Tillbaka till svenska Fidonet
English   Information   Debug  
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4275
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   27601
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/1974
DOS_INTERNET   0/196
duplikat   5999
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33771
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   23435
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12841
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4155
FN_SYSOP   41520
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13554
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16041
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22002
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   894
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4779
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1117
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   2626
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13029
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2055
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
Möte VIRUS_INFO, 201 texter
 lista första sista föregående nästa
Text 189, 1093 rader
Skriven 2007-05-20 18:53:00 av KURT WISMER
Ärende: News, May 20 2007
=========================
[cut-n-paste from sophos.com]

Name   Troj/ConHook-AE

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Drops more malware
    * Installs itself in the Registry
    * Monitors browser activity
    * Installs a browser helper object

Aliases  
    * TROJ_AGENT.AAFS

Prevalence (1-5) 3

Description
Troj/ConHook-AE is a Trojan for the Windows platform.

Advanced
Troj/ConHook-AE is a Trojan for the Windows platform.

Troj/ConHook-AE includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/ConHook-AE is installed it creates the file 
<System>\<random>.dll

The DLL is detected as Troj/ConHook-AD.

The following registry entries are created to run code exported by 
<random>..dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\<random>
Dllname
<random>

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\<random>
Impersonate
0

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\<random>
Startup
NotifyStartup

The DLL is registered as a COM object and Browser Helper Object (BHO) 
for Microsoft Internet Explorer, creating registry entries under:

HKCR\CLSID\d3d60adf-7d3b-491c-9a78-0f1b085593f6
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objects\d3d60adf-7d3b-491c-9a78-0f1b085593f6

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\DNIdent
(default)
d3d60adf-7d3b-491c-9a78-0f1b085593f6

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\afc3c84e3b





Name   Troj/Zlobmi-B

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Zlobmi-B is a Trojan for the Windows platform.

Advanced
Troj/Zlobmi-B is a Trojan for the Windows platform.

When Troj/Zlobmi-B is installed the following files are created:

<Current Folder>\bpmini.exe
<Current Folder>\bpvol.dll

The following registry entry is created to run Troj/Zlobmi-B on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
user32.dll
<pathname of the Trojan executable>

The file bpvol.dll is registered as a COM object and Browser Helper 
Object (BHO) for Microsoft Internet Explorer, creating registry 
entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser 
Helper Objects\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9

Troj/Zlobmi-B changes search settings for Microsoft Internet Explorer 
by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Search\





Name   Troj/Banker-EGG

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information

Prevalence (1-5) 2

Description
Troj/Banker-EGG is an internet banking Trojan for the Windows platform.

Advanced
Troj/Banker-EGG is an internet banking Trojan for the Windows platform.

When first run Troj/Banker-EGG copies itself to the Windows system 
folder.





Name   W32/Stration-FW

Type  
    * Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Stration-FW is a worm for the Windows platform.

Advanced
W32/Stration-FW is a worm for the Windows platform.

When W32/Stration-FW is installed the following files are created:

<System>\diagisr.dll
<System>\isrprf32.dll
<System>\isrprov.exe

The file diagisr.dll is detected as W32/Strati-Gen.

The following registry entries are created to run W32/Stration-FW on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
himem.exe
<pathname of the worm executable> -s

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SoundMnEx32
<pathname of the worm executable>

The following registry entry is set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewall
Policy\StandardProfile\AuthorizedApplications\List
<pathname of the worm executable>
<Current Folder>\<original filename>:*:Enabled:SystemVersion





Name   W32/Dundun-A

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Prevalence (1-5) 2

Description
W32/Dundun-A is a parasitic virus for the Windows platform.

When run the virus will attempt to infect executable files as they 
are launched.





Name   W32/Stap-C

Type  
    * Worm

How it spreads  
    * Email messages
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Uses its own emailing engine
    * Installs itself in the Registry

Aliases  
    * Net-Worm.Win32.Stap.d
    * WORM_YOURIP.E

Prevalence (1-5) 2

Description
W32/Stap-C is a worm for the Windows platform.

