Text 164, 1513 rader
Skriven 2007-01-28 22:08:00 av KURT WISMER
Ärende: News, January 28 2007
=============================
[cut-n-paste from sophos.com]

Name   W32/Dref-X

Type  
    * Virus

How it spreads  
    * Email attachments
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine
    * Leaves non-infected files on computer

Aliases  
    * Trojan.Peacomm

Prevalence (1-5) 3

Description
W32/Dref-X is a mass-mailing virus for the Windows platform.

Advanced
W32/Dref-X is a mass-mailing virus for the Windows platform.

W32/Dref-X spreads to other network computers and via email.

When first run W32/Dref-X copies itself to <System>\alsys.exe and 
creates the following files:

<current folder>\e2McBB3.exe - detected as W32/Dref-X
<System>\wincom32.ini - can be removed
<System>\wincom32.sys - can be removed

W32/Dref-X also includes functionality to infect files. The infected 
files are detected as W32/Dref-L.





Name   Troj/Clagger-AS

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 3

Description
Troj/Clagger-AS is a Trojan for the Windows platform.

Troj/Clagger-AS includes functionality to download and execute code 
from the internet.

Advanced
Troj/Clagger-AS is a Trojan for the Windows platform.

Troj/Clagger-AS includes functionality to download and execute code 
from the internet.

When first run Troj/Clagger-AS copies itself to the following location:

<system>\iptb.exe

The following registry entry is created to ensure that iptb.exe is 
run on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iptb
iptb.exe





Name   Troj/Dloadr-ASI

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 3

Description
Troj/Dloadr-ASI is a Trojan for the Windows platform.

The Trojan includes functionality to download, install and run new 
software.





Name   Troj/DwnLdr-FZI

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 3

Description
Troj/DwnLdr-FZI is a worm for the Windows platform.

Troj/DwnLdr-FZI includes functionality to download, install and run 
new software.

When Troj/DwnLdr-FZI is installed it creates the file <Windows>\1.exe.





Name   Troj/DwnLdr-FYG

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * TROJ_DLOADER.AH

Prevalence (1-5) 2

Description
Troj/DwnLdr-FYG is a downloader Trojan for the Windows platform.





Name   W32/SillyFDC-M

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/SillyFDC-M is a worm for the Windows platform.

Advanced
W32/SillyFDC-M is a worm for the Windows platform.

W32/SillyFDC-M also creates the following files on the infected 
computer;

<Windows>\cmd.com
<Windows>\svchost.com
<System>\driver.exe
<Windows>\wuaucll.exe

W32/SillyFDC-M attempts to periodically copy itself to removeable 
drives, including floppy drives and USB keys. The worm will attempt 
to create a hidden file Autorun.inf on the removeable drive and copy 
itself to the same location as the filename music.exe

The file Autorun.inf is designed to start the worm once the 
removeable drive is connected to a uninfected computer.

The following registry entry is changed to run wuaucll.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe wuaucll.exe

The following registry entry is set or modified, so that wuaucll.exe 
is run when files with extensions of EXE are opened/launched:

HKCR\exefile\shell\open\command
(default)
wuaucll.exe "%1" %*

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
3030





Name   Troj/Agent-EAB

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Agent-EAB is a DLL Helper Trojan for the Windows platform.

Troj/Agent-EAB includes functionality to download code from the 
internet and to inject code into system processes.

Advanced
Troj/Agent-EAB is a DLL Helper Trojan for the Windows platform.

Troj/Agent-EAB includes functionality to download code from the 
internet and to inject code into system processes.

Once installed Troj/Agent-EAB registers itself under the following 
registry entries as a DLL helper component to run itself when 
EXPLORER.EXE starts up:

HKCR\CLSID\(087FC023-DC5B-41E6-9286-953D382070C1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHoo
ks
(087FC023-DC5B-41E6-9286-953D382070C1)

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\<original filename without file 
extension>





Name   Troj/Cimuz-BM

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry
    * Dropped by malware
    * Installs a browser helper object

Aliases  
    * TROJ_BZUB.CQ
    * Trojan-Spy.Win32.BZub.fz

Prevalence (1-5) 2

Description
Troj/Cimuz-BM is a Trojan for the Windows platform.

Advanced
Troj/Cimuz-BM is a Trojan for the Windows platform.

