Tillbaka till svenska Fidonet
English   Information   Debug  
COMICS   0/15
CONSPRCY   0/899
COOKING   27611
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/1974
DOS_INTERNET   0/196
duplikat   5999
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33774
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   23439
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12841
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4155
FN_SYSOP   41520
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13562
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16041
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22002
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   894
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4779
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1117
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   2632
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13030
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2055
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4275
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
Möte DIRTY_DOZEN, 201 texter
 lista första sista föregående nästa
Text 160, 628 rader
Skriven 2006-12-31 17:39:00 av KURT WISMER
Ärende: News, December 31 2006
==============================
[cut-n-paste from sophos.com]

Name   W32/Rbot-FZE

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * Backdoor.Win32.Rbot.bng

Prevalence (1-5) 2

Description
W32/Rbot-FZE is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-FZE spreads to other network computers by:
- exploiting common buffer overflow vulnerabilities, including LSASS 
(MS04-011), SRVSVC (MS06-040), RPC-DCOM (MS04-012), PNP (MS05-039), 
ASN.1 (MS04-007) and RealVNC (CVE-2006-2369) and
- networks protected by weak passwords

Advanced
W32/Rbot-FZE is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-FZE spreads to other network computers by:
- exploiting common buffer overflow vulnerabilities, including LSASS 
(MS04-011), SRVSVC (MS06-040), RPC-DCOM (MS04-012), PNP (MS05-039), 
ASN.1 (MS04-007) and RealVNC (CVE-2006-2369) and
- networks protected by weak passwords

W32/Rbot-FZE runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When run W32/Rbot-FZE copies itself to <System>\winlogz2.exe and sets 
the following registry entries to run itself on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Services Layer
<System>\winlogz2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Services Layer
<System>\winlogz2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Services Layer
<System>\winlogz2.exe

W32/Rbot-FZE also sets the following registry entry:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
<System>\winlogz2.exe
<System>\winlogz2.exe:*:Enabled:Windows Services Layer

W32/Rbot-FZE includes functionality to:
- access the internet and communicate with a remote server via HTTP
- setup a SOCKS4 server
- record keystrokes
- perform DDoS attacks
- steal information





Name   Troj/StraDl-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/StraDl-B is a downloader Trojan for the Windows platform.

When run Troj/StraDl-B attempts to download a file from a remote 
website and run it. This file is currently detected as W32/Strati-Gen.





Name   Troj/StraDl-C

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Email-Worm.Win32.Warezov.jj

Prevalence (1-5) 2

Description
Troj/StraDl-C is a downloader Trojan for the Windows platform.

Troj/StraDl-C includes functionality to download, install and run new 
software.





Name   W32/Fujacks-A

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Delf.bd
    * W32/Fujacks

Prevalence (1-5) 2

Description
W32/Fujacks-A is a prepending virus for the Windows platform.

The virus can also spread to network shares and has backdoor 
functionality.

Advanced
W32/Fujacks-A is a prepending virus for the Windows platform.

The virus can also spread to network shares and has backdoor 
functionality.

W32/Fujacks-A runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Fujacks-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Fujacks-A copies itself to 
<System>\drivers\spoclsv.exe.

The following registry entry is created to run spoclsv.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spoclsv.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0





Name   W32/Rbot-FZO

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Scans network for vulnerabilities
    * Scans network for weak passwords
    * Scans network for open ports

Prevalence (1-5) 2

Description
W32/Rbot-FZO is a worm for the Windows platform.

W32/Rbot-FZO runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Rbot-FZO spreads to computers vulnerable to common exploits, 
including:
RPC-DCOM (MS04-012), ASN.1 (MS04-007), and via network shares.

Advanced
W32/Rbot-FZO is a worm for the Windows platform.

W32/Rbot-FZO runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Rbot-FZO spreads to computers vulnerable to common exploits, 
including:
RPC-DCOM (MS04-012), ASN.1 (MS04-007), and via network shares.

When first run W32/Rbot-FZO copies itself to \jamesbond.exe.

The following registry entries are created to run jamesbond.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Casino Royale
<System>\jamesbond.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Casino Royale
<System>\jamesbond.exe

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List
<Windows>\System32\jamesbond.exe
<System>\jamesbond.exe:*:Enabled:Casino Royale

The following registry entry is set:

HKCU\Software\Microsoft\OLE
Casino Royale
<System>\jamesbond.exe





Name   W32/Rbot-FZQ

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Rbot-FZQ is a network worm for the Windows platform.

