Text 16, 1285 rader
Skriven 2004-12-19 18:58:00 av KURT WISMER (1:123/140)
Ärende: News, Dec. 19 2004
==========================
[cut-n-paste from sophos.com]

Name   W32/Oddbob-A

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Oddbob-A is a network worm for the Windows platform.

W32/Oddbob-A spreads by exploiting the LSASS vulnerability (MS04-011).

Advanced
W32/Oddbob-A is a network worm for the Windows platform.

W32/Oddbob-A spreads by exploiting the LSASS vulnerability (MS04-011).

W32/Oddbob-A copies itself to the Windows system folder using a
randomly generated filename.

On NT based versions of Windows W32/Oddbob-A registers itself as a
service process named NetDDEipx with the displayname NetDDEipx also
and a start type of Automatic so that the service is started
automatically each time a new Windows session is started.

For more details of the LSASS vulnerability, see
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx





Name   W32/Rbot-RW

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Rbot-RW is a network worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-RW spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using
backdoors opened by other worms or Trojans.

Advanced
W32/Rbot-RW is a network worm and IRC backdoor Trojan for the Windows 
platform.

The worm copies itself to a file named servicsmjr.exe in the Windows 
system folder and creates the following registry entries in order to run 
each time a user logs on:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
k3ym4n
"servicsmjr.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
k3ym4n
"servicsmjr.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
k3ym4n
"servicsmjr.exe"

W32/Rbot-RW spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using
backdoors opened by other worms or Trojans.

W32/Rbot-RW can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-RW can be instructed by a remote user 
to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)

Patches for the operating system vulnerabilities exploited by 
W32/Rbot-RW can be obtained from Microsoft at:

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx





Name   W32/Wort-D

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Wort-D is a network worm that attempts to spread to remote computers 
by exploiting the LSASS vulnerability (MS04-011).

W32/Wort-D generates random IP addresses to exploit.

Advanced
W32/Wort-D is a network worm that attempts to spread to remote computers 
by exploiting the LSASS vulnerability (MS04-011).

W32/Wort-D creates the following registry entry to run itself 
automatically at system startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
WinLsass =
<path to file>

See Microsoft TechNet article (MS04-011) for more information about the 
LSASS exploit.





Name   W32/Forbot-EQ

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security

Aliases  
    * WORM_WOOTBOT.EQ

Prevalence (1-5) 2

Description
W32/Forbot-EQ is a nIRC backdoor Trojan and network worm for the Windows 
platform.

Once installed, W32/Forbot-EQ connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands.

The worm can spread to unpatched machines affected by the LSASS 
vulnerability (see MS04-011) and through backdoors left open by the 
Troj/Optix Trojans.


Advanced
W32/Forbot-EQ is a IRC backdoor Trojan and network worm for the Windows 
platform.

In order to run automatically when Windows starts up the worm moves 
itself to the Windows system folder as mpsvc.exe and creates the 
following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
MP Services
"mpsvc.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
MP Services
"mpsvc.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
MP Services
"mpsvc.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
MP Services
"mpsvc.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
MP Services
"mpsvc.exe"

W32/Forbot-EQ also creates its own service named "MP Services" with the 
display name "MP Services".

Once installed, W32/Forbot-EQ connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands. These 
commands can cause the infected machine to perform any of the following 
actions:

flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files

The worm can spread to unpatched machines affected by the LSASS 
vulnerability (see MS04-011) and through backdoors left open by the 
Troj/Optix Trojans.





Name   W32/Forbot-DA

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Prevalence (1-5) 2

Description
W32/Forbot-DA is a worm which attempts to spread to remote network 
shares and computers vulnerable to common exploits. W32/Forbot-DA also 
contains backdoor functionality, allowing unauthorised remote access to 
the infected computer via the IRC network, while running in the 
background as a service process.

W32/Forbot-DA connects to a preconfigured IRC channel and awaits 
commands from a remote intruder. These include commands to:

steal information
delete network shares
reduce system security
start a proxy server
participate in DDoS attacks
exploit vulnerabilities
steal registration keys for computer games
harvest email addresses from the Windows address book and Instant 
 Messenger configuration files

Advanced
W32/Forbot-DA is a worm which attempts to spread to remote network 
shares and computers vulnerable to common exploits.

