Tillbaka till svenska Fidonet
English   Information   Debug  
COMICS   0/15
CONSPRCY   0/899
COOKING   33158
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/2064
DOS_INTERNET   0/196
duplikat   6002
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33918
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   24145
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12852
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4422
FN_SYSOP   41694
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13600
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16073
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22103
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   928
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4786
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1121
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   3233
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13284
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2056
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4289
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
Möte DIRTY_DOZEN, 201 texter
 lista första sista föregående nästa
Text 190, 849 rader
Skriven 2007-06-02 13:42:00 av KURT WISMER
Ärende: News, June 2 2007
=========================
[cut-n-paste from sophos.com]

Name   Troj/Goldun-FZ

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Goldun-FZ is a Trojan for the Windows platform.

Advanced
Troj/Goldun-FZ is a Trojan for the Windows platform.

When run, the Trojan creates the file <System>\msdom2.dll and this 
file is detected as Troj/Goldun-FZ.





Name   W32/Looked-DW

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Looked-DW is a prepending virus and worm for the Windows platform.

Advanced
W32/Looked-DW is a prepending virus and worm for the Windows platform.

W32/Looked-DW spreads to other network computers.

W32/Looked-DW includes functionality to access the internet and 
communicate with a remote server via HTTP. W32/Looked-DW may attempt 
to download and execute additional files from a remote location.

When first run W32/Looked-DW copies itself to the following locations:

<Windows>\uninstall\rundl132.exe
<Windows>\logo1_.exe

and creates the file <Windows>\RichDll.dll.

The file RichDll.dll is also detected as W32/Looked-DW.
            
The following registry entry is created to run rundl132.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe

Registry entries are created under:
HKLM\SOFTWARE\Soft\DownloadWWW\





Name   Troj/Mdrop-BPE

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Prevalence (1-5) 2

Description
Troj/Mdrop-BPE is a Trojan for the Windows platform.

Advanced
Troj/Mdrop-BPE is a Trojan for the Windows platform.

When Troj/Mdrop-BPE is installed the following files are created:

<System>\exec1.exe - detected as W32/IRCBot-WA
<System>\exec2.exe - detected as Troj/Keygen-BI





Name   W32/Seccmu-A

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Trojan.Win32.VB.pt
    * Win32/VB.PT trojan
    * WORM_VB.AK

Prevalence (1-5) 2

Description
W32/Seccmu-A is a worm for the Windows platform.

Advanced
W32/Seccmu-A is a worm for the Windows platform.

W32/Seccmu-A attempts to copy itself to C:\Windows\system32\csrs.exe 
and A:\Practica3.exe, and sets the following registry entry to run 
itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Action
C:\Windows\system32\csrs.exe

W32/Seccmu-A generates a fake error message box with the title "Error 
de ejecucion" and the text "Practica3.xls Danado".





Name   Troj/Kimat-C

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry
    * Modifies browser settings

Prevalence (1-5) 2

Description
Troj/Kimat-C is a Trojan for the Windows platform.

Advanced
Troj/Kimat-C is a Trojan for the Windows platform.

When first run Troj/Kimat-C copies itself to:

<User>\Templates\winword.doc.exe
<User>\Templates\winword2.doc.exe
<CurrentFolder>\sample1.doc.exe
<Root>\Tiara Lestari.exe
<Root>\goats\SAMPLE1.DOC.exe
<Root>\sample1.doc.exe
<System>\config\systemprofile\Templates\winword.doc.exe
<System>\config\systemprofile\Templates\winword2.doc.exe
<Windows>\zistro.exe

The following registry entry is created to run zistro.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
test
<Windows>\zistro.exe

The following registry entry is set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegedit
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
DefaultValue
1





Name   W32/Fujacks-AK

Type  
    * Virus

How it spreads  
    * Removable storage devices
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Fujacks-AK is an attempted virus and worm for the Windows platform.

W32/Fujacks-AK spreads to other network computers through available 
network shares and removeable storage devices by coping itself with 
the filenames GameSetup.exe and setup.exe correspondingly. 
W32/Fujacks-AK also creates the file autorun.inf to ensure that the 
file setup.exe is executed.

Advanced
W32/Fujacks-AK is an attempted virus and worm for the Windows platform.

W32/Fujacks-AK spreads to other network computers through available 
network shares and removeable storage devices by coping itself with 
the filenames GameSetup.exe and setup.exe correspondingly. 
W32/Fujacks-AK also creates the file autorun.inf to ensure that the 
file setup.exe is executed.

