Text 167, 1420 rader
Skriven 2007-02-11 17:26:00 av KURT WISMER
Ärende: News, February 11 2007
==============================
[cut-n-paste from sophos.com]
Name Troj/Clagger-AW
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Downloads code from the internet
Aliases
* Downloader-AAP
Prevalence (1-5) 3
Description
Troj/Clagger-AW is a downloader Trojan for the Windows platform.
Troj/Clagger-AW contains functionality to terminate anti-virus
applications and download remote code.
Name W32/Chode-W
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Win32/Spy.VB.LO
Prevalence (1-5) 2
Description
W32/Chode-W is an instant messaging worm for the Windows platform
with IRC backdoor functionality.
Advanced
W32/Chode-W is an instant messaging worm for the Windows platform
with IRC backdoor functionality.
W32/Chode-W attempts to spread via MSN Instant Messenger and AOL
Instant Messenger by sending users a link to a copy of the worm.
When first run W32/Chode-W copies itself to <System>\<random
characters>\winlogon.exe.
W32/Chode-W also creates the following files:
<System>\netstat.com
<System>\taskkill.com
<System>\<random characters>\winlogon.ini
<Start Menu>\Programs\Startup\winlogon.lnk
These files can be deleted.
The following registry entries are created to run W32/Chode-W on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run
<System>\<random characters>\winlogon.exe
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\<random characters>\winlogon.exe
The following registry entry is set, disabling the registry editor
(regedit):
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
W32/Chode-W sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoAdminPage
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter
Enabled
1
W32/Chode-W also appends the HOSTS file with the following URL
mappings, denying access to security and anti-virus related websites:
1.1.1.1 f-secure.com
1.1.1.1 www.f-secure.com
1.1.1.1 ftp.f-secure.com
1.1.1.1 ftp.sophos.com
1.1.1.1 liveupdate.symantec.com
1.1.1.1 customer.symantec.com
1.1.1.1 dispatch.mcafee.com
1.1.1.1 download.mcafee.com
1.1.1.1 rads.mcafee.com
1.1.1.1 mast.mcafee.com
1.1.1.1 my-etrust.com
1.1.1.1 www.my-etrust.com
1.1.1.1 nai.com
1.1.1.1 www.nai.com
1.1.1.1 networkassociates.com
1.1.1.1 secure.nai.com
1.1.1.1 securityresponse.symantec.com
1.1.1.1 service1.symantec.com
1.1.1.1 sophos.com
1.1.1.1 www.sophos.com
1.1.1.1 support.microsoft.com
1.1.1.1 symantec.com
1.1.1.1 www.symantec.com
1.1.1.1 update.symantec.com
1.1.1.1 updates.symantec.com
1.1.1.1 us.mcafee.com
1.1.1.1 vil.nai.com
1.1.1.1 viruslist.com
1.1.1.1 www.viruslist.com
1.1.1.1 grisoft.com
1.1.1.1 www.grisoft.com
1.1.1.1 free.grisoft.com
1.1.1.1 trendmicro.com
1.1.1.1 housecall.trendmicro.com
1.1.1.1 www.trendmicro.com
1.1.1.1 pandasoftware.com
1.1.1.1 www.pandasoftware.com
1.1.1.1 usa.kaspersky.com
1.1.1.1 ewido.net
1.1.1.1 www.ewido.net
1.1.1.1 zonelabs.com
1.1.1.1 www.zonelabs.com
1.1.1.1 bitdefender.com
1.1.1.1 www.bitdefender.com
1.1.1.1 download.bitdefender.com
1.1.1.1 upgrade.bitdefender.com
1.1.1.1 spywareinfo.com
1.1.1.1 www.spywareinfo.com
1.1.1.1 merijn.org
1.1.1.1 www.merijn.org
1.1.1.1 sysinternals.com
1.1.1.1 www.sysinternals.com
1.1.1.1 onguardonline.gov
1.1.1.1 www.onguardonline.gov
1.1.1.1 avast.com
1.1.1.1 www.avast.com
1.1.1.1 safety.live.com
1.1.1.1 www.paretologic.com
1.1.1.1 paretologic.com
1.1.1.1 virusscan.jotti.org
1.1.1.1 services.google.com
Name W32/Fujacks-N
Type
* Worm
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Worm.Win32.Fujack.ab
* WORM_FUJACKS.ES
* W32.Fujacks.A
Prevalence (1-5) 2
Description
W32/Fujacks-N is a virus with backdoor functionality for the Windows
platform.
W32/Fujacks-N spreads to other network computers.
