Tillbaka till svenska Fidonet
English   Information   Debug  
COMICS   0/15
CONSPRCY   0/899
COOKING   33158
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/2064
DOS_INTERNET   0/196
duplikat   6002
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33918
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   24145
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12852
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4422
FN_SYSOP   41694
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13600
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16073
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22103
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   928
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4786
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1121
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   3233
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13284
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2056
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4289
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
Möte DIRTY_DOZEN, 201 texter
 lista första sista föregående nästa
Text 146, 1941 rader
Skriven 2006-10-22 23:44:00 av KURT WISMER (1:123/140)
Ärende: News, October 22 2006
=============================
[cut-n-paste from sophos.com]

Name   Troj/Nebuler-K

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.Agent.vg
    * BackDoor-CVT

Prevalence (1-5) 2

Description
Troj/Nebuler-K is a Trojan for the Windows platform.

Advanced
Troj/Nebuler-K is a Trojan for the Windows platform.

Troj/Nebuler-K gathers details relating to dialup services and sends 
collected information to a remote site via HTTP. The Trojan may 
inject code into other processes in an attempt to remain hidden.

When Troj/Nebuler-K is installed the following files are created:

<System>\win<xxx>32.dll

Where <xxx> are random letters.

The following registry entries are created to run code exported by 
win<xxx>32.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\win<xxx>32
DllName
win<xxx>32.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\win<xxx>32
Impersonate
0

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\win<xxx>32
Startup
EvtStartup

Registry entries are created under:

HKCR\MezziaCodec.Chl\CLSID\
HKLM\SOFTWARE\Microsoft\MSSMGR\





Name   W32/Brontok-BY

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Brontok-BY is a worm for the Windows platform.

Advanced
W32/Brontok-BY is a worm for the Windows platform.

When first run W32/Brontok-BY copies itself to:

<Startup>\Empty.pif
<User>\Local Settings\Application Data\windows\csrss.exe
<User>\Local Settings\Application Data\windows\lsass.exe
<User>\Local Settings\Application Data\windows\services.exe
<User>\Local Settings\Application Data\windows\smss.exe
<User>\Local Settings\Application Data\windows\winlogon.exe
\kERe.exe
<Windows>\kERe.exe
<System>\IExplorer.exe
<System>\MrBugs.scr
<System>\shell.exe

and creates the file \Pesan.txt. This file can be safely removed.

The following registry entries are created to run W32/Brontok-BY on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
kERe
<Windows>\kERe.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicesara
<User>\Local Settings\Application Data\WINDOWS\SERVICES.EXE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Logonsara
<User>\Local Settings\Application Data\WINDOWS\CSRSS.EXE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Monitoring
<User>\Local Settings\Application Data\WINDOWS\LSASS.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS
<User>\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

The following registry entries are changed to run W32/Brontok-BY on 
startup:

HKCU\Control Panel\Desktop
SCRNSAVE.EXE
<System>\MRBugs.scr

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "<System>\IExplorer.exe"

(the default value for this registry entry is "Explorer.exe" which 
causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<System>\IExplorer.exe

(the default value for this registry entry is 
"<Windows>\System32\userinit.exe,").

The following registry entries are set or modified, so that shell.exe 
is run when files with extensions of BAT, COM, EXE and PIF are 
opened/launched:

HKCR\lnkfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\batfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\comfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\exefile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\piffile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

The following registry entries are set, disabling the registry editor 
(regedit), the Windows task manager (taskmgr), the command prompt and 
system restore:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
1

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableConfig
1

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableSR
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoViewContextMenu
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp
Disabled
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
LimitSystemRestoreCheckpointing
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
DisableMSI
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
<System>\Shell.exe

HKCR\exefile
(default)
File Folder





Name   W32/Brontok-BY

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Brontok-BY is a worm for the Windows platform.

Advanced
W32/Brontok-BY is a worm for the Windows platform.

When first run W32/Brontok-BY copies itself to:

<Startup>\Empty.pif
<User>\Local Settings\Application Data\windows\csrss.exe
<User>\Local Settings\Application Data\windows\lsass.exe
<User>\Local Settings\Application Data\windows\services.exe
<User>\Local Settings\Application Data\windows\smss.exe
<User>\Local Settings\Application Data\windows\winlogon.exe
\kERe.exe
<Windows>\kERe.exe
<System>\IExplorer.exe
<System>\MrBugs.scr
<System>\shell.exe

and creates the file \Pesan.txt. This file can be safely removed.