W32/Forbot-DA copies itself to the Windows system folder and creates the 
following registry entries to run itself automatically on log-on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HP Deskjet 500
HP_DeskJet_500.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
HP Deskjet 500
HP_DeskJet_500.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
HP Deskjet 500
HP_DeskJet_500.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
HP Deskjet 500
HP_DeskJet_500.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
HP Deskjet 500
HP_DeskJet_500.exe

On NT based versions of Windows HP_DeskJet_500.exe is run as a new 
service named Level.Kicks-Ass.Org with a display name of "HP Deskjet 
500"

New registry entries are created under

HKLM\SYSTEM\CurrentControlSet\Services\Level.Kicks-Ass.Org\





Name   W32/Forbot-BI

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * WORM_WOOTBOT.AQ

Prevalence (1-5) 2

Description
W32/Forbot-BI is an IRC backdoor Trojan and network worm for the Windows 
platform.

Advanced
W32/Forbot-BI is an IRC backdoor Trojan and network worm for the Windows 
platform.

In order to run automatically when Windows starts up the worm moves 
itself to the Windows system folder as systemproc.exe and creates the 
following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoftkeysd = "systemproc.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoftkeysd = "systemproc.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoftkeysd = "systemproc.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoftkeysd = "systemproc.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Microsoftkeysd = "systemproc.exe"

W32/Forbot-BI also creates its own service named "MicrosoftCorporations", 
with the display name "Microsoftkeysd".

Once installed, W32/Forbot-BI connects to a preconfigured IRC server and 
joins a channel from which an attacker can issue further commands. These 
commands can cause the infected machine to perform any of the following 
actions:

flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files

The worm can spread to unpatched machines affected by the LSASS 
vulnerability (see MS04-011) and through backdoors left open by the 
Troj/Optix family of Trojans.





Name   W32/Rbot-RR

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Rbot.gen
    * W32/Sdbot.worm.gen.j
    * WORM_RBOT.ADJ

Prevalence (1-5) 2

Description
W32/Rbot-RR is a worm which attempts to spread to remote network shares. 
It also contains backdoor Trojan functionality, allowing unauthorised 
remote access to the infected computer via IRC channels while running in 
the background as a service process.

W32/Rbot-RR spreads to network shares with weak passwords as a result of 
the backdoor Trojan element receiving the appropriate command from a 
remote user. W32/Rbot-RR will also attempt to spread via vulnerabilites.

Advanced
W32/Rbot-RR is a worm which attempts to spread to remote network shares. 
It also contains backdoor Trojan functionality, allowing unauthorised 
remote access to the infected computer via IRC channels while running in 
the background as a service process.

W32/Rbot-RR spreads to network shares with weak passwords as a result of 
the backdoor Trojan element receiving the appropriate command from a 
remote user. W32/Rbot-RR will also attempt to spread via vulnerabilites.

W32/Rbot-RR copies itself to the Windows system folder as 
iexplorerupdt.exe and may create entries in the registry at the 
following locations to run itself on windows startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Start Upping
iexplorerupdt.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Start Upping
iexplorerupdt.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Start Upping
iexplorerupdt.exe

W32/Rbot-RR may also set the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





Name   W32/Atak-I

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Atak.i
    * Worm.Mydoom.Gen-unp

Prevalence (1-5) 2

Description
W32/Atak-I is a mass-mailing worm.

Advanced
W32/Atak-I is a mass-mailing worm.

W32/Atak-I arrives in an email with one of the following subject lines:

Merry X-Mas!
Happy New Year!

The subject line may be differently capitalised.

The message text contains the one of the following lines:

Happy New year and wish you good luck on next year!
Mery Chrismas & Happy New Year! 2005 will be the beginning!

The worm is included in the email as an attachment. This attachment may 
be the worm executable itself or a ZIP file containing the executable. 
The executable name is chosen so that both the main name and the 
extension belong to the following list:

PIF, COM, SCR, BAT

If the file attached is a ZIP file, this is given one of the above names 
with a ZIP extension.

W32/Atak-I harvests email addresses from files on the system drive and 
on drives C: to Z: which have file extension LOG, HTML, MSG, EML, MHT, 
DBX, ASP, PHP, JSP, HTM or TXT.

When first run, W32/Atak-I copies itself to the Windows system folder as 
dec25.exe and adds the following line to the win.ini file to ensure it 
is run at system startup:

run = %SYSTEM%\dec25.exe

The worm also creates the following registry entry in order to run 
itself on system startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run
%SYSTEM%\dec25.exe





Name   W32/Protoride-Z

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Used in DOS attacks

Aliases  
    * Worm.Win32.Protoride.gen

Prevalence (1-5) 2

Description
W32/Protoride-Z is a network worm with backdoor functionality.