W32/Fujacks-N runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Fujacks-N includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Fujacks-N is a virus with backdoor functionality for the Windows
platform.
W32/Fujacks-N spreads to other network computers.
W32/Fujacks-N runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Fujacks-N includes functionality to access the internet and
communicate with a remote server via HTTP.
When W32/Fujacks-N is installed the following files are created:
<System>\drivers\sppolsv.exe
The following registry entry is created to run ncscv32.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\sppolsv.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0
Name W32/Dref-Z
Type
* Virus
How it spreads
* Email messages
* Email attachments
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Aliases
* Win32/Nuwar.gen
* Email-Worm.Win32.Glowa.h
Prevalence (1-5) 2
Description
W32/Dref-Z is a mass-mailing worm and parasitic virus for the Windows
platform.
W32/Dref-Z spreads to other network computers and via email.
W32/Dref-Z includes functionality to access the internet and
communicate with a remote server via HTTP.
W32/Dref-Z will attempt to infect SCR EXE and RAR files.
Files infected with the virus are detected as W32/Dref-L.
Advanced
W32/Dref-Z is a mass-mailing worm and parasitic virus for the Windows
platform.
W32/Dref-Z spreads to other network computers and via email.
W32/Dref-Z harvests email addresses from the infected computer.
W32/Dref-Z includes functionality to access the internet and
communicate with a remote server via HTTP.
W32/Dref-Z will attempt to infect SCR EXE and RAR files.
Files infected with the virus are detected as W32/Dref-L.
When first run W32/Dref-Z copies itself to:
<CurrentFolder>\<random>.t
<System>\<Random Name>.t
<System>\wservice.exe
and creates the file <Current Folder>\l132JRa.exe. This file is
detected as Troj/DwnLdr-FUY.
The following registry entries are created to run wservice.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
UpdateService
<System>\wservice.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdateService
<System>\wservice.exe
W32/Dref-Z sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Name Troj/Agent-EBO
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
* Opens links to websites
Prevalence (1-5) 2
Description
Troj/Agent-EBO is a Trojan for the Windows platform.
Advanced
Troj/Agent-EBO is a Trojan for the Windows platform.
The Trojan has the functionality to download code from a remote server.
The following registry entry is created to run Troj/Agent-EBO on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<original filename>
<pathname of the Trojan executable>
Troj/Agent-EBO changes settings for Microsoft Internet Explorer by
modifying values under:
HKCU\Software\Microsoft\Internet Explorer\AdvancedOptions\
HKCU\Software\Microsoft\Internet Explorer\AdvancedOptions\Ypdyp\
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\Ypdyp\
Name Troj/PWS-AFA
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Trojan-Spy.Win32.Delf.ue
Prevalence (1-5) 2
Description
Troj/PWS-AFA is a Trojan for the Windows platform.
The Trojan has the functionality to steal information and to access
the internet and communicate with a remote server via HTTP.
Advanced
Troj/PWS-AFA is a Trojan for the Windows platform.
The Trojan has the functionality to steal information and to access
the internet and communicate with a remote server via HTTP.
When run, the Trojan copies itself to \Games\yspyDMH\svchost.exe and
creates the following files:
\Games\desktop.dat (Can be removed safely)
\Games\yspyDMH\winlogon.dll (Detected as Troj/PWS-AFA)
\Games\yspyDMH\winsvc.dll (Detected as Troj/PWS-AFA)
\Games\yspyDMH\wintvc.dll (Detected as Troj/PWS-AFA)
<current folder>\tmp1.dat (Can be removed safely)
<current folder>\tmp2.dat (Can be removed safely)
The following registry entry is created to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
YahooSpyServer
\Games\yspydmh\svchost.exe
Name W32/VB-CYK
Type
* Worm
How it spreads
* Removable storage devices
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* TROJ_VB.YN
* Virus.Win32.VB.h
Prevalence (1-5) 2
Description
W32/VB-CYK is a worm for the Windows platform.
W32/VB-CYK spreads via removable storage devices.
Advanced
W32/VB-CYK is a worm for the Windows platform.
W32/VB-CYK spreads via removable storage devices.
When first run W32/VB-CYK copies itself to the Windows system folder.
The following registry entry is created to run W32/VB-CYK on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RavMont
<System>\<original worm filename>
Name Troj/Dloadr-ASY
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/Dloadr-ASY is a downloading Trojan for the Windows platform.
Advanced
Troj/Dloadr-ASY is a downloading Trojan for the Windows platform.
Troj/Dloadr-ASY downloads a file from a preconfigured location to the
temporary folder and executes it. At the time of writing, this file
is detected as Mal/Cimuz-A.