The following registry entries are created to run W32/Brontok-BY on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
kERe
<Windows>\kERe.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicesara
<User>\Local Settings\Application Data\WINDOWS\SERVICES.EXE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Logonsara
<User>\Local Settings\Application Data\WINDOWS\CSRSS.EXE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Monitoring
<User>\Local Settings\Application Data\WINDOWS\LSASS.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS
<User>\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

The following registry entries are changed to run W32/Brontok-BY on 
startup:

HKCU\Control Panel\Desktop
SCRNSAVE.EXE
<System>\MRBugs.scr

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "<System>\IExplorer.exe"

(the default value for this registry entry is "Explorer.exe" which 
causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<System>\IExplorer.exe

(the default value for this registry entry is 
"<Windows>\System32\userinit.exe,").

The following registry entries are set or modified, so that shell.exe 
is run when files with extensions of BAT, COM, EXE and PIF are 
opened/launched:

HKCR\lnkfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\batfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\comfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\exefile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\piffile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

The following registry entries are set, disabling the registry editor 
(regedit), the Windows task manager (taskmgr), the command prompt and 
system restore:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
1

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableConfig
1

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableSR
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoViewContextMenu
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp
Disabled
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
LimitSystemRestoreCheckpointing
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
DisableMSI
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
<System>\Shell.exe

HKCR\exefile
(default)
File Folder





Name   Troj/Psyme-DH

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Exploits system or software vulnerabilities

Aliases  
    * Trojan-Downloader.JS.gen
    * VBS/Psyme
    * HTML/Exploit.IESlice
    * EXPL_SSLICE.GEN

Prevalence (1-5) 2

Description
Troj/Psyme-DH is a downloader Trojan for the Windows platform.

Troj/Psyme-DH attempts to download a file to C:\autoexec.exe and 
execute the downloaded file.





Name   W32/Looked-AI

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Viking.an
    * Win32/Viking.AZ
    * PE_LOOKED.GP

Prevalence (1-5) 2

Description
W32/Looked-AI is a virus for the Windows platform.

W32/Looked-AI includes functionality to access the internet and 
communicate with a remote server via HTTP.

W32/Looked-AI also may spread through available network shares

Advanced
W32/Looked-AI is a virus for the Windows platform.

W32/Looked-AI includes functionality to access the internet and 
communicate with a remote server via HTTP.

W32/Looked-AI also may spread through available network shares.

Upon execution W32/Looked-AI creates the following files:

<Windows>\Dll.dll
<Windows>\Logo1_.exe
<Windows>\rundl132.exe

where Logo1_.exe and rundl132.exe are copies of the virus host, and 
Dll.dll is a downloading component of the virus.

These files are also detected as W32/Looked-AI.

The following registry entry is created to run rundl132.exe on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe

Registry entries are created under:

HKLM\SOFTWARE\Soft\DownloadWWW\

The virus infects PE EXE files found on the infected computer.

Many files with the name "_desktop.ini" are created, in various 
folders on the infected computer. These files are harmless text files.





Name   W32/Looked-AJ

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Looked-AJ is a virus for the Windows platform.

Advanced
W32/Looked-AJ is a virus for the Windows platform.

When first run the virus copies itself to <Windows>\rundl132.exe and 
creates a file <Windows>\Dll.dll, detected as W32/Looked-AH. This 
file attempts to download further executable code.

The virus sets the following registry entry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe

The virus infects EXE files found on the infected computer.

Many files with the name "_desktop.ini" are created, in various 
folders on the infected computer. These files are harmless text files.





Name   Troj/Xorpix-X

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Proxy.Win32.Xorpix.ar
    * TROJ_XORPIX.AU

Prevalence (1-5) 2

Description
Troj/Xorpix-X is a proxy Trojan for the Windows platform.

Advanced
Troj/Xorpix-X is a proxy Trojan for the Windows platform.

Troj/Xorpix-X includes functionality to connect to the internet and 
communicate with a remote server using HTTP.

Troj/Xorpix-X allows a remote attacker to route internet traffic 
through the infected computer.

When first run Troj/Xorpix-X creates the file <Documents and 
Settings>\All Users\Documents\Settings\winsys2freg.dll. This file is 
also detected as Troj/Xorpix-X.

The Trojan also creates the following file <Documents and 
Settings>\All Users\Documents\Settings\Desktop.ini.