W32/Stap-C has the functionalities to:

 - spread by network shares
 - send mail to email addresses found on the infected computer

Advanced
W32/Stap-C is a worm for the Windows platform.

W32/Stap-C has the functionalities to:

 - spread by network shares
 - send mail to email addresses found on the infected computer

When first run W32/Stap-C copies itself to:

<Root>\Chikka.exe
<Startup>\Office_viewer.exe
<Program Files>\Versekulo\readme.exe
<Program Files>\Versekulo\src.dll
<Program Files>\Versekulo\verse.exe
<Program Files>\Versekulo\wers.ocx
<Program Files>\msdtc.exe
<Root>\kernel32.exe
<Root>\Yahoo Mgr 2.0_zip.exe
<Root>\Star Wars_zip
<Root>\Pictures_zip
<Root>\Yahoo Mgr 2.0_zip
<Root>\Zuma DEluxe 1.0_zip
<Root>\The Mystery_zip

and creates the file <Root>\plog.tmp. This file can be deleted.

The following registry entry is created to run kernel32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Mstask
<Root>\kernel32.exe

Registry entries are created under:

HKLM\SOFTWARE\Microsoft





Name   Troj/Glibma-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Drops more malware

Aliases  
    * Virus.VBS.Small.g

Prevalence (1-5) 2

Description
Troj/Glibma-A is a Trojan for the Windows platform.

Advanced
Troj/Glibma-A is a Trojan for the Windows platform.

When Troj/Glibma-A is installed it creates the following files in the 
<Windows>\system folder:

cscript.exe
Hd.vbs
gm.BAT
gm.vbe

The file cscript.exe is a clean executable file, while the other 
files are all also detected as Troj/Glibma-A.

Troj/Glibma-A attempts to find and modify files with the following 
extensions:

ASP
HTML
HTM
PHP

Modified files are detected as Troj/Glibif-A and will attempt to run 
a script from a remote location.





Name   W32/Rbot-GQK

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Prevalence (1-5) 2

Description
W32/Rbot-GQK is a worm and IRC backdoor for the Windows platform.

Advanced
W32/Rbot-GQK is a worm and IRC backdoor for the Windows platform.

W32/Rbot-GQK spreads to other network computers by exploiting common 
buffer overflow vulnerabilities, including: LSASS (MS04-011) and 
RPC-DCOM (MS04-012).

W32/Rbot-GQK runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-GQK copies itself to <System>\pwjbvphi.exe.

The following registry entry is created to run <System>\pwjbvphi.exe 
on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows
pwjbvphi.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Windows
pwjbvphi.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows
pwjbvphi.exe





Name   W32/Sdbot-DES

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.bib

Prevalence (1-5) 2

Description
W32/Sdbot-DES is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Sdbot-DES runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Sdbot-DES is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Sdbot-DES runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Sdbot-DES copies itself to <Windows>\sysvrs32.exe 
and creates the file <Temp>\uia3.tmp.

The file sysvrs32.exe is registered as a new system driver service 
named "Server VSS System", with a display name of "Server VSS System" 
and a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Server VSS System





Name   W32/Sohana-W

Type  
    * Worm

How it spreads  
    * Removable storage devices
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * IM-Worm.Win32.Sohanad.ao
    * W32/YahLover.worm
    * WORM_SOHANAD.BA

Prevalence (1-5) 2

Description
W32/Sohana-W is a worm for the Windows platform.

Advanced
W32/Sohana-W is a worm for the Windows platform.

W32/Sohana-W spreads to other network computers and by copying itself 
to removable storage devices.

W32/Sohana-W includes functionality to access the internet and 
communicate with a remote server via HTTP. The worm also includes 
functionality to download, install and run new software.

