Tillbaka till svenska Fidonet
English   Information   Debug  
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4282
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   32026
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/2048
DOS_INTERNET   0/196
duplikat   6002
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33877
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   23979
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12852
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4357
FN_SYSOP   41651
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13596
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16066
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22070
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   920
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4786
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1121
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   3169
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13225
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2056
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
Möte VIRUS_INFO, 201 texter
 lista första sista föregående nästa
Text 55, 2339 rader
Skriven 2005-05-21 13:32:00 av KURT WISMER (1:123/140)
Ärende: News, May 21 2005
=========================
[cut-n-paste from sophos.com]

Name   W32/Netsky-C

Type  
    * Worm

Aliases  
    * I-Worm.Moodown.c
    * Win32/Netsky.C
    * W32.Netsky.C@mm
    * WORM_NETSKY.C

Prevalence (1-5) 3

Description
W32/Netsky-C is a worm which spreads via shared networks and by emailing 
itself to addresses found within files located on drives C: to Z:.

The email subject line, message text and attachment filename are 
randomly chosen from lists within the worm.

The name of the attached file is chosen from:

associal, msg, yours, doc, wife, talk, message, response,
creditcard, description, details, attachment, pic, me, trash,
card, stuff, poster, posting, portmoney, textfile, moonlight,
concert, sexy, information, news, note, number_phone, bill,
mydate, swimmingpool, class_photos, product, old_photos, topseller,
ps, important, shower, myaunt, aboutyou, yours, nomoney, birth,
found, death, story, worker, mails, letter, more, website,
regards, regid, friend, unfolds, jokes, doc_ang, your_stuff,
location, 454543403, final, schock, release, webcam, dinner,
intimate stuff, sexual, ranking, object, secrets, mail2, attach2,
part2, msg2, disco, freaky, visa, party, material, misc,
nothing, transfer, auction, warez, undefinied, violence, update,
masturbation, injection, naked1, naked2, tear, music, paypal,
id, privacy, word_doc, image or incest.

The attachment extension will be ZIP, COM, EXE, PIF or SCR and may be 
preceded by .DOC, .HTM, .RTF or .TEXT. (e.g. visa.htm.scr)

When first run W32/Netsky-C copies itself to the Windows folder as 
winlogon.exe and creates the following registry entry so that 
winlogon.exe is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ICQNet
= <WINDOWS>\winlogon.exe -stealth

W32/Netsky-C spreads via file sharing networks by copying itself to 
folders on drives C: to Z: whose name contains the sub-string 'Shar', 
using a filename randomly chosen from the following list:

1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
ACDSee 9.exe
Adobe Photoshop 9 full.exe
Adobe Premiere 9.exe
Ahead Nero 7.exe
Best Matrix Screensaver.scr
Clone DVD 5.exe
Cracks & Warez Archive.exe
Dark Angels.pif
Dictionary English - France.doc.exe
DivX 7.0 final.exe
Doom 3 Beta.exe
E-Book Archive.rtf.exe
Full album.mp3.pif
Gimp 1.5 Full with Key.exe
How to hack.doc.exe
IE58.1 full setup.exe
Keygen 4 all appz.exe
Learn Programming.doc.exe
Lightwave SE Update.exe
Magix Video Deluxe 4.exe
Microsoft Office 2003 Crack.exe
Microsoft WinXP Crack.exe
MS Service Pack 5.exe
Norton Antivirus 2004.exe
Opera.exe
Partitionsmagic 9.0.exe
Porno Screensaver.scr
RFC Basics Full Edition.doc.exe
Screensaver.scr
Serials.txt.exe
Smashing the stack.rtf.exe
Star Office 8.exe
Teen Porn 16.jpg.pif
The Sims 3 crack.exe
Ulead Keygen.exe
Virii Sourcecode.scr
Visual Studio Net Crack.exe
Win Longhorn Beta.exe
WinAmp 12 full.exe
Windows Sourcecode.doc.exe
WinXP eBook.doc.exe
XXX hardcore pic.jpg.exe

W32/Netsky-C attempts to delete the following registry entries if they 
exist:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Taskmon
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Explorer
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAv
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAv
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\system.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\system.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\service
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Sentry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\msgsrv32
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\DELETE ME
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\D3dupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\au.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OLE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows services host
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows services host
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKLM\System\CurrentControlSet\Services\WksPatch
HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

When the worm is run on the 26th of February 2004 between 06:00 and 
09:00 it may cause the computer to beep sporadically.