This file may be safely deleted.

Registry entries are created under the following in order to run code 
exported by winsys2freg.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\winsys2freg\

Troj/Xorpix-X stops and removes the "SharedAccess" and "wscsvc" 
services, affecting system security.





Name   Troj/Redplut-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Redplut-B is a Trojan for the Windows platform.

Advanced
Troj/Redplut-B is a Trojan for the Windows platform.

Troj/Redplut-B copies itself to the following locations:

<System>\servlogon.exe
<System>\smhost.exe

Troj/Redplut-B sets the following registry entries:

HKCU\SOFTWARE\Microsoft\Command Processor
AutoRun
echo off|<System>\servlogon.exe|cls

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RPCall_<ComputerName>
<System>\smhost.exe /register

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemFileProtection
ShowPopups
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RPCall_<ComputerName>
<System>\smhost.exe /register

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run
System handler
<System>\servlogon.exe /register

Troj/Redplut-B may also modify the following registy entries as shown:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Windows
load
<System>\smhost.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe <system>\smhost.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System
<system>\smhost.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<system>\userinit.exe,<System>\servlogon.exe,





Name   Troj/VB-CRJ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.VB.amm
    * Win32/VB.AMM
    * Generic VB.b
    * TROJ_VB.BLD

Prevalence (1-5) 2

Description
Troj/VB-CRJ is a Trojan for the Windows platform.

Advanced
Troj/VB-CRJ is a Trojan for the Windows platform.

When first run Troj/VB-CRJ copies itself to:

<User>\My Documents\dlhost.exe
<Windows>\lodctr32.exe
<System>\note.exe

and creates the file <User>\My Documents\about.html.

The following registry entry is changed to run lodctr32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe lodctr32.exe

(the default value for this registry entry is "Explorer.exe" which 
causes the Microsoft file <Windows>\Explorer.exe to be run on startup).

The following registry entry is set or modified, so that note.exe is 
run when files with extensions of TXT are opened/launched:

HKCR\txtfile\shell\open\command
(default)
<System>\NOTE.EXE %1

The following registry entries are set, disabling the registry editor 
(regedit):

HKCU\Software\Microsoft\Windows\CurrentVersion\
Group Policy Objects\LocalUser\Software\Microsoft\Windows\
CurrentVersion\Policies\System
DisableRegistryTools
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Group Policy Objects\LocalUser\Software\Microsoft\Windows\
CurrentVersion\Policies\System
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer
NoFind
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer
NoRun
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ClassicViewState
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
DisableCAD
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ClassicViewState
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
RegisteredOrganization
.BoRaX.BoRaX.BoRaX.BoRaX.BoRaX.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
RegisteredOwner
.BoRaX.BoRaX.BoRaX.BoRaX.BoRaX.

HKCR\Directory\DefaultIcon
(default)
<Windows>\lodctr32.exe

HKCR\Folder\DefaultIcon
(default)
<Windows>\lodctr32.exe

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\





Name   W32/Looked-AK

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Worm.Win32.Viking.bb
    * W32/HLLP.Philis.bd
    * W32/HLLP.Philis.dll
    * Win32/Viking.BM

Prevalence (1-5) 2

Description
W32/Looked-AK is a worm and prepending virus for the Windows platform.

W32/Looked-AK spreads via file sharing on P2P networks.

Advanced
W32/Looked-AK is a worm and prepending virus for the Windows platform.

W32/Looked-AK spreads via file sharing on P2P networks.

W32/Looked-AK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Looked-AK includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Looked-AK copies itself to \windows\rundl132.exe.

The worm changes the following registry entry in order to be run 
automatically on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
load
<Windows>\rundl132.exe





Name   Troj/Mdrop-BLO

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
Troj/Mdrop-BLO is a Trojan for the Windows platform.

Troj/Mdrop-BLO will appear to be a legitimate winrar installation 
program, which it does install but will also silenty install the 
potentially unwanted application "Ardamax Keylogger".

Advanced
Troj/Mdrop-BLO is a Trojan for the Windows platform.

Troj/Mdrop-BLO will appear to be a legitimate winrar installation 
program, which it does install but will also silenty install the 
potentially unwanted application "Ardamax Keylogger".