W32/Protoride-Z targets remote network shares allowing, at the same 
time, remote access to the infected computer via IRC channels.

Advanced
W32/Protoride-Z is a Windows worm that spreads via network shares. The 
worm also has a backdoor component that allows unauthorised remote 
access to the computer via IRC channels.

W32/Protoride-Z attempts to copy itself to the Windows system folder 
with the filename rdpty6.7.6.exe, and then set the following registry 
entry so as to run itself before all EXE files:

HKCR\exefile\shell\open\command

W32/Protoride-Z attempts to copy itself to msupdate.exe in the startup 
folder of shared network computers.

W32/Protoride-Z may also set the following registry entry:

HKLM\Software\BeyonD inDustries\ProtoType[v6.7.6.]

W32/Protoride-Z remains resident, running in the background as a service 
process and listening for commands from remote users via IRC channels.





Name   W32/Agobot-DAA

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes

Prevalence (1-5) 2

Description
W32/Agobot-DAA is an IRC backdoor and network worm.

W32/Agobot-DAA is capable of spreading to computers on the local network 
protected by weak passwords.

The Trojan runs continuously in the background providing backdoor access 
to the computer.

Advanced
W32/Agobot-DAA is an IRC backdoor and network worm.

W32/Agobot-DAA is capable of spreading to computers on the local network 
protected by weak passwords.

When first run, W32/Agobot-DAA copies itself to the Windows system 
folder as winhlpp32.exe and creates registry entries under the following 
to run itself each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\

The Trojan runs continuously in the background providing backdoor access 
to the computer.

W32/Agobot-DAA attempts to terminate and disable various anti-virus and 
security related programs and modifies the HOSTS file located at 
<Windows system folder>\Drivers\etc\HOSTS, mapping certain anti-virus 
websites to the loopback address 127.0.0.1 in an attempt to prevent 
access to these sites. Typically the following mappings will be appended 
to the HOSTS file:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com

W32/Agobot-DAA will also hide all files with names that contain the 
string 'soun'.





Name   W32/Sdbot-SG

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Used in DOS attacks

Aliases  
    * Backdoor.Win32.SdBot.gen
    * W32/Sdbot.worm.gen.t

Prevalence (1-5) 2

Description
W32/Sdbot-SG is a worm with backdoor Trojan functionality.

W32/Sdbot-SG is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

Advanced
W32/Sdbot-SG is a worm with backdoor Trojan functionality.

W32/Sdbot-SG is capable of spreading to computers on the local network 
protected by weak passwords after receiving the appropriate backdoor 
command.

When first run, W32/Sdbot-SG copies itself to the Windows system folder 
as DQDDSS.EXE and runs this copy of the worm. In order to run each time 
a user logs on, W32/Sdbot-SG will set the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ffeqfqs
dqddss.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
ffeqfqs
dqddss.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ffeqfqs
dqddss.exe

The worm runs continuously in the background providing backdoor access 
to the infected computer.





Name   W32/Zafi-D

Type  
    * Worm

How it spreads  
    * Email attachments
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Zafi.d
    * W32/Zafi.d@MM

Prevalence (1-5) 5!

Description
W32/Zafi-D is a mass mailing worm and peer-to-peer worm.

W32/Zafi-D copies itself to the Windows system folder with the filename 
Norton Update.exe.

W32/Zafi-D creates a number of files in the Windows system folder with 
filenames consisting of 8 random characters and a DLL extension. Some of 
these are exact or zipped copies of the worm, detected as W32/Zafi-D, 
while others are log files created by the worm.

W32/Zafi-D harvests email addresses from the Windows Address Book and 
from files found on the hard drive.

W32/Zafi-D copies itself to folders with names containing share, upload, 
or music as ICQ 2005a new!.exe or winamp 5.7 new!.exe.

W32/Zafi-D displays an fake error message box with the caption "CRC: 
04F6Bh" and the text "Error in packed file!".


A typical message sent by the W32/Zafi-D worm

Advanced
W32/Zafi-D is a mass mailing and peer-to-peer worm.

W32/Zafi-D copies itself to the Windows system folder with the filename 
Norton Update.exe and creates the following entry in the registry so as 
to run itself when a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Wxp4

W32/Zafi-D creates a number of files in the Windows system folder with 
filenames consisting of 8 random characters and a DLL extension. Some of 
these are exact or zipped copies of the worm, detected as W32/Zafi-D, 
while others are log files created by the worm.

