Tillbaka till svenska Fidonet
English   Information   Debug  
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/3879
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   26524
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/1115
DOS_INTERNET   0/196
duplikat   5204
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   30286
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   14613
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12240
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   2451
FN_SYSOP   38915
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/11291
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/15570
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/20274
LINUX_BBS   0/957
mail   4.97
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   682
N203_SYSCHAT   313
NET203   319
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/785
OS2DOSBBS   0/579
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4400
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1063
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   8
R20_CHAT   0/886
R20_DEPP   0/3
R20_DEV   397
R20_ECHO2   1375
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   713
R20_INTERNET   0/12940
R20_INTRESSE   0/52
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   38
R20_KANDIDAT   24
R20_KOM_DEV   112
R20_KONTROLL   0/10436
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   75
R20_NET200   241
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/33
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   3
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/1963
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
Möte VIRUS_INFO, 201 texter
 lista första sista föregående nästa
Text 201, 820 rader
Skriven 2007-08-11 16:23:00 av KURT WISMER
Ärende: News, August 11 2007
============================
[cut-n-paste from sophos.com]

Name   Troj/IRCBot-XD

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.IRCBot.acd
    * BKDR_IRCBOT.AIH

Prevalence (1-5) 2

Description
Troj/IRCBot-XD is a Trojan for the Windows platform.

Advanced
Troj/IRCBot-XD is a Trojan for the Windows platform.

When first run Troj/IRCBot-XD copies itself to <System>\libcinet.exe 
and creates the file <System>\libwinets.dll. This file is also detected 
as Troj/IRCBot-XD. The Trojan also creates the file egos.txt, where 
information taken from the clipboard and from the keylogging component 
is stored. This file may be safely deleted.

The following registry entry is created to run code exported by a 
random CLSID linked to the file libwinets.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoa
d
printers
<random CLSID>

The file libwinets.dll is registered as a COM object, creating registry 
entries under:

HKCR\CLSID\<random CLSID>





Name   W32/SillyFDC-AQ

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Prevalence (1-5) 2

Description
W32/SillyFDC-AQ is a worm for the Windows platform.

Advanced
W32/SillyFDC-AQ is a worm for the Windows platform.

When run W32/SillyFDC-AQ copies itself to <Startup>\systemnt.exe and 
<System>\mslogon.exe.

W32/SillyFDC-AQ spreads via removable shared drives, copying itself to 
<Root>\Toy.exe as a hidden, system file and creating the file 
<Root>\autorun.inf so that the worm runs when the removable media is 
plugged into an uninfected computer. The file <Root>\autorun.inf is 
also detected as W32/SillyFDC-AQ.





Name   Troj/Banker-EIK

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Banker-EIK is a Trojan for the Windows platform.

Advanced
Troj/Banker-EIK is a Trojan for the Windows platform.

The Trojan includes functionality to download, install and run new 
software.

When first installed, Troj/Banker-EIK copies itself to 
<Startup>\Wapp.exe and sets the following registry entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Wapp
<path of Trojan executable>





Name   W32/Delf-EXO

Type  
    * Spyware Worm

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Records keystrokes
    * Installs itself in the Registry
    * Installs a browser helper object

Aliases  
    * Trojan-Spy.Win32.Delf.uy

Prevalence (1-5) 2

Description
W32/Delf-EXO is a worm for the Windows platform

Advanced
W32/Delf-EXO is a worm for the Windows platform.

When first run W32/Delf-EXO copies itself to the following location :

<System>\SysInfo.dll.

Upon installation W32/Delf-EXO modifies the file autorun.inf and 
injects itself into the system process to enable autorun with 
rundll32.exe. The worm spreads with the filename SysInfo2.dll to any 
available storage devices using the file autorun.inf.

The worm creates a number of monitoring processes and inserts itself 
into explorer.exe and winlogon.exe processes.

SysInfo.DLL is also ergistered as a COM object , creating registry 
entries under:
HKCR\CLSID\{989D2FEB-5411-4565-8988-1DD2C5263377}





Name   W32/Looked-DR

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Modifies data on the computer
    * Drops more malware
    * Downloads code from the internet
    * Reduces system security
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
W32/Looked-DR is a virus and network worm for the Windows platform.

Advanced
W32/Looked-DR is a virus and network worm for the Windows platform.

W32/Looked-DR infects files found on the local computer. W32/Looked-DR 
also copies itself to remote network shares and may infect files found 
on those shares.

W32/Looked-DR includes functionality to access the internet and 
communicate with a remote server via HTTP. W32/Looked-DR may attempt to 
download and execute additional files from a remote location.

When W32/Looked-DR is installed the following files are created:

<Windows>\Logo1_.exe
<Windows>\uninstall\rundl132.exe

The files Logo1_.exe and rundl132.exe are detected as Mal/Behav-085.

The following registry entry is created to run rundl132.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load
<Windows>\uninstall\rundl132.exe

W32/Looked-DR may also create many files with the name "_desktop.ini" 
in various folders on the infected computer. These files are harmless 
text files and can be deleted.