When Troj/Cimuz-BM is installed it creates the file 
<System>\ipv6monl.dll. This file is also detected as Troj/Cimuz-BM.

The file ipv6monl.dll is registered as a COM object and Browser 
Helper Object (BHO) for Microsoft Internet Explorer, creating 
registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\browser 
helper objects\{21384D29-1240-2d4f-A15C-17E42823D523}

HKCR\CLSID\{21384D29-1240-2d4f-A15C-17E42823D523}

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\StandardProfile\AuthorizedApplications\List
<Program Files>\Internet Explorer\IEXPLORE.EXE
<Program Files>\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet 
Explorer

The following registry entry is set:

HKCU\Software\Microsoft\Internet Explorer\Main
Enable Browser Extensions
yes





Name   Troj/Lineag-AIV

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Uses its own emailing engine
    * Dropped by malware

Aliases  
    * Trojan-PSW.Win32.Gamec.bw
    * PWS-Lineage.dll
    * Win32/PSW.Lineage.NEE
    * TSPY_LINEAGE.DUL

Prevalence (1-5) 2

Description
Troj/Lineag-AIV is a Trojan for the Windows platform.

Advanced
Troj/Lineag-AIV is a Trojan for the Windows platform.

Troj/Lineag-AIV is a DLL component that contains functionality to 
steal information and send it to a remote user by email.

Troj/Lineag-AIV is likely to be installed by other malware.





Name   W32/Rbot-GCE

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks
    * Scans network for vulnerabilities
    * Scans network for weak passwords
    * Scans network for open ports

Aliases  
    * Backdoor.Win32.Rbot.bvz
    * W32/Sdbot.worm.gen.q

Prevalence (1-5) 2

Description
W32/Rbot-GCE is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-GCE runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Rbot-GCE spreads
- to computers vulnerable to common exploits, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012) and WKS (MS03-049)
- to network shares protected by weak passwords

Advanced
W32/Rbot-GCE is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-GCE runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-GCE copies itself to <System>\zaq.exe.

The following registry entries are created to run zaq.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32
zaq.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32
zaq.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Win32
zaq.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N





Name   Troj/FakeAle-AI

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/FakeAle-AI is a Trojan for the Windows platform.

Troj/FakeAle-AI includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/FakeAle-AI is a Trojan for the Windows platform.

Troj/FakeAle-AI includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/FakeAle-AI copies itself to 
<Windows>\xpupdate.exe and creates the file <User>\Application 
Data\Install.dat.

The following registry entries are created to run Troj/FakeAle-AI on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows update loader
<Windows>\xpupdate.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
con
<pathname of the application executable>

Registry entries are created under:

HKCU\Software\Install





Name   Troj/DwnLdr-FYH

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Win32/TrojanDownloader.Nurech.G

Prevalence (1-5) 2

Description
Troj/DwnLdr-FYH is a Trojan for the Windows platform.

Troj/DwnLdr-FYH includes functionality to;

- access the internet and communicate with a remote server via HTTP.
- download, install and run new software.

Advanced
Troj/DwnLdr-FYH is a Trojan for the Windows platform.

Troj/DwnLdr-FYH includes functionality to;

- access the internet and communicate with a remote server via HTTP.
- download, install and run new software.

When first run Troj/DwnLdr-FYH copies itself to <System>\ipcbt.exe 
and creates the file <System>\drivers\onud.dat. This file can be 
deleted.

The following registry entry is created to run ipcbt.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ipcbt
<System>\ipcbt.exe





Name   W32/Rbot-GCI

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Enables remote access

Aliases  
    * Backdoor.Win32.Agent.rk
    * W32/Backdoor.AAMZ

Prevalence (1-5) 2

Description
W32/Rbot-GCI is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-GCI spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: LSASS (MS04-011), SRVSVC 
(MS06-040), RPC-DCOM (MS04-012) and ASN.1 (MS04-007).

W32/Rbot-GCI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Rbot-GCI is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-GCI spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: LSASS (MS04-011), SRVSVC 
(MS06-040), RPC-DCOM (MS04-012) and ASN.1 (MS04-007).

W32/Rbot-GCI runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-GCI copies itself to <System>\soundman.exe.