When Troj/Mdrop-BLO is installed the following files are created:

<Temp>\wrar361.exe - detected as Troj/Mdrop-BLO
<System>\Sys\Explorer.001
<System>\Sys\Explorer.002
<System>\Sys\Explorer.006
<System>\Sys\Explorer.007
<System>\Sys\Explorer.exe

The files created within the <System>\Sys folder are detected as the 
potentially unwanted application "Ardamax Keylogger".





Name   Troj/Spammit-H

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Forges the sender's email address
    * Uses its own emailing engine
    * Installs itself in the Registry
    * Enables remote access

Aliases  
    * SpamTool.Win32.Delf.m

Prevalence (1-5) 2

Description
Troj/Spammit-H is a Trojan for the Windows platform.

Advanced
Troj/Spammit-H is a Trojan for the Windows platform.

Troj/Spammit-H includes functionality to:

- access the internet and communicate with a remote server via HTTP
- send notification messages to remote locations

When first run Troj/Spammit-H copies itself to:

<Windows>\Media\Call32.exe
<System>\Outlook Express.exe

and creates the following files:

\win.ini
<Windows>\netaps2.txt
<System>\ftpd.dll

The following registry entries are created to run Call32.exe and 
Outlook Express.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Outlook
<System>\Outlook Express.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Call32
<Windows>\MEDIA\Call32.exe





Name   Troj/Clagger-AG

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Downloader-AAP

Prevalence (1-5) 2

Description
Troj/Clagger-AG is a Trojan for the Windows platform.

Troj/Clagger-AG attempts to download further executable code.

The Trojan may arrive as an attachment to spam email messages.

When first run the Trojan displays the following fake error message:

Acrobat 6 - Error "Warning" 20225

Advanced
Troj/Clagger-AG is a Trojan for the Windows platform.

Troj/Clagger-AG attempts to download further executable code.

The Trojan may arrive as an attachment to spam email messages.

When first run the Trojan displays the following fake error message:

Acrobat 6 - Error "Warning" 20225

The Trojan copies itself to <System>\ipf.exe and creates the 
following registry entry in order to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ifp
<System>\ipf.exe

The Trojan drops a file <System>\drivers\winut.dat. This is a 
harmless text file.

The following registry entry is also created:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
windowsshell
1





Name   Troj/Bagle-QQ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Dropped by malware
    * Leaves non-infected files on computer

Aliases  
    * NTRootKit-W
    * Win32/Bagle.GY

Prevalence (1-5) 2

Description
Troj/Bagle-QQ is a Trojan for the Windows platform.

Advanced
Troj/Bagle-QQ is a Trojan for the Windows platform.

Troj/Bagle-QQ is usually dropped by variant of the W32/Bagle worm to 
the following location:

<Current user>\Application Data\hidn\m_hook.sys.

The file m_hook.sys is registered as a new system driver service 
named "m_hook", with a display name of "Empty". Registry entries are 
created under:

HKLM\SYSTEM\CurrentControlSet\Services\m_hook\

Troj/Bagle-QQ is used to stealth a dropper from certain processes.





Name   W32/Stratio-AW

Type  
    * Worm

How it spreads  
    * Email attachments
    * Web downloads

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Stratio-AW is a worm for the Windows platform.

When run the worm will attempt to copy itself to <Windows>\serv.exe 
and download
components from a remote website which it will then run.

Advanced
W32/Stratio-AW is a worm for the Windows platform.

When run the worm will attempt to copy itself to <Windows>\serv.exe 
and download
components from a remote website which it will then run.

W32/Stratio-AW creates the following files:

<Windows>\serrv.wax(Can be removed safely)
<System>\e1.dll
<System>\<random>.exe(Detected as W32/Stratio-AW)

The following registry entry is created to run the worm on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
serrv
<Windows>\serrv.exe s

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
e1.dll

The emails may have the following subject line:

Mail server report.
Server Report
test
Error
hello
picture
Mail Transaction Failed
Status
Mail Delivery System
Good day

The message body may have the following text:

Mail server report.

Our firewall determined the e-mails containing worm copies are being 
sent from your computer.

Nowadays it happens from many computers, because this is a new virus 
type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer 
unnoticeably.
After the penetrating into the computer the virus harvests all the 
e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer 
restoring.

Best regards,
Customers support service

The message contains Unicode characters and has been sent
as a binary attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has 
been sent as a binary attachment.