W32/Zafi-D attempts to terminate processes related to files found in 
folders that have names containing the following strings:

syman, viru, trend, secur, panda, cafee, sopho, kasper

W32/Zafi-D attempts to open files containing the following strings and 
keep them open so as to make them inaccessible to the user:

reged, msconfig, task

W32/Zafi-D copies itself to folders containing one of the following 
strings:

share, upload, music

W32/Zafi-D copies itself to these folders with one of the following 
filenames:

ICQ 2005a new!.exe
winamp 5.7 new!.exe

W32/Zafi-D harvests email addresses from the Windows Address Book and 
from files it finds with the extensions HTM, WAB, TXT, DBX, TBB, ASP, 
PHP, SHT, ADB, MBX, EML, PMR, FPT or INB.

W32/Zafi-D may copy the file from which it is harvesting addresses to 
C:\S.CM.

W32/Zafi-D does not harvest addresses that contain the following words:

yaho, google, win, use, info, help, admi, webm, micro, msn, hotm, 
suppor, syman, viru, trend, secur, panda, cafee, sopho, kasper

W32/Zafi-D does not harvest addresses that contain 16 or more digits.

W32/Zafi-D may generate random addresses using harvested domain names.

W32/Zafi-D produces emails with the following characteristics depending 
on the nationality of the recipient, which it gathers from the 
region-specific top-level domain (e.g. .uk, .de, .fr, .nl etc.)


A typical message sent by the W32/Zafi-D worm

From line: This is either a name gathered from the host email setup or 
one of the following:

Pamela M.
T. Antonio
J. Martin
V. Dusan
R. Cornel
H. Irene
S. Ewa
C. Lina
M. Virtanen
M. Emma
J. Andersson
V. Jensen
V. Tatyana
N. Fernandez
T. Maria

Subject line: This can start either "Re:", "Fw:" or with nothing, 
continuing with one of the following:

Merry Christmas!
Buon Natale!
Joyeux Noel!
Christmas pohlednice
Prettige Kerstdagen!
Weihnachen card.
Christmas - Kertki!
Christmas - Atviruka!
Christmas postikorti!
Christmas Postkort!
Christmas Vykort!
Christmas Kort!
ecard.ru
Feliz Navidad!
boldog karacsony...

Message body: This is in plain text and html format. Both consist either 
of two words or spaces, followed by a smiley and the sender name from 
the subject line. In the html the words or spaces are separated by 
"...." strings and an lewd animated GIF file of two smileys and the line 
starts and ends in asterisks. The html text ends in a string containing 
a domain name followed by the text "Picture Size: 11 KB, Mail +OK".
The words used in the text are from the following, or using non-Roman 
characters:

Happy Hollydays!
Buon Natale!
Joyeux Noel!
Prettige Kerstdagen!
Frohliche Wiehnachten!
Wesolych Swiat!
Naujieji Metai!
Iloista Joulua!
God Jul!
Glaedelig Jul!
Feliz Navidad
Kellemes Unnepeket!

Attached filename: This starts "link." or nothing, followed by one name 
from the following list:

postcard.
cartoline.
ecarte.
phlednice.
kerstdagen.
weihnachten.
kartki.
atviruka.
postikorti.
postkort.
vykort.
ekort.
card.
navidad.
karacsony.

This is then followed by "christmas." or nothing, then by "index." or 
nothing.

The attachment then has one of the following fake extensions followed by 
4 random digits:

.php
.htm
.jpg
.gif

The attachment has one of the following actual extensions:

.cmd
.bat
.pif
.com
.zip

If the attachment is a ZIP file then the worm inside it has a filename 
of one of the following:

postcard.
wishcard.
xmascard.
giftcard.

This is followed by either "id" or "php", four random digits and one of 
the following extensions:

.cmd
.bat
.pif
.com

For example, the attached file may be a zip file named 
atviruka.christmas.index.jpg6245.zip containing a copy of the virus 
named wishcard.id8302.cmd

W32/Zafi-D creates entries in the registry, some related to file it 
drops and some related to system information. The entries are all at 
HKLM\Software\Microsoft\Wxp4\ with some of the following values:

t1, t2, t3, t4, t5, t6, t7, t8, t9, tA, tB, tC, tD, tE, tZ, rB, rC,
mA, mB, mC, ... , mX, mY, mZ
lA, lB, lC, ... , lX, lY, lZ

W32/Zafi-D displays an fake error message box with the caption "CRC: 
04F6Bh" and the text "Error in packed file!".