The following registry entries are created to run soundman.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Sounds
soundman.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Sounds
soundman.exe

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\ StandardProfile\AuthorizedApplications\List
<System>\soundman.exe
<System>\soundman.exe:*:Enabled:Microsoft Sounds

W32/Rbot-GCI sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).

The following registry entry is set:

HKCU\Software\Microsoft\OLE
Microsoft Sounds
soundman.exe





Name   W32/Dzan-A

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Enables remote access

Aliases  
    * Virus.Win32.Dzan.a
    * W32/Dzan
    * Win32/Dzan.A
    * Infostealer.QQRob.A
    * PE_DZAN.A

Prevalence (1-5) 2

Description
W32/Dzan-A is a worm for the Windows platform.

W32/Dzan-A runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer.

Advanced
W32/Dzan-A is a worm that spreads via removable storage devices.

W32/Dzan-A runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer.

When W32/Dzan-A is installed it creates the files \mmc.exe and 
\ufdata2000.log.

The file mmc.exe is registered as a new system driver service named 
"mmc", with a display name of "Smart Card Supervisor" and a startup 
type of automatic, so that it is started automatically during system 
startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\mmc

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0





Name   W32/Sohana-G

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Sohana-G is a worm for the Windows platform.

W32/Sohana-G has the functionalities to spread via Instant Messaging 
protocols and to download, install and run new software.

Advanced
W32/Sohana-G is a worm for the Windows platform.

W32/Sohana-G has the functionalities to spread via Instant Messaging 
protocols and to download, install and run new software.

When first run W32/Sohana-G copies itself to:

<Windows>\lsass.exe
<System>\lsass.exe

The following registry entries are changed to run lsass.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe <System>\lsass.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
userinit.exe,<System>\lsass.exe

W32/Sohana-G changes settings for Microsoft Internet Explorer by 
modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableConfig
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

Registry entries are created under:

HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast
HKCU\Software\Yahoo\pager\View\YMSGR_buzz





Name   W32/Sohana-H

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Sohana-H is a worm for the Windows platform.

W32/Sohana-H has the functionalities to spread via Instant Messaging 
protocols and to download, install and run new software.

Advanced
W32/Sohana-H is a worm for the Windows platform.

W32/Sohana-H has the functionalities to spread via Instant Messaging 
protocols and to download, install and run new software.

When W32/Sohana-H is installed the following files are created:

<System>\svchost.exe
<System>\svchost32.exe

The following registry entries are created to run W32/Sohana-H on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Task Manager
<System>\svchost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Yahoo Messenger
<System>\svchost32.exe

W32/Sohana-H changes settings for Microsoft Internet Explorer by 
modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
1

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
Homepage
1

Registry entries are created under:

HKCU\Software\Yahoo\pager\View\YMSGR_Launchcast
HKCU\Software\Yahoo\pager\View\YMSGR_buzz





Name   Troj/Raser-AS

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry
    * Dropped by malware
    * Enables remote access

Aliases  
    * Trojan-Proxy.Win32.Delf.cb

Prevalence (1-5) 2

Description
Troj/Raser-AS is a Trojan for the Windows platform.

Advanced
Troj/Raser-AS is a multi-component proxy Trojan for the Windows 
platform.

Troj/Raser-AS allows unauthorized remote access to the computer via a 
network.

Troj/Raser-AS comprises the following files

<System>\ msiexecu.exe
<System>\<DRIVERS>\SndSystem.sys

The file msiexexcu.exe is installed as a the service called "HID 
Input Service WIN32".

The file SndSystem.sys is registered as a system driver service with 
a display name of "Sndsystem". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Sndsystem\





Name   Troj/FuiFrame-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Downloads code from the internet

Aliases  
    * Trojan.Win32.Zytric.d
    * Win32/TrojanDownloader.Delf.NPQ
    * TROJ_DLOADER.ETB

Prevalence (1-5) 2

Description
Troj/Fuiframe-A is a Trojan for the Windows platform.

Troj/Fuiframe-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/Fuiframe-A is a Trojan for the Windows platform.

Troj/Fuiframe-A includes functionality to access the internet and 
communicate with a remote server via HTTP.

Troj/Fuiframe-A searches the local file system for files with 
extensions starting PHP, ASP or HTM which it then infects with 
Troj/Psyme-DO or Troj/Fujif-Fam.