The Netsky-C worm contains the following text embedded in its code:

<-<- we are the skynet - you can't hide yourself! - we kill malware 
writers (they have no chance!) - [LaMeRz-->]MyDoom.F is a thief of our 
idea! - -< SkyNet AV vs. Malware >- ->->





Name   W32/Mytob-AK

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Forges the sender's email address
    * Uses its own emailing engine

Aliases  
    * WORM_MYTOB.BT

Prevalence (1-5) 2

Description
W32/Mytob-AK is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-AK is capable of spreading through operating system 
vulnerabilities, including the LSASS (MS04-011) exploit.

W32/Mytob-AK can harvest email addresses from files on the infected 
computer and from the Windows address book.

Emails sent by the worm have the following characteristics:

Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
<blank>

Message body:
The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

The original message was included as an attachment,

Here are your bank documents

Advanced
W32/Mytob-AK is a mass-mailing worm and IRC backdoor Trojan.

W32/Mytob-AK is capable of spreading through operating system 
vulnerabilities, including the LSASS (MS04-011) exploit.

W32/Mytob-AK can harvest email addresses from files on the infected 
computer and from the Windows address book.

Emails sent by the worm have the following characteristics:

Subject line:
Error
Status
Server Report
Mail Transaction Failed
Mail Delivery System
hello
Good day
<blank>

Message body:
The message contains Unicode characters and has been sent as a binary 
attachment.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.

The original message was included as an attachment,

Here are your bank documents

W32/Mytob-AK copies itself to the Windows system folder as 
"taskgmr32.exe " and creates the following registry entries in order to 
run automatically on computer login:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK =
taskgmr32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WINTASK =
taskgmr32.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
WINTASK =
taskgmr32.exe

The worm also creates the following registry entries:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa\
WINTASK =
taskgmr32.exe

HKCU\Software\Microsoft\OLE\
WINTASK =
taskgmr32.exe

HKLM\SOFTWARE\Microsoft\Ole\
WINTASK =
taskgmr32.exe

W32/Mytob-AK copies itself to the root folder with the following 
filenames:

funny_pic.scr
my_photo2005.scr
see_this!!.scr

W32/Mytob-AK blocks access to security-related websites by writing the 
following entries to the Windows hosts file:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com

W32/Mytob-AK may create a new file detected by Sophos as W32/Mytob-D.





Name   Troj/Haxdoor-Y

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to 
an infected system.

Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and 
removal of its files.

Advanced
Troj/Haxdoor-Y is a backdoor Trojan that provides unauthorised access to 
an infected system.

Troj/Haxdoor-Y attempts to use stealthing to prevent the detection and 
removal of its files.

When the Trojan is installed the following files may be created:

&ltSYSTEM>\avpx32.dll
&ltSYSTEM>\avpx32.sys
&ltSYSTEM>\avpx64.sys
&ltSYSTEM>\p3.ini
&ltSYSTEM>\qy.sys
&ltSYSTEM>\qz.dll
&ltSYSTEM>\qz.sys

The Trojan registers AVPX32.SYS as a service process AVPX32 with display 
name "AVPX TCP". The Trojan also registers AVPX64.SYS as a driver AVPX64 
with display name "AVPX64 TCP".

The Trojan creates the following registry entries in order to run itself 
on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
DllName
61,76,70,78,33,32,2e,64,6c,6c,00

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Startup
MmMapView3

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Impersonate
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Asynchronous
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
MaxWait
1





Name   W32/Mytob-CK

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer
    * Drops more malware
    * Forges the sender's email address

Aliases  
    * WORM_MYTOB.DQ
    * W32.Mytob.R@mm
    * Net-Worm.Win32.Mytob.w

Prevalence (1-5) 2

Description
W32/Mytob-CK is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-CK may drop a file called hellmsn.exe (detected by Sophos as 
W32/Mytob-D) in the same location. This component attempts to spread the 
worm by sending the aforementioned SCR files through Windows Messenger 
to all online contacts.

