsoft\OLE
Windows Security
winscure.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Windows Security
winscure.exe
HKCU\Software\Microsoft\OLE
Windows Security
winscure.exe
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Windows Security
winscure.exe
W32/Rbot-BAF attempts to terminate certain processes related to
anti-virus and security programs.
W32/Rbot-BAF attempts to modify the HOSTS file by appending the
following lines, preventing access to the websites
specified:
127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 kaspersky.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 pandasoftware.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 virustotal.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.virustotal.com
Name Troj/Zlob-O
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Zlob.bl
Prevalence (1-5) 2
Description
Troj/Zlob-O is a downloader Trojan.
Troj/Zlob-O will contact predefined remote sites and download data.
The Trojan may then download further executable files and run them.
Advanced
Troj/Zlob-O is a downloader Trojan.
Troj/Zlob-O will contact predefined remote sites and download data.
The Trojan may then download further executable files and run them.
In order to run automatically each time Explorer initializes,
Troj/Zlob-O will set the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
wininet.dll
mscornet.exe
Troj/Zlob-O will drop a component to the Windows system folder as
ld<random>.tmp. This file is also detected as Troj/Zlob-O
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|