Name   Troj/Rincux-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Used in DOS attacks
    * Dropped by malware

Aliases  
    * Win32/Delf.NDZ
    * BKDR_HUPIGON.GEN
    * Backdoor.Win32.Agent.fs

Prevalence (1-5) 2

Description
Troj/Rincux-A is a Trojans for the Windows platform.

Once running Troj/Rincux-A has the functionality to perform denial of 
service attacks against remote computers.





Name   W32/Tilebot-IO

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Enables remote access

Aliases  
    * Backdoor.Win32.VanBot.as
    * IRC/SdBot
    * W32.Spybot.Worm
    * WORM_SPYBOT.UX

Prevalence (1-5) 2

Description
W32/Tilebot-IO is a worm for the Windows platform.

W32/Tilebot-IO may spread by exploiting the RealVNC vulnerability 
(CVE-2006-2369) or by copying itself to remote network shares with 
weak passwords.

W32/Tilebot-IO runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Tilebot-IO is a worm for the Windows platform.

W32/Tilebot-IO may spread by exploiting the RealVNC vulnerability 
(CVE-2006-2369) or by copying itself to remote network shares with 
weak passwords.

W32/Tilebot-IO runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-IO includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-IO copies itself to \mstinit.exe.

The file mstinit.exe is registered as a new system driver service 
named "Mstinit", with a display name of "Scheduling Agent" and a 
startup type of automatic, so that it is started automatically during 
system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Mstinit

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d

he worm may also change the following files:

<System>\ftp.exe
<System>\sfc_os.dll
<System>\tftp.exe

The modified file sfc.dll is the potentially unwanted application 
"Disabled System File Check DLL". The files ftp.exe and tftp.exe are 
replaced by dummy files that contain no executable code.





Name   W32/Fujacks-L

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Fujacks-L spreads to other network computers.

W32/Fujacks-L runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer.

W32/Fujacks-L includes functionality to access the internet and 
communicate
with a remote server via HTTP.

Advanced
W32/Fujacks-L is a virus with backdoor functionality for the Windows 
platform.

W32/Fujacks-L spreads to other network computers.

W32/Fujacks-L runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer.

W32/Fujacks-L includes functionality to access the internet and 
communicate
with a remote server via HTTP.

When W32/Fujacks-L is installed the following files are created:

<System>\drivers\ncscv32.exe

The following registry entry is created to run ncscv32.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
nvscv32
<System>\drivers\ncscv32.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\S
HOWALL
CheckedValue
0

The virus may infect ASP and HTML files, which are detected by 
Troj/Fujif-B.





Name   Troj/VB-CXT

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Monitors system activity

Prevalence (1-5) 2

Description
Troj/VB-CXT is a Trojan for the Windows platform.

Troj/VB-CXT tries to disguise itself as Microsoft DirectX Diagnostic 
Tool.

Advanced
Troj/VB-CXT is a Trojan for the Windows platform.

Troj/VB-CXT tries to disguise itself as Microsoft DirectX Diagnostic 
Tool.

When first run Troj/VB-CXT copies itself to <System>\dxdlg32.exe and 
may create the file \show.bat. The batch file can be deleted.

The following registry entry is created to run dxdlg32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DxDialog
<System>\dxdlg32.exe





Name   RK

Type  
    * Adware

Affected operating systems  
    * Windows

Side effects  
    * Monitors browser activity
    * Monitors system activity

Aliases  
    * AdWare.Win32.RK.k
    * Win32/Adware.RK

Prevalence (1-5) 2

Description
RK provides detection for the components of RelevantKnowledge 
application.





Name   W32/Tilebot-IP

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aad

Prevalence (1-5) 2

Description
W32/Tilebot-IP is a worm with IRC Backdoor functionality for the 
Windows platform.

W32/Tilebot-IP spreads to other network computers
- by exploiting common buffer overflow vulnerabilities, including: 
LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 
(MS04-007).
- via network shares.

Advanced
W32/Tilebot-IP is a worm with IRC Backdoor functionality for the 
Windows platform.

W32/Tilebot-IP spreads to other network computers
- by exploiting common buffer overflow vulnerabilities, including: 
LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039) and ASN.1 
(MS04-007).
- via network shares.

When first run W32/Tilebot-IP copies itself to \symon.exe.