The attachments may have the following filenames with the extensions 
of .zip, .cmd, .exe, .pif, .bat, .elm, .pdf:

Update-KB<random 4 numbers>-x86
body
data
docs
file
docs
body
message
test
document
test
test
file
readme





Name   Troj/Haxdoor-DI

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Haxspy.ax
    * Win32/Spy.Goldun.HP

Prevalence (1-5) 2

Description
Troj/Haxdoor-DI is a backdoor Trojan for the Windows platform.

Troj/Haxdoor-DI includes functionality to:

- stealth its files, processes and registry entries
- inject its code into other processes

Advanced
Troj/Haxdoor-DI is a backdoor Trojan for the Windows platform.

Troj/Haxdoor-DI includes functionality to:

- stealth its files, processes and registry entries
- inject its code into other processes

When Troj/Haxdoor-DI is installed the following files are created:

<System>\arprmdg0.dll
<System>\arprmdg5.sys
<System>\ksl48.bin

The following registry entries are created to run code exported by 
arprmdg0.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\arprmdg0
DllName
arprmdg0.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\arprmdg0
Startup
arprmdg0

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\arprmdg0
Impersonate
1





Name   W32/Tilebot-HN

Type  
    * Spyware Worm

How it spreads  
    * Network shares
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks
    * Scans network for weak passwords
    * Scans network for open ports

Aliases  
    * Backdoor.Win32.SdBot.aad
    * PAK_Generic.001

Prevalence (1-5) 2

Description
W32/Tilebot-HN is a worm for the Windows platform.

W32/Tilebot-HN spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: LSASS (MS04-011), 
RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007). The worm 
may also spreads via network shares protected by weak passwords.

W32/Tilebot-HN runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-HN includes functionality to:

- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- set or remove network shares
- port scanning
- packet sniffing
- start a remote shell (RLOGIN)
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks

Advanced
W32/Tilebot-HN is a worm for the Windows platform.

W32/Tilebot-HN spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: LSASS (MS04-011), 
RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 (MS04-007). The worm 
may also spreads via network shares protected by weak passwords.

W32/Tilebot-HN runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-HN includes functionality to:

- set up an FTP server
- set up a proxy server
- spread via AOL Instant Messager by sending messages automatically
- set or remove network shares
- port scanning
- packet sniffing
- start a remote shell (RLOGIN)
- access the internet and communicate with a remote server via HTTP
- harvest information from clipboard
- take part in Distributed Denial of Service (DDoS) attacks

When first run W32/Tilebot-HN copies itself to <System>\lsiss.exe.

The file lsiss.exe is registered as a new system driver service named 
"System Restore Services", with a display name of "System Restore 
Services" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\System Restore Services\

W32/Tilebot-HN sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4

Additional registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1

HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1

HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareServer
0

HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
AutoShareWks
0

HKLM\SYSTEM\CurrentControlSet\Control\
WaitToKillServiceTimeout
7000

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





Name   W32/Stratio-AY

Type  
    * Worm

How it spreads  
    * Email attachments
    * Web downloads

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Stratio-AY is a mass-mailing worm for the Windows platform.

When run the worm will attempt to download components from a remote 
website which it will then run.

Advanced
W32/Stratio-AY is a mass-mailing worm for the Windows platform.

When run the worm will attempt to download components from a remote 
website which it will then run.

W32/Stratio-AY creates the following files:

<Windows>\sserrvv.wax(Can be removed safely)
<System>\e1.dll
<Windows>\sserrvv.exe

The following registry entry is created to run the worm on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
sserrvv
<Windows>\sserrvv.exe s

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
e1.dll

The emails may have the following subject line:

Mail server report.
Server Report
test
Error
hello
picture
Mail Transaction Failed
Status
Mail Delivery System
Good day

The message body may have the following text:

Mail server report.

Our firewall determined the e-mails containing worm copies are being 
sent from your computer.

Nowadays it happens from many computers, because this is a new virus 
type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer 
unnoticeably.
After the penetrating into the computer the virus harvests all the 
e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer 
restoring.

Best regards,
Customers support service

The message contains Unicode characters and has been sent
as a binary attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has 
been sent as a binary attachment.

The attachments may have the following filenames with the extensions 
of .zip, .cmd, .exe, .pif, .bat, .elm, .pdf:

Update-KB<random 4 numbers>-x86
body
data
docs
file
docs
body
message
test
document
test
test
file
readme





Name   Troj/BankDl-BK

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Banload.adw

Prevalence (1-5) 2

Description
Troj/BankDl-BK ia an downloader Trojan for the Windows platform.