When first run W32/Sohana-W copies itself to:

<Windows>\SSCVIHOST.exe
<System>\SSCVIHOST.exe
<System>\blastclnnn.exe

and creates the following files:

<System>\autorun.ini - Also detected as W32/Sohana-W
<System>\setting.ini - dat file, may simply be deleted
<Windows>\Tasks\At1.job - dat file, may simply be deleted

W32/Sohana-W may also attempt to download and execute the following 
files:

example.eex - detected as Troj/Havar-A
nhatquanglan15.exe - detected as Perfect Keylogger
test.exe - detected as Troj/VB-DUW

The following registry entry is created to run SSCVIHOST.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Yahoo Messengger
<System>\SSCVIHOST.exe

The following registry entry is changed to run SSCVIHOST.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe SSCVIHOST.exe

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

The following registry entries are set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NofolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawle
r\Shares
shared
\New Folder.exe





Name   W32/Stration-NZ

Type  
    * Worm

How it spreads  
    * Email messages
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Warezov.nz
    * W32/Warezov.gen4

Prevalence (1-5) 2

Description
W32/Stration-NZ is a worm for the Windows platform which spreads via 
email.

Advanced
W32/Stration-NZ is a worm for the Windows platform which spreads via 
email.

W32/Stration-NZ includes functionality to silently download, install 
and run new software.

When W32/Stration-NZ is installed the following files are created:

<System>\certmsje.dll
<System>\dpl1npwm.dat
<System>\dpl1npwm.dll
<System>\dpl1npwm.exe
<System>\psapuman.exe
<System>\psnppack.dll

The files certmsje.dll, psapuman.exe and psnppack.dll are detected as 
W32/Strati-Gen.

The following registry entries are created to run code exported by 
dpl1npwm.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\dpl1npwm
DllName
<System>\dpl1npwm.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\dpl1npwm
Startup
WlxStartupEvent

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\dpl1npwm
Impersonate
0





Name   W32/Fujacks-AJ

Type  
    * Worm

How it spreads  
    * Removable storage devices
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Worm.Win32.Fujack.a
    * Win32/Fujacks.L
    * WORM_FUJACKS.AT

Prevalence (1-5) 2

Description
W32/Fujacks-AJ is a worm for the Windows platform.

W32/Fujacks-AJ spreads to network shares and removable storage 
devices with the filename setup.exe. W32/Fujacks-AJ also creates the 
file autorun.inf to ensure that the file setup.exe is executed.

Advanced
W32/Fujacks-AJ is a worm for the Windows platform.

W32/Fujacks-AJ spreads to network shares and removable storage 
devices with the filename setup.exe. W32/Fujacks-AJ also creates the 
file autorun.inf to ensure that the file setup.exe is executed.

W32/Fujacks-AJ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Fujacks-AJ includes functionality to access the internet and 
communicate with a remote server via HTTP.

W32/Fujacks-AJ appends an HTML Iframe tag to HTML and ASP files. 
These modified files are detected as Troj/Fujif-Gen. W32/Fujacks-AJ 
may drop the file Desktop_.ini (which may simply be deleted) in 
various folders.

When first run W32/Fujacks-AJ copies itself to 
<System>\drivers\CTMONTv.exe.

The following registry entry is created to run W32/Fujacks-AJ on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svcshare
<System>\drivers\CTMONTv.exe

The following registry entry is modified to hide W32/Fujacks-AJ, in 
an attempt to make removal difficult:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ 
Advanced\Folder\Hidden\SHOWALL
CheckedValue
0

The following registry entry tree is removed by W32/Fujacks-AJ in 
order to reduce system security:

HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\





Name   W32/Whld-C

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files
    * Web downloads

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Reduces system security

Prevalence (1-5) 2

Description
W32/Whld-C is a virus for the Windows platform.

W32/Whld-C spreads by infecting Windows executable files and copying 
itself to network shares.

Advanced
W32/Whld-C is a virus for the Windows platform.

W32/Whld-C spreads by infecting Windows executable files and copying 
itself to network shares.

When first run W32/Whld-C may create the files <Current>\Server.exe 
and <System>\IME\svchost.exe which are also detected as W32/Whld-C.

W32/Whld-C attempts to turn off System File Checking to prevent 
infected Windows files being reported.





Name   W32/VB-DUX

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Aliases  
    * Virus.Win32.VB.dx

Prevalence (1-5) 2

Description
W32/VB-DUX is a worm for the Windows platform.