Troj/Dloadr-ASY includes functionality to terminate anti-virus and
other security applications.
Name Troj/PWS-AFB
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Aliases
* Trojan-PSW.Win32.OnLineGames.es
Prevalence (1-5) 2
Description
Troj/PWS-AFB is an information stealing Trojan for the Windows
platform.
Advanced
Troj/PWS-AFB is an information stealing Trojan for the Windows
platform.
When first run Troj/PWS-AFB copies itself to <Windows>\itise.exe and
creates the file <System>\itise.dll. The dll is also detected as
Troj/PWS-AFB.
The following registry entry is created to run itise.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
itise
<Windows>\itise.exe
Name W32/Sdbot-CYD
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* WORM_SPYBOT.QI
* Backdoor.Win32.SdBot.qt
Prevalence (1-5) 2
Description
W32/Sdbot-CYD is a worm with IRC Backdoor functionality for the
Windows platform.
W32/Sdbot-CYD spreads
- to computers vulnerable to common exploits, including: SRVSVC
(MS06-040), RPC-DCOM (MS04-012), WKS (MS03-049) and ASN.1 (MS04-007)
- to network shares
W32/Sdbot-CYD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Sdbot-CYD is a worm with IRC Backdoor functionality for the
Windows platform.
W32/Sdbot-CYD spreads
- to computers vulnerable to common exploits, including: SRVSVC
(MS06-040), RPC-DCOM (MS04-012), WKS (MS03-049) and ASN.1 (MS04-007)
- to network shares
W32/Sdbot-CYD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Sdbot-CYD copies itself to \ntfscrypt.exe and
creates the file \sysremove.bat. The bat file can be deleted.
The file ntfscrypt.exe is registered as a new system driver service
named "NTFSCrypt", with a display name of "NTFS Crypto Technology"
and a startup type of automatic, so that it is started automatically
during system startup.
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\NTFSCrypt
Name W32/Brontok-CO
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Win32/VB.DA
* W32/Generic.worm.b
* Worm.Win32.VB.da
Prevalence (1-5) 2
Description
W32/Brontok-CO is a worm for the Windows platform.
Advanced
W32/Brontok-CO is a worm for the Windows platform.
When first run W32/Brontok-CO copies itself to:
\4k51k4.exe
<Startup>\Empty.pif
<User>\Local Settings\Application Data\csrss.exe
<User>\Local Settings\Application Data\windows\csrss.exe
<User>\Local Settings\Application Data\windows\lsass.exe
<User>\Local Settings\Application Data\windows\services.exe
<User>\Local Settings\Application Data\windows\smss.exe
<User>\Local Settings\Application Data\windows\winlogon.exe
<Windows>\4k51k4.exe
<System>\IExplorer.exe
<System>\MrHelloween.scr
<System>\shell.exe
The following registry entries are created to run W32/Brontok-CO on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
4k51k4
<Windows>\4k51k4.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicesara
<User>\Local Settings\Application Data\WINDOWS\SERVICES.EXE
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Logonsara
<User>\Local Settings\Application Data\WINDOWS\CSRSS.EXE
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Monitoring
<User>\Local Settings\Application Data\WINDOWS\LSASS.EXE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS
<User>\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
The following registry entries are changed to run W32/Brontok-CO on
startup:
HKCU\Control Panel\Desktop
SCRNSAVE.EXE
<System>\MRHELL~1.SCR
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "<System>\IExplorer.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<System>\IExplorer.exe
The following registry entries are set or modified, so that shell.exe
is run when files with extensions of BAT, COM, EXE and PIF are
opened/launched:
HKCR\lnkfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*
HKCR\batfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*
HKCR\comfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*
HKCR\exefile\shell\open\command
(default)
<System>\shell.exe" "%1" %*
HKCR\piffile\shell\open\command
(default)
<System>\shell.exe" "%1" %*
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
1
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
<System>\Shell.exe
Name W32/Fujacks-O
Type
* Worm
How it spreads
* Removable storage devices
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Enables remote access
Aliases
* W32/Fujacks.n
* Win32/Fujacks.U
* Worm.Win32.Fujack.b
Prevalence (1-5) 2
Description
W32/Fujacks-O is a virus and worm with backdoor functionality for the
Windows platform.
Advanced
W32/Fujacks-O is a virus and worm with backdoor functionality for the
Windows platform.
W32/Fujacks-O spreads to other network computers.
W32/Fujacks-O runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Fujacks-O includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Fujacks-O copies itself to
<System>\drivers\spcolsv.exe.