W32/Mytob-CK is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011).

The following patch for the operating system vulnerability exploited by 
W32/Mytob-CK can be obtained from the Microsoft website:

LSASS (MS04-011) security vulnerability

W32/Mytob-CK is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011). Email sent by 
W32/Mytob-CK has the following properties:

Subject line:

Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
<random characters>

Message text:

'Here are your banks documents.'
'The original message was included as an attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been 
 sent as a binary attachment.'
'The message contains Unicode characters and has been sent as a binary 
 attachment.'
'Mail transaction failed. Partial message is available.'
<random characters>

The attached file consists of a base name followed by the extentions 
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions 
where the first extension is DOC, TXT or HTM and the final extension is 
PIF, SCR, EXE or ZIP.

Advanced
W32/Mytob-CK is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

When first run W32/Mytob-CK copies itself to the Windows system folder 
as taskgmr.exe and creates the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole
WINTASK
taskgmr.exe

HKCU\Software\Microsoft\Ole
WINTASK
taskgmr.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
WINTASK
taskgmr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WINTASK
taskgmr.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WINTASK
taskgmr.exe

W32/Mytob-CK may drop a file called hellmsn.exe (detected by Sophos as 
W32/Mytob-D) in the same location. This component attempts to spread the 
worm by sending the aforementioned SCR files through Windows Messenger 
to all online contacts.

W32/Mytob-CK may also appends the following to the HOSTS file to deny 
access to security related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com

W32/Mytob-CK is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011). Email sent by 
W32/Mytob-CK has the following properties:

Subject line:

Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
<random characters>

Message text:

'Here are your banks documents.'
'The original message was included as an attachment.'
'The message cannot be represented in 7-bit ASCII encoding and has been 
 sent as a binary attachment.'
'The message contains Unicode characters and has been sent as a binary 
 attachment.'
'Mail transaction failed. Partial message is available.'
<random characters>

The attached file consists of a base name followed by the extentions 
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions 
where the first extension is DOC, TXT or HTM and the final extension is 
PIF, SCR, EXE or ZIP.

W32/Mytob-CK harvests email addresses from files on the infected 
computer and from the Windows address book as well as the Microsoft 
Internet Account Manager.

The following patch for the operating system vulnerability exploited by 
W32/Mytob-CK can be obtained from the Microsoft website:

LSASS (MS04-011) security vulnerability





Name   W32/Agobot-AAZ

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information

Prevalence (1-5) 2

Description
W32/Agobot-AAZ is a network worm with backdoor Trojan functionality for 
the Windows platform.

W32/Agobot-AAZ is capable of spreading to computers on the local network 
protected by weak passwords.

The backdoor component runs continuously in the background providing 
backdoor access to the computer through IRC channels.

Advanced
W32/Agobot-AAZ is a network worm with backdoor Trojan functionality for 
the Windows platform.

W32/Agobot-AAZ is capable of spreading to computers on the local network 
protected by weak passwords.

When first run, W32/Agobot-AAZ copies itself to the Windows system 
folder as walg32.exe and creates the following registry entries to run 
itself each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Application Layer Gateway
"walg32.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows Application Layer Gateway
"walg32.exe"

The backdoor component runs continuously in the background providing 
backdoor access to the computer through IRC channels. The backdoor 
component can be instructed to perform the following functions:

harvest email addresses
steal product registration information for certain software
take part in Distributed Denial of Service (DDoS) attacks
scan networks for vulnerabilities
download/execute arbitrary files
start a proxy server (SOCKS4/SOCKS5)
start/stop system services
monitor network communications (packet sniffing)
add/remove network shares
send email
log keypresses

W32/Agobot-AAZ attempts to terminate and disable various anti-virus and 
security related programs and modifies the HOSTS file located at 
%SYSTEM%\Drivers\etc\HOSTS, mapping selected anti-virus websites to the 
loopback address 127.0.0.1 in an attempt to prevent access to these 
sites. Typically the following mappings will be appended to the HOSTS 
file:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com