Name   W32/Looked-DE

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Looked-DE is a virus for the Windows platform.

Advanced
W32/Looked-DE is a virus for the Windows platform.

W32/Looked-DE spreads by infecting executable files and copying 
itself to network shares protected by weak passwords.

When W32/Looked-DE is installed the following files are created:

<Windows>\RichDll.dll
<Windows>\uninstall\rundl132.exe

These files are also detected as W32/Looked-DE.

The following registry entry is created to run rundl132.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe





Name   Troj/Hiload-E

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security

Prevalence (1-5) 2

Description
Troj/Hiload-E is a Trojan for the Windows platform.

Advanced
Troj/Hiload-E is a Trojan for the Windows platform.

Troj/Hiload-E includes functionality to access the internet and 
communicate with a remote server via HTTP, and attempts to download 
and execute further files.

Troj/Hiload-E attempts to steal password information from the 
infected computer.

When first run Troj/Hiload-E copies itself to <Windows>\<random 
name>.exe and creates the following files:

<Windows>\new_drv.sys

The file new_drv.sys is detected as Troj/RKProc-Fam and is used to 
stealth files, processes and registry entries related to Troj/Hiload-E.

Troj/Hiload-E attempts to inject code into other processes in order 
to download and execute files from remote locations.





Name   W32/Rbot-GPM

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Rbot-GPM is a worm with IRC backdoor functionality for the 
Windows platform.

Advanced
W32/Rbot-GPM is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Rbot-GPM runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Rbot-GPM copies itself to <Windows>\msnserver.exe.

The following registry entries are created to run msnserver.exe on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Svchost local services
msnserver.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Svchost local services
msnserver.exe

The following registry entry is set:

HKCU\Software\Microsoft\OLE
Microsoft Svchost local services
msnserver.exe





Name   W32/Brontok-DI

Type  
    * Worm

How it spreads  
    * Email messages

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Brontok-DI is a worm for the Windows platform.

Advanced
W32/Brontok-DI is a worm for the Windows platform.

When first run W32/Brontok-DI copies itself to:

<Startup>\Empty.pif
<Root>\FuckD3w4.exe
<Windows>\FuckD3w4.exe
<System>\IExplorer.exe
<System>\MrHelloween.scr
<System>\shell.exe

and creates the file <Root>\PuisiKu.txt.

The following registry entry is created to run FuckD3w4.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
FuckD3w4
<Windows>\FuckD3w4.exe

The following registry entries are changed to run W32/Brontok-DI on 
startup:

HKCU\Control Panel\Desktop
SCRNSAVE.EXE
<System>\MRHELL~1.SCR

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "<System>\IExplorer.exe"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<System>\IExplorer.exe

The following registry entries are set or modified, so that shell.exe 
is run when files with extensions of BAT, COM, EXE and PIF are 
opened/launched:

HKCR\lnkfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\batfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\comfile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\exefile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

HKCR\piffile\shell\open\command
(default)
<System>\shell.exe" "%1" %*

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoFolderOptions
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableTaskMgr
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableRegistryTools
0

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableConfig
0

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableSR
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
LimitSystemRestoreCheckpointing
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
DisableMSI
0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Debugger
<System>\Shell.exe





Name   W32/SillyFD-AC

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Delf.bs

Prevalence (1-5) 2

Description
W32/SillyFD-AC is a worm for the Windows platform.

Advanced
W32/SillyFD-AC is a worm for the Windows platform.

W32/SillyFD-AC includes functionality to download, install and run 
new software.

When first run W32/SillyFD-AC copies itself to <System>\servet.exe 
and creates the file <System>\Deleteme.bat.

The file servet.exe is registered as a new system driver service 
named "WindowsDown", with a display name of "Windows Ins" and a 
startup type of automatic, so that it is started automatically during 
system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\WindowsDown

W32/SillyFD-AC spreads via removeable shared drives by creating the 
file autorun.inf and a copy of the worm (named servet.exe) on the 
removeable drive.

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)