The following registry entry is created to run spcolsv.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spcolsv.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0
Name Troj/Murlo-AQ
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Murlo.ev
* Generic
Prevalence (1-5) 2
Description
Troj/Murlo-AQ is a Trojan for the Windows platform.
Advanced
Troj/Murlo-AQ is a Trojan for the Windows platform.
Troj/Murlo-AQ includes functionality to access the internet and
communicate with a remote server via HTTP.
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Internet Explorer
UID
b13501008005000040003e47
Name W32/Bobandy-H
Type
* Spyware Worm
How it spreads
* Removable storage devices
* Email attachments
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
Aliases
* Worm.Win32.VB.cz
Prevalence (1-5) 2
Description
W32/Bobandy-H is a worm for the Windows platform.
Advanced
W32/Bobandy-H is a worm for the Windows platform.
When first run W32/Bobandy-H copies itself to:
<Startup>\adodb.cmd
<User>\Templates\63746\13463746.exe
<User>\Templates\63746\service.exe
<User>\Templates\63746\winlogon.exe
<Windows>\036450635.exe
<Windows>\35838\bb856821l.com
<Windows>\35838\smss.exe
<Windows>\35838\system.exe
<Windows>\l755287.exe
<Windows>\lsass.exe
<System>\127387645063l.exe
<System>\51334a\c1273870.cmd
<System>\moonlight.scr
and creates the file <System>\crtsys.dll.
Registry entries are created under:
HKCU\Software\VB and VBA Program Settings\titta\version
HKCU\Software\VB and VBA Program Settings\untukmu2\version
Emails sent by W32/Bobandy-H have the following characteristics:
Subject lines chosen from:
hey Indonesian porn
Agnes Monica pic's
Fucking With Me :D
please read again what i have written to you
miss Indonesian
Cek This
Japannes Porn
Aku Mencari Wanita yang aku Cintai
dan cara menggunakan email mass
ini adalah cara terakhirku ,di lampiran ini terdapat
foto dan data Wanita tsb Thank's
NB:Mohon di teruskan kesahabat anda
aku mahasiswa BSI Margonda smt 4
yah aku sedang membutuhkan pekerjaan
CoolMan
oh ya aku tahu anda dr milis ilmu komputer
di lampiran ini terdapat curriculum vittae dan foto saya
File attachments may arrive as:
MyHeart.exe
KesenjanganSosial.exe
FirstLove.exe
W32/Bobandy-H attempts to copy itself to the root folders of all
mapped drives.
W32/Bobandy-H harvests email addresses from files on the infected
computer and includes functionality to terminate security and
anti-virus related processes and record keystrokes.
Name W32/Looked-BV
Type
* Virus
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* PE_LOOKED.MP
* W32/HLLP.Philis.bz
* Worm.Win32.Viking.cf
* Win32/Viking.CH
Prevalence (1-5) 2
Description
W32/Looked-BV is a virus which can also spread via network shares.
W32/Looked-BV runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Looked-BV includes functionality to access the internet and
communicate with a remote server via HTTP, and to download and
execute further files.
Advanced
W32/Looked-BV is a virus which can also spread via network shares.
W32/Looked-BV runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Looked-BV includes functionality to access the internet and
communicate with a remote server via HTTP, and to download and
execute further files.
When first run W32/Looked-BV copies itself to \uninstall\rundl132.exe
and <Windows>\Logo1_.exe and creates the following files:
<Windows>\RichDll.dll
This file is also detected as W32/Looked-BV.
The following registry entry is created to run rundl132.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe
Registry entries are created under:
HKLM\SOFTWARE\Soft\DownloadWWW\
Name W32/Fujacks-P
Type
* Virus
How it spreads
* Removable storage devices
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Worm.Win32.Small.n
* Win32/Fujacks.X
* WORM_NIMAYA.V
Prevalence (1-5) 2
Description
W32/Fujacks-P is a virus for the Windows platform.
W32/Fujacks-P spreads to other network computers via shared drives.
W32/Fujacks-P includes functionality to:
- download code from the internet
- terminate anti-virus and security related processes
W32/Fujacks-P also spreads via removeable drives and creating the
file AUTORUN.INF into the root folder of the removeable drive which
will runs the worm in an attempt to infect other computers when the
removeable device is connected to another computer.
Advanced
W32/Fujacks-P is a virus for the Windows platform.
W32/Fujacks-P spreads to other network computers via shared drives.
W32/Fujacks-P includes functionality to:
- download code from the internet
- terminate anti-virus and security related processes
When first run W32/Fujacks-P copies itself to
<System>\drivers\spoclsv.exe and <Root>\setup.exe.