W32/Fujacks-AK includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Fujacks-AK copies itself to
<System>\drivers\spoclsv.exe.
<Root>\setup.exe.
<Root>\autorun.inf. - This file can be safely deleted.

The following registry entry is created to run spoclsv.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\spoclsv.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0

W32/Fujacks-AK searches for EXE files in attempt to infect them and 
creates Desktop_.ini file every time when succeed. This file may be 
safely deleted.

W32/Fujacks-AK includes functionality to delete shares including the 
Admin$ share.

W32/Fujacks-AK attempts to periodically copy itself to removeable 
drives, including floppy drives and USB keys. The worm will attempt 
to create a hidden file Autorun.inf on the removeable drive and copy 
itself to the same location. The file Autorun.inf is designed to 
start the worm once the removeable drive is connected to a uninfected 
computer.





Name   Troj/LdPinch-QW

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information

Aliases  
    * Trojan-PSW.Win32.LdPinch.bvf

Prevalence (1-5) 2

Description
Troj/LdPinch-QW is a Trojan for the Windows platform.





Name   Troj/BHO-CC

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs a browser helper object

Prevalence (1-5) 2

Description
Troj/BHO-CC is a Trojan for the Windows platform.

Troj/BHO-CC may register itself as a browser helper object for 
Internet Explorer. When installed, it may steal user browsing habits 
and redirect searches.

Advanced
Troj/BHO-CC is a Trojan for the Windows platform.

Troj/BHO-CC may register itself as a browser helper object for 
Internet Explorer. When installed, it may steal user browsing habits 
and redirect searches.





Name   Mal/Behav-043

Type  
    * Malicious Behavior

Affected operating systems  
    * Windows

Prevalence (1-5) 2

Description
Mal/Behav-043 is a malicious file for the Windows platform.

Advanced
Mal/Behav-043 is a malicious file for the Windows platform.





Name   W32/Poebot-LP

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks
    * Scans network for vulnerabilities
    * Scans network for weak passwords

Prevalence (1-5) 2

Description
W32/Poebot-LP is a worm for the Windows platform.

The worm spreads through network shares protected by weak passwords 
and through operating system vulnerabilities such as LSASS 
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), SRVSVC (MS06-040) 
and Dameware (CAN-2003-1030).

The backdoor component of W32/Poebot-LP connects to a predefined IRC 
server and awaits commands from remote attackers. The backdoor 
component of W32/Poebot-LP can be instructed by a remote user to 
perform the following functions:

- start an FTP server
- start a proxy server
- start a web server
- take part in distributed denial of service (DDoS) attacks
- log keypresses
- capture screen/webcam images
- packet sniffing
- port scanning
- download/execute arbitrary files
- start a remote shell (RLOGIN)
- steals information from the Protected Storage Area
- steal product registration information from certain software

Advanced
W32/Poebot-LP is a worm for the Windows platform.

The worm spreads through network shares protected by weak passwords 
and through operating system vulnerabilities such as LSASS 
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), SRVSVC (MS06-040) 
and Dameware (CAN-2003-1030).

The backdoor component of W32/Poebot-LP connects to a predefined IRC 
server and awaits commands from remote attackers. The backdoor 
component of W32/Poebot-LP can be instructed by a remote user to 
perform the following functions:

- start an FTP server
- start a proxy server
- start a web server
- take part in distributed denial of service (DDoS) attacks
- log keypresses
- capture screen/webcam images
- packet sniffing
- port scanning
- download/execute arbitrary files
- start a remote shell (RLOGIN)
- steals information from the Protected Storage Area
- steal product registration information from certain software

When first run, W32/Poebot-LP copies itself to <Windows system 
folder>\lsass.exe

W32/Poebot-LP sets the following registry entry to start at system 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Local Security Authority Servce
<Windows system folder>\lssas.exe





Name   W32/Fujacks-AL

Type  
    * Virus

How it spreads  
    * Removable storage devices
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Steals information
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Fujacks-AL is a virus for the Windows platform.

Advanced
W32/Fujacks-AL is a virus for the Windows platform.

W32/Fujacks-AL spreads to other network computers.

W32/Fujacks-AL includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Fujacks-AL copies itself to 
<System>\drivers\ncscv32.exe.

The following registry entry is created to run ncscv32.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
nvscv32
<System>\drivers\ncscv32.exe

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder
\Hidden\SHOWALL
CheckedValue
0

W32/Fujacks-AL attempts to periodically copy itself to removeable 
drives, including floppy drives and USB keys. The worm will attempt 
to create a hidden file Autorun.inf on the removeable drive and copy 
itself to the same location. The file Autorun.inf is designed to 
start the virus once the removeable drive is connected to a 
uninfected computer.