Troj/BankDl-BK includes functionality to access the internet and 
communicate with a remote server via HTTP.

The downloaded file was detected as Mal/DelpBanc-A.





Name   W32/Tilebot-HO

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Tilebot-HO is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-HO attempts to spread by copying itself to remote network 
shares or by exploiting any of the following vulnerabilities: SRVSVC 
(MS06-040), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), 
ASN.1 (MS04-007).

Advanced
W32/Tilebot-HO is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-HO attempts to spread by copying itself to remote network 
shares or by exploiting any of the following vulnerabilities: SRVSVC 
(MS06-040), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), 
ASN.1 (MS04-007).

When first run W32/Tilebot-HO copies itself to <System>\cpstorage.exe 
and creates the file <Temp>\sysremove.bat.

The file cpstorage.exe is registered as a new system driver service 
named "CryptProtectedService", with a display name of "Cryptic 
Protected Storage" and a startup type of automatic, so that it is 
started automatically during system startup. Registry entries are 
created under:

HKLM\SYSTEM\CurrentControlSet\Services\CryptProtectedService\





Name   W32/Looked-AL

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Viking.ax
    * W32/HLLP.Philis.dll
    * Win32/Viking.BC

Prevalence (1-5) 2

Description
W32/Looked-AL is a worm and prepending virus for the Windows platform.

W32/Looked-AL spreads via file sharing on P2P networks.

W32/Looked-AL runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Looked-AL includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Looked-AL is a worm and prepending virus for the Windows platform.

W32/Looked-AL spreads via file sharing on P2P networks.

W32/Looked-AL runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Looked-AL includes functionality to access the internet and 
communicate with a remote server via HTTP.

When W32/Looked-AL is installed the following files are created:

<Windows>\Logo1_.exe
<Windows>\rundl132.exe

Both of these are detected as W32/Looked-AL.

The worm changes the following registry entry in order to be run 
automatically on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
load
C:\WINDOWS\rundl132.exe





Name   W32/Rbot-FSK

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Enables remote access

Aliases  
    * Backdoor.Win32.EggDrop.v

Prevalence (1-5) 2

Description
W32/Rbot-E is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-E spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012) and 
ASN.1 (MS04-007).

W32/Rbot-E runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

Advanced
W32/Rbot-E is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-E spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: RPC-DCOM (MS04-012) and 
ASN.1 (MS04-007).

W32/Rbot-E runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

When first run W32/Rbot-E copies itself to <Windows>\SystemDebug.exe.

The following registry entries are created to run SystemDebug.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Debugger
SystemDebug.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
System Debugger
SystemDebug.exe

The following registry entry is set:

HKCU\Software\Microsoft\OLE
System Debugger
SystemDebug.exe





Name   W32/Stration-BC

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Email-Worm.Win32.Warezov.do
    * TROJ_STRAT.DR

Prevalence (1-5) 2

Description
W32/Stration-BC is a worm for the Windows platform.

W32/Stration-BC includes functionality to download, install and run 
new software.





Name   W32/Bagle-QR

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * IM-Worm.Win32.Qucan.b

Prevalence (1-5) 2

Description
W32/Bagle-QR is a worm for the Windows platform.

W32/Bagle-QR includes functionality to download, install and run new 
software.

Advanced
W32/Bagle-QR is a worm for the Windows platform.

W32/Bagle-QR includes functionality to download, install and run new 
software.

W32/Bagle-QR changes the Start Page for Microsoft Internet Explorer 
by setting the registry entry:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

The following registry entries are set, disabling the registry editor 
(regedit) and the Windows task manager (taskmgr):

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

The following registry entry is set:

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1

Registry entries are created under:

HKCU\Software\Yahoo\Pager\View\YMSGR_Launchcast\
HKCU\Software\Yahoo\Pager\View\YMSGR_buzz\





Name   Troj/Sufia-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Sufia-A is a Trojan for the Windows platform.

Troj/Sufia-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/Sufia-A is a Trojan for the Windows platform.

Troj/Sufia-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/Sufia-A copies itself to:

<Windows>\csrss.exe
<Windows>\smss.exe
<System>\explorer.exe

The following registry entries are created to run Troj/Sufia-A on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001
ClientServerRuntimeProcess
<Windows>\csrss.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0002
ClientServerRuntimeProcess
<Windows>\smss.exe

 
--- MultiMail/Win32 v0.43
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)