W32/Fujacks-P also spreads via removeable drives and creating the
file AUTORUN.INF into the root folder of the removeable drive which
will runs the worm in an attempt to infect other computers when the
removeable device is connected to another computer.
The following registry entry is created to run spoclsv.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spoclsv.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL
CheckedValue
0
Name W32/Looked-BU
Type
* Virus
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Looked-BU is a Windows executable virus and network worm.
The virus includes functionality to access the internet and
communicate with a remote server via HTTP.
Advanced
W32/Looked-BU is a Windows executable virus and network worm.
The virus includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Looked-BU copies itself to
<Windows>\uninstall\rundl132.exe <Windows>\logo1_.exe and creates the
file <Windows>\RichDll.dll. This file is also detected as
W32/Looked-BU.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
Many files with the name "_desktop.ini" are created, in various
folders on the infected computer. These files are harmless text files.
The following registry entry is created in order to run the virus on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\uninstall\rundl132.exe
Name W32/Looked-BW
Type
* Worm
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/Looked-BW is a Windows executable virus and network worm.
Advanced
W32/Looked-BW is a Windows executable virus and network worm.
When first run the virus copies itself to <Windows>\rundl132.exe and
creates a file <Windows>\RichDll.dll, also detected as W32/Looked-BW.
This file attempts to download further malicious code.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
Many files with the name "_desktop.ini" are created, in various
folders on the infected computer. These files are harmless text files.
The following registry entry is created in order to run the virus on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe
Name Troj/Zlob-ZT
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* TROJ_ZLOB.CBM
Prevalence (1-5) 2
Description
Troj/Zlob-ZT is a Trojan for the Windows platform.
Troj/Zlob-ZT includes functionality to download, install and run new
software.
Name W32/Looked-BX
Type
* Virus
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* PE_LOOKED.GEN
* W32/HLLP.Philis.bg
* Worm.Win32.Viking.bd
* Win32/Viking.BY
Prevalence (1-5) 2
Description
W32/Looked-BX is a Windows executable virus and network worm.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
Advanced
W32/Looked-BX is a Windows executable virus and network worm.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
When W32/Looked-BX is installed the following files are created:
<Windows>\Logo1_.exe
<Windows>\rundl132.exe
The files Logo1_.exe and rundl132.exe are detected as W32/Looked-BX.
The following registry entry is created to run rundl132.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows>\rundl132.exe
Name W32/MSNVB-D
Type
* Worm
How it spreads
* Chat programs
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Installs itself in the Registry
Prevalence (1-5) 2
Description
W32/MSNVB-D is a worm for the Windows platform.
Advanced
W32/MSNVB-D is a worm for the Windows platform.
W32/MSNVB-D may attempt to spread through Microsoft's MSN Messenger
program.
W32/MSNVB-D includes functionality to:
-access the internet and communicate with a remote server via HTTP.
-terminate security related processes
When first run W32/MSNVB-D copies itself to:
<Windows>\Avconsol.exe
<Windows>\Zap.exe
<System>\Hide32.exe
<System>\Ttt.exe
The following registry entries are created to run Avconsol.exe,
Zap.exe,
Hide32.exe and Ttt.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinService
<System>\Ttt.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AVantivirus
<Windows>\Avconsol.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System
<Windows>\Zap.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicewin
<System>\Hide32.exe
Registry entries are created under:
HKCU\Software\VB and VBA Program Settings\Form1\TextBox
Name Troj/DwnLdr-GAI
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Prevalence (1-5) 2
Description
Troj/DwnLdr-GAI is a downloader Trojan for the Windows platform.
When run, Troj/DwnLdr-GAI downloads a file from a remote server via
HTTP. At the time of writing the file downloaded was detected by
Sophos as Troj/Deldo-Gen.
Name Troj/Gampass-H
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Installs itself in the Registry
Aliases
* W32/PWStealer.gen1
Prevalence (1-5) 2
Description
Troj/Gampass-H is a Trojan for the Windows platform which aims to
steal login credentials for certain online games.
Advanced
Troj/Gampass-H is a Trojan for the Windows platform which aims to
steal login credentials for certain online games.
When run Troj/Gampass-H installs the following files:
<windows>\Debug\UserMode\299E55F.dll
<windows>\Debug\UserMode\299E55F.exe
The following Registry entries are added to run the Trojan at startup:
HKCR\CLSID\{3771BD45-B3B5-46FF-B309-028D126B9103}
InProcServer32
<windows>\debug\userMode\299E55F.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{3771BD45-B3B5-46FF-B309-028D126B9103}
--- MultiMail/Win32 v0.43
* Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)
|