W32/Agobot-AAZ attempts to terminate the following processes:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ADAWARE.EXE
ADVXDWIN.EXE
AGENTSVR.EXE
AGENTW.EXE
ALERTSVC.EXE
ALEVIR.EXE
ALOGSERV.EXE
AMON9X.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ARR.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATUPDATER.EXE
ATWATCH.EXE
AU.EXE
AUPDATE.EXE
AUTO-PROTECT.NAV80TRY.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCC32.EXE
AVGCTRL.EXE
AVGNT.EXE
AVGSERV.EXE
AVGSERV9.EXE
AVGUARD.EXE
AVGW.EXE
AVKPOP.EXE
AVKSERV.EXE
AVKSERVICE.EXE
AVKWCTl9.EXE
AVLTMAIN.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVSYNMGR.EXE
AVWIN95.EXE
AVWINNT.EXE
AVWUPD.EXE
AVWUPD32.EXE
AVWUPSRV.EXE
AVXMONITOR9X.EXE
AVXMONITORNT.EXE
AVXQUAR.EXE
BACKWEB.EXE
BARGAINS.EXE
BD_PROFESSIONAL.EXE
BEAGLE.EXE
BELT.EXE
BIDEF.EXE
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BLSS.EXE
BOOTCONF.EXE
BOOTWARN.EXE
BORG2.EXE
BPC.EXE
BRASIL.EXE
BS120.EXE
BUNDLE.EXE
BVT.EXE
CCAPP.EXE
CCEVTMGR.EXE
CCPXYSVC.EXE
CDP.EXE
CFD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
Claw95.EXE
CLAW95CF.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CLICK.EXE
CMD32.EXE
CMESYS.EXE
CMGRDIAN.EXE
CMON016.EXE
CONNECTIONMONITOR.EXE
CPD.EXE
CPF9X206.EXE
CPFNT206.EXE
CTRL.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
DATEMANAGER.EXE
DCOMX.EXE
DEFALERT.EXE
DEFSCANGUI.EXE
DEFWATCH.EXE
DEPUTY.EXE
DIVX.EXE
DLLCACHE.EXE
DLLREG.EXE
DOORS.EXE
DPF.EXE
DPFSETUP.EXE
DPPS2.EXE
DRWATSON.EXE
DRWEB32.EXE
DRWEBUPW.EXE
DSSAGENT.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
EFPEADM.EXE
EMSW.EXE
ENT.EXE
ESAFE.EXE
ESCANH95.EXE
ESCANHNT.EXE
ESCANV95.EXE
ESPWATCH.EXE
ETHEREAL.EXE
ETRUSTCIPE.EXE
EVPN.EXE
EXANTIVIRUS-CNET.EXE
EXE.AVXW.EXE
EXPERT.EXE
EXPLORE.EXE
F-AGNT95.EXE
F-AGOBOT.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FAMEH32.EXE
FAST.EXE
FCH32.EXE
FIH32.EXE
FINDVIRU.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FNRB32.EXE
FP-WIN.EXE
FP-WIN_TRIAL.EXE
FPROT.EXE
FRW.EXE
FSAA.EXE
FSAV.EXE
FSAV32.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
FSGK32.EXE
FSM32.EXE
FSMA32.EXE
FSMB32.EXE
GATOR.EXE
GBMENU.EXE
GBPOLL.EXE
GENERICS.EXE
GMT.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HBINST.EXE
HBSRV.EXE
HIJACKTHIS.EXE
HOTACTIO.EXE
HOTPATCH.EXE
HTLOG.EXE
HTPATCH.EXE
HWPE.EXE
HXDL.EXE
HXIUL.EXE
IAMAPP.EXE
IAMSERV.EXE
IAMSTATS.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IDLE.EXE
IEDLL.EXE
IEDRIVER.EXE
IEXPLORER.EXE
IFACE.EXE
IFW2000.EXE
INETLNFO.EXE
INFUS.EXE
INFWIN.EXE
INIT.EXE