Name   W32/Atak-G

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Forges the sender's email address
    * Uses its own emailing engine
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Atak-G is a Windows worm that spreads via email. W32/Atak-G copies 
itself to a file with a random name in the Windows system folder.

W32/Atak-G sends itself to all email addresses found on the computer.

The worm arrives as a ZIP attachment in an email. The subject line, 
message text and attachment filenames are randomly constructed from the 
building blocks listed in the Advanced Description.

Advanced
W32/Atak-G is a Windows worm that spreads via email. W32/Atak-G copies 
itself to a file with a random name in the Windows system folder.

On W9x systems W32/Atak-G inserts a 'load=' entry under the [windows] 
class of the WIN.INI file pointing to the worm so as to auto-start on 
user logon.

On NT, W2k and XP systems, the worm creates the following registry entry 
to autorun on windows logon:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Path to worm>

W32/Atak-G sends itself to all email addresses found on the system. The 
worm harvests addresses from files with various extensions such as HTM, 
EML, ASP or DBX.

The worms email will have the following characteristics:

Attachment name: chosen from

separate_file.zip
textfile.zip
print.zip
note.zip
white_paper.zip
part001.zip

Subject Lines:

<random1> Love <random2> <smiley>

where the random parts are selected from the following lists.

<random1>:

Stay
True
Get
Make
Have a

<random2>:

human spirit
Not Wars
and get money
for fun
will freedom
to other
with me
Not spam

<smiley >:
:D
;)
:>
;-D
- ;-*
!!
!?!
:K

An example is 'Have a Love to other :>'.

The message starts with a greeting of the form
<random1> <random2>,'

with <random1> selected from:

Dear
Congratulation
Welcome
Greet
Hi
Hello
Nice to meet you

and <random2> one of:

Ladies & Gentleman
Sir/Madam
Person
Customer
User

An example is 'Welcome User,'.

After the greeting appears one of the following lines:

We have installed our anti-spam tools to protect your email
Your account info has been setting up to block spam email
We have make a few change for our customer. Please be informed
We have upgraded your account features
Your account has been upgraded with our new services

followed by another randomly assembled line of the format
<random1> website at http://www.<domain> to <random2>

with <random1> choosen from:

Please check our
Visit our
Goto our
Logon to

and <randome2> selected from:

know about account features
learn about our features
get more info
find out our services.

The domainname is either harvested from the system or randomly 
constructed.

The next part of the email message is one of the following lines:

Remember this note
Please take note this info
Keep this info
Your account info

followed by

---> Email: <email>
---> Password: <password> <text>

<email> is a randomly constructed email address for the domainname that 
was choosen previously. The password is a random string. <text> is 
choosen randomly from the following:


    * [please change it after registeration]

    * (You can change it later)

    * (temp. pwd only)

    * (temporary password).


The next line in the email has the format
<random1> website to <random2> http://www.<domain> .

with <random1> one of:

Please check our
Visit our
Goto our
Logon to

and <random2> selected from:

know about account features
learn about our features
get more info
find out our services.

The last line has the format
<random1>ormation <random2>.
with <random1> one of:

Saved
Email account
Your credential
Your account
NOTE: All your account

and <random2> choosen from:

has been saved. Please check when needed
can be found at your email attachment
has been clipped to your email
already included into your email
has been attached as a file and ready to be printed.

The email ends with a greeting of the form
<random1>, <domain> <random2>

with <random1> selected from:
By
Thank you
Your sincerely
Regard

and <random2> one of:

Help Team
Technical Support
Customer Services
Administrator
Services Team
Team.

An example for an email is:
Welcome Sir/Madam,

We have installed our anti-spam tools to protect your email.
Please check our website at http://www.microsoft.com to know about 
account features.

Your account info:

---> Email: inet@microsoft.com
---> Password: 2aff (temporary password)

Please check our website to learn about our features
http://www.microsoft.com .

Your account information has been saved. Please check when needed.

Your sincerely,
microsoft.com Team





Name   W32/Sdbot-SB

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Dropped by malware

Prevalence (1-5) 2

Description
W32/Sdbot-SB is a member of the W32/Sdbot family of worms with a 
backdoor component.

Advanced
W32/Sdbot-SB is a member of the W32/Sdbot family of worms with a 
backdoor component.

In order to run automatically when Windows starts up the worm copies 
itself to the file winprotect.exe in the Windows system folderand adds 
the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\winprotect
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\winprotect

W32/Sdbot-SB is dropped by Troj/Wurmark-B.

 
--- MultiMail/Win32 v0.43
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)