Name   Troj/Torpig-BV

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Torpig-BV is a downloader Trojan for the Windows platform.

Advanced
Troj/Torpig-BV is a downloader Trojan for the Windows platform.

When run Troj/Torpig-BV creates the file \clean_4392d.dll. This file 
is also detected as Troj/Torpig-BV.

Troj/Torpig-BV attempts to install the a service with the name 
"ldrsvc".

Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LDRSVC\
HKLM\SYSTEM\CurrentControlSet\Services\ldrsvc\





Name   W32/Tilebot-JS

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Tilebot-JS is a backdoor worm for the Windows platform which 
allows a remote intruder to gain access and control over the computer.

Advanced
W32/Tilebot-JS is a backdoor worm for the Windows platform which 
allows a remote intruder to gain access and control over the computer.

W32/Tilebot-JS includes functionality to access the internet and 
communicate with a remote server via HTTP.

W32/Tilebot-JS patches the Windows executable files ftp.exe and 
tftp.exe so that they no longer function. W32/Tilebot-JS also patches 
the Windows system file sfc_os.dll to disable Windows system file 
checking.

When first run W32/Tilebot-JS copies itself to <Windows>\iexplore.exe.

The file iexplore.exe is registered as a new system driver service 
named "Microsoft Internet Explorer", with a display name of 
"Microsoft Internet Explorer" and a startup type of automatic, so 
that it is started automatically during system startup. Registry 
entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Internet Explorer

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d





Name   W32/SillyFDC-HO

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/SillyFDC-HO is a worm for the Windows platform.

Advanced
W32/SillyFDC-HO is a worm for the Windows platform.

When run W32/SillyFDC-HO enumerates all the folders on the infected 
computer and copies itself to those folders with that same folder 
name but appended with an .exe file extension.

W32/SillyFDC-HO copies itself to <Windows>\windows.exe and sets the 
following registry entry to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
gpmce
<Windows>\windows.exe


HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr
1

HKCU\Software\Policies\Microsoft\Windows\System
disableCMD
2

HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
www.booble.com

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
DisableThumbnailCache
1





Name   W32/Bagle-WX

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Bagle-WX is a worm for the Windows platform.

Advanced
W32/Bagle-WX is a worm for the Windows platform.

W32/Bagle-WX creates the file <Application Data>\hidires\m_hook.sys. 
This file is registered as a service named "m_hook" with a startup 
type of automatic. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\
HKLM\SYSTEM\CurrentControlSet\Services\m_hook\

The file m_hook.sys is also detected as W32/Bagle-WX.

The following registry entries are set:

HKLM\SYSTEM\CurrentControlSet\Services\Alerter
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\Ndisuio
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4





Name   W32/Bagle-SR

Type  
    * Worm

How it spreads  
    * Email messages
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Downloads code from the internet

Prevalence (1-5) 2

Description
W32/Bagle-SR is a worm for the Windows platform.

Advanced
W32/Bagle-SR is a worm for the Windows platform.

When run W32/Bagle-SR creates the files:

- \Local settings\Temp\~3.exe - detected as W32/Bagle-WX
- \Local settings\Temp\~4.exe - detected as Troj/BagleDL-PQ
- \Local settings\Temp\~5.exe - detected as W32/Bagle-WW

W32/Bagle also creates the following files which are harmless and can 
be safely deleted:

- \Local settings\Temp\~3.tmp
- \Local settings\Temp\~4.tmp
- \Local settings\Temp\~5.tmp

W32/Bagle-SR creates the file \hidires\m_hook.sys which is detected 
as W32/Bagle-WX. This file is registered as a service named "m_hook" 
with a startup type of automatic. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\

HKLM\SYSTEM\CurrentControlSet\Services\m_hook\

The following registry entries are set:

HKLM\SYSTEM\CurrentControlSet\Services\Alerter
Start
4
 
HKLM\SYSTEM\CurrentControlSet\Services\Ndisuio
Start
4
 
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
 
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4





Name   W32/Looked-DH

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Viking.lr
    * Win32/Viking.DC

Prevalence (1-5) 2

Description
W32/Looked-DH is a virus for the Windows platform.

Advanced
W32/Looked-DH is a virus for the Windows platform.

When first run W32/Looked-DH unsuccessfully copies itself to:

<Current>\<original filename>.exe
<Windows>\uninstall\rundl132.exe
<Windows>\Logo1_.exe

The above files are a corrupt version of the original and may simply 
be deleted.

W32/Looked-DH creates the following registry entry to start itself:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)