Name   W32/Fujacks-AP

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Agent.cac

Prevalence (1-5) 2

Description
W32/Fujacks-AP is a worm for the Windows platform.

W32/Fujacks-AP runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Fujacks-AP includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Fujacks-AP is a worm for the Windows platform.

W32/Fujacks-AP runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Fujacks-AP includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Fujacks-AP copies itself to <System>\ntsokele.exe.

W32/Fujacks-AP appends an HTML Iframe tag to HTML and ASP files. These 
modified files are detected as Troj/Fujif-Fam.

The file ntsokele.exe is registered as a new system driver service 
named "Rasautol", with a display name of "Remote Help Session Manager" 
and a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Rasautol





Name   W32/Stratio-E

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Win32/Stration.XJ worm

Prevalence (1-5) 2

Description
W32/Stratio-E is a worm for the Windows platform.

W32/Stratio-E spreads by sending emails with itself as an attachment.

Advanced
W32/Stratio-E is a worm for the Windows platform.

W32/Stratio-E spreads by sending emails with itself as an attachment.

W32/Stratio-E includes functionality to access the internet and 
communicate with a remote server via HTTP.

When W32/Stratio-E is installed the following files are created:

<System>\consmsls.dll
<System>\dispregs.dll
<System>\icmuwmau.dat
<System>\icmuwmau.dll
<System>\icmuwmau.exe
<System>\vvrtusrf.exe

The files consmsls.dll, dispregs.dll, icmuwmau.dll and vvrtusrf.exe are 
detected as W32/Strati-Gen. The file icmuwmau.dat is harmless and can 
be deleted

The following registry entries are created to run code exported by 
icmuwmau.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\icmuwmau
DllName
<System>\icmuwmau.dll

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\icmuwmau
Startup
WlxStartupEvent

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\icmuwmau
Impersonate
0





Name   W32/SillyFDC-AR

Type  
    * Worm

How it spreads  
    * Removable storage devices

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/SillyFDC-AR is a worm for the Windows platform.

Advanced
W32/SillyFDC-AR is a worm for the Windows platform.

W32/SillyFDC-AR spreads via removable shared drives, copying itself to 
<Root>\<original worm filename> and creating the file 
<Root>\autorun.inf that will run the file when the removable media is 
plugged into an uninfected computer.

W32/SillyFDC-AR sets the following registry entry to run itself on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rising
<System>\<original worm filename>

W32/SillyFDC-AR also copies itself to

<Root>\<original worm filename>
<System>\<original worm filename>

and creates the file <Root>\autorun.inf. The file <Root>\Autorun.inf 
can be safely removed.





Name   Troj/PWS-AOF

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry
    * Installs a browser helper object

Prevalence (1-5) 2

Description
Troj/PWS-AOF is a Trojan for the Windows platform.

Advanced
Troj/PWS-AOF is a Trojan for the Windows platform.

Troj/PWS-AOF includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/PWS-AOF copies itself to <Program Files>\Internet 
Explorer\rksldk.bak and creates the following files:

<Common Files>\goskdl.dll
<Program Files>\Internet Explorer\rksldk.dll

The files goskdl.dll and rksldk.dll are registered as COM objects, 
creating registry entries under:

HKCR\CLSID\(5C7596CB-51CC-5BA3-BE52-6EEA62F9C51C)
HKCR\CLSID\(C1626E66-C26B-C628-E1DF-CDACCFA26EE1)
HKCR\CLSID\(DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D)

The file rksldk.dll is registered as a shell extension, creating 
registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
\
(DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D)

The file goskdl.dll is registered as a Browser Helper Object (BHO) for 
Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper 
Objects\
(C1626E66-C26B-C628-E1DF-CDACCFA26EE1)

The following registry entry is set:

HKCR\*\shellex\ContextMenuHandlers\ReliveHookDLL
(default)
(5C7596CB-51CC-5BA3-BE52-6EEA62F9C51)





Name   W32/IRCBot-XF

Type  
    * Spyware Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/IRCBot-XF is a worm for the Windows platform.

Advanced
W32/IRCBot-XF is a worm for the Windows platform.

W32/IRCBot-XF contains functionality to spread via MSN Messenger.

W32/IRCBot-XF runs continuously in the background, providing a backdoor 
server which allows a remote intruder to gain access and control over 
the computer via IRC channels.

W32/IRCBot-XF is installed the following files are created:

<User>\new.txt - May be safely deleted.
<Windows>\pictures07-01.zip - Also detected as W32/IRCBot-XF.
<System>\systesrt32.dll - Also detected as W32/IRCBot-XF.