The file symon.exe is registered as a new system driver service named 
"System Restore Manager", with a display name of "System Restore 
Manager" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created 
under:

HKLM\SYSTEM\CurrentControlSet\Services\System Restore Manager

W32/Tilebot-IP sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center





Name   W32/Fujet-A

Type  
    * Worm

How it spreads  
    * Removable storage devices
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Worm.Win32.Fujack.j
    * W32.Fujacks.L
    * WORM_FUJACK.X

Prevalence (1-5) 2

Description
W32/Fujet-A is a worm with backdoor functionality for the Windows 
platform.

W32/Fujet-A spreads to other network computers.

W32/Fujet-A runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer.

W32/Fujet-A includes functionality to access the internet and 
communicate with a remote server via HTTP, and attempts to download 
and execute further files from remote websites.

W32/Fujet-A modifies or deletes certain files it finds on the 
infected computer or available network shares.

W32/Fujet-A attempts to terminate processes and services, delete 
registry entries, and close windows related to anti-virus and 
security applications.

Advanced
W32/Fujet-A is a worm with backdoor functionality for the Windows 
platform.

W32/Fujet-A spreads to other network computers.

W32/Fujet-A runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer.

W32/Fujet-A includes functionality to access the internet and 
communicate with a remote server via HTTP, and attempts to download 
and execute further files from remote websites.

When first run W32/Fujet-A copies itself to 
<System>\drivers\spoclsv.exe.

The following registry entry is created to run spoclsv.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spoclsv.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0

W32/Fujet-A attempts to copy itself as GameSetup.exe to the following 
locations on network shares with weak passwords, and may attempt to 
run the copy as well:

<Root>\Documents and Settings\All Users\Start Menu\Programs\Startup\
<Root>\Documents and Settings\All Users\bkbe\
<Root>\WINDOWS\Start Menu\Programs\Startup\
<Root>\WINNT\Profiles\All Users\Start Menu\Programs\Startup\

W32/Fujet-A searches all folders on all drives and network shares 
with weak password on the infected computer. It avoids certain 
predefined folders, while in all others it attempts to drop a clean 
hidden file Desktop_.ini, attempts to delete files it finds with the 
extension GHO, and attempts to append data to files it finds with an 
extension of HTM, HTML, ASP, PHP, JSP and ASPX. Modified files are 
detected as W32/Fujif-A, W32/Fujif-Fam or W32/Fujif-Gen.

W32/Fujet-A may also create the clean file C:\test.txt.

W32/Fujet-A attempts to copy itself to the root of certain drives as 
setup.exe, also dropping the file autorun.inf in an attempt to run 
the copy automatically.

W32/Fujet-A may delete network shares from the infected computer.

W32/Fujet-A attempts to terminate processes and services, delete 
registry entries, and close windows related to anti-virus and 
security applications.





Name   W32/Sdbot-CXO

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Enables remote access

Aliases  
    * W32/Sdbot.worm.gen.ca
    * W32/Backdoor.ZLO
    * Backdoor.Win32.SdBot.bcf

Prevalence (1-5) 2

Description
W32/Sdbot-CXO is a worm with IRC backdoor functionality for the Windows
platform.

Advanced
W32/Sdbot-CXO is a worm with IRC backdoor functionality for the Windows
platform.

W32/Sdbot-CXO runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

When first run W32/Sdbot-CXO copies itself to <System>\msrdc.exe.

The following registry entries are created to run msrdc.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msrdc
<System>\msrdc.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
msrdc
<System>\msrdc.exe

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\St
andardProfile\AuthorizedApplications\List
<System>\msrdc.exe
<System>\msrdc.exe:*:Enabled:msrdc

The following registry entry is set:

HKCU\Software\Microsoft\OLE
msrdc
<System>\msrdc.exe





Name   W32/Sohana-J

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Sohana-J is a worm for the Windows platform.

W32/Sohana-J may attempt to spread via instant messaging clients.

W32/Sohana-J includes functionality to download, install and run new 
software.

Advanced
W32/Sohana-J is a worm for the Windows platform.

W32/Sohana-J may attempt to spread via instant messaging clients.

W32/Sohana-J includes functionality to download, install and run new 
software.

When first run W32/Sohana-J copies itself to:

<Windows>\svichosst.exe
<System>\svichosst.exe

The following registry entry is changed to run svichosst.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe svichosst.exe

The following registry entry is set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)