W32/Rbot-FZQ spreads
- to computers vulnerable to common exploits, including: LSASS 
(MS04-011), SRVSVC (MS06-040), RPC-DCOM (MS04-012), PNP (MS05-039), 
ASN.1 (MS04-007) and RealVNC (CVE-2006-2369)
- to network shares protected by weak passwords

W32/Rbot-FZQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Rbot-FZQ is a network worm for the Windows platform.

W32/Rbot-FZQ spreads
- to computers vulnerable to common exploits, including: LSASS 
(MS04-011), SRVSVC (MS06-040), RPC-DCOM (MS04-012), PNP (MS05-039), 
ASN.1 (MS04-007) and RealVNC (CVE-2006-2369)
- to network shares protected by weak passwords

W32/Rbot-FZQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-FZQ copies itself to <System>\winl0g0.exe.

The following registry entries are created to run winl0g0.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Services Layer
<System>\winl0g0.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Services Layer
<System>\winl0g0.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Services Layer
<System>\winl0g0.exe

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\StandardProfile\AuthorizedApplications\List
<System>\winl0g0.exe
<System>\winl0g0.exe:*:Enabled:Windows Services Layer





Name   Troj/FeebDl-AA

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Downloads code from the internet

Aliases  
    * JS/Feebs.gen.p@MM

Prevalence (1-5) 2

Description
Troj/FeebDl-AA is a downloader Trojan for the Windows platform.

Advanced
Troj/FeebDl-AA is a downloader Trojan for the Windows platform.

Troj/FeebDl-AA attempts to download and execute a number of files 
from remote websites to C:\Recycled\userinit.exe, sometimes also 
copying it to the startup folder. These files are currently detected 
as Mal/Packer.

Troj/FeebDl-AA attempts to set the following registry entry:

HKLM\Active Setup\Installed 
Components\{CD5AC91B-AE7B-E83A-0C4C-E616075972F3}
Stubpath
C:\Recycled\userinit.exe

Troj/FeebDl-AA attempts to terminate a number of services related to 
security and anti-virus applications.

Troj/FeebDl-AA has been seen sent in spam containing a "pump and 
dump" stock GIF image and random message text.





Name   W32/Dref-U

Type  
    * Virus

How it spreads  
    * Email attachments
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Dref-U is a virus with mass-mailing capability for the Windows 
platform.

W32/Dref-U spreads to other network computers and via email.

W32/Dref-U includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Dref-U is a virus with mass-mailing capability for the Windows 
platform.

W32/Dref-U spreads to other network computers and via email.

W32/Dref-U includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Dref-U copies itself to <System>\ppl.exe and 
creates the following registy keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
agent
<System>\ppl.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
agent
<System>\ppl.exe

W32/Dref-U sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).

W32/Dref-U may also attempt to drop a randomly named file into the 
current folder and run it. This file is detected by Sophos as 
Troj/Dloadr-ANE.

Files infected by W32/Dref-U are detected by Sophos as W32/Dref-L.





Name   W32/Agobot-AHT

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * W32/Sdbot.worm.gen.t

Prevalence (1-5) 2

Description
W32/Agobot-AHT is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Agobot-AHT runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Agobot-AHT is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Agobot-AHT runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Agobot-AHT copies itself to <System>\wcsntfy.exe.

The following registry entries are created to run wcsntfy.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft
wcsntfy.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft
wcsntfy.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft
wcsntfy.exe





Name   W32/Dref-V

Type  
    * Virus

How it spreads  
    * Email messages
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Tibs.jy
    * Win32/Nuwar.M

Prevalence (1-5) 2

Description
W32/Dref-V is a virus for the Windows platform.

W32/Dref-V spreads to other network computers and via email.

W32/Dref-V includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Dref-V is a virus with mass-mailing capability for the Windows 
platform. Files infected by W32/Dref-V are detected by Sophos as 
W32/Dref-L.

W32/Dref-V spreads to other network computers and via email.

W32/Dref-V sends emails with a subject line of "Happy New Year!" and 
an attachment named postcard.exe.

W32/Dref-V includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Dref-V copies itself to <System>\alsys.exe and 
creates the following registy keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Agent
<System>\alsys.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Agent
<System>\alsys.exe

W32/Dref-V sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).

W32/Dref-V may also attempt to drop a randomly named file into the 
current folder and run it. This file is detected by Sophos as 
W32/Dref-V.





Name   Troj/Agent-DYG

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Agent-DYG is a Trojan for the Windows platform.

Advanced
Troj/Agent-DYG is a Trojan for the Windows platform.

When first run Troj/Agent-DYG copies itself to <System>\logmen.exe.

The following registry entry is created to run logmen.exe on startup:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed 
Components\(32E79AE2-96C6-7A4B-0407-050408030200)
StubPath
<System>\logmen.exe

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 www.docsplace.tzo.com (1:123/140)