The file systesrt32.dll is registered as a COM object, creating 
registry entries under:

HKCR\CLSID\{478DFE97-ED1E-47E4-8BFC-8F09F9F89812

The following registry entry is created to run systesrt32.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoa
d
syshelps
{478DFE97-ED1E-47E4-8BFC-8F09F9F89812}





Name   Troj/MDrop-BPQ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Prevalence (1-5) 2

Description
Troj/MDrop-BPQ is a Trojan for the Windows platform.

Advanced
Troj/MDrop-BPQ is a Trojan for the Windows platform.

When Troj/MDrop-BPQ is installed the following files are created:

<Windows>\ichan.txt
<Windows>\inv.txt
<Windows>\libparse.exe
<Windows>\login.txt
<Windows>\mcop.dll
<Windows>\os32.txt
<Windows>\ping.exe
<Windows>\pnp11.exe
<Windows>\psexec.exe
<Windows>\r.ini
<Windows>\reader.w
<Windows>\stde9.exe
<Windows>\tskdbg.exe
<Windows>\vlxd.bat
<Windows>\x89.reg

The file ping.exe is detected as Troj/Soldier-A and the file stde9.exe 
is detected as Troj/ZDown-A.

The following registry entry is created to run tskdbg.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinXPService
<Windows>\Tskdbg.exe

The following registry entries are set or modified, so that tskdbg.exe 
is run when files with extensions of CHA and IRC are opened or launched:

HKCR\ChatFile\Shell\open\command
(default)
<Windows>\tskdbg.exe

HKCR\irc\Shell\open\command
(default)
<Windows>\tskdbg.exe

Registry entries are set as follows:

HKCR\ChatFile\DefaultIcon
(default)
<Windows>\tskdbg.exe

HKCR\irc\DefaultIcon
(default)
<Windows>\tskdbg.exe

Registry entries are created under:

HKCU\Software\Microsoft\Microsoft Agent
HKCU\Software\mIRC\DateUsed
HKCR\irc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC





Name   W32/IRCBot-XG

Type  
    * Worm

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.IRCBot.acd
    * W32/IRCbot.worm.gen

Prevalence (1-5) 2

Description
W32/IRCBot-XG is a worm for the Windows platform.

Advanced
W32/IRCBot-XG is a worm for the Windows platform.

W32/IRCBot-XG includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/IRCBot-XG copies itself to <System>\msninet.exe and 
creates the following files:

<User>\aria.txt
<System>\libmsns.dll

The following registry entry is created to run code exported by 
{BED56B71-F844-4A27-82A5-56AF62D49FF4} on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoa
d
printers
{BED56B71-F844-4A27-82A5-56AF62D49FF4}

The file libmsns.dll is registered as a COM object, creating registry 
entries under:

HKCR\CLSID\{BED56B71-F844-4A27-82A5-56AF62D49FF4}





Name   Troj/Delf-EXQ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Delf-EXQ is a Trojan for the Windows platform.

Advanced
Troj/Delf-EXQ is a Trojan for the Windows platform.

When run Troj/Delf-EXQ copies itself to <User>\Favorites\netservice.exe.

Troj/Delf-EXQ then registers itself as a system service with a display 
name of "DDMP" and a service name of "netservice" and a startup type of 
automatic. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETSERVICE\

HKLM\SYSTEM\CurrentControlSet\Services\netservice\





Name   Troj/Vacdo-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * W32/Downldr2.APXC
    * PWS-Banker.dldr
    * Trojan-Downloader.Win32.Banload.zg

Prevalence (1-5) 2

Description
Troj/Vacdo-A is a Trojan for the Windows platform.

Advanced
Troj/Vacdo-A is a Trojan for the Windows platform.

Troj/Vacdo-A attempts to download and execute files from a remote 
website to the following following locations:

<Windows>\svchosts.dll
<System>\imglong.pif
<Windows>\bsyys.scr

The file svchosts.dll is currently detected as Mal/Behav-053. The file 
imglong.pif is then moved to imglong.exe, and is currently detected as 
Mal/DelpBanc-A. The file bsyys.scr is currently detected as 
W32/Vacill-A, which has been seen to send messages via instant 
messanging that contain links to a file detected as Troj/Vacdo-A.





Name   W32/Sdbot-DGR

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * W32/Backdoor.BENC
    * Backdoor.Win32.SdBot.bgc

Prevalence (1-5) 2

Description
W32/Sdbot-DGR is a network worm for the Windows platform.

Advanced
W32/Sdbot-DGR is a network worm for the Windows platform.

W32/Sdbot-DGR includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Sdbot-DGR copies itself to:

<Windows>\hkcmd.exe
<Program Files>\KaZaA\My Shared Folder\

The file hkcmd.exe is registered as a new system driver service named 
"Intel multimedia devices", with a display name of "Intel multimedia 
devices" and a startup type of automatic, so that it is started 
automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Intel multimedia devices

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

W32/Sdbot-DGR sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCScan
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
ffffff9d

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe %WINDIR%\hkcmd.exe

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center
HKLM\SOFTWARE\Symantec\LiveUpdate Admin

 
--- MultiMail/Win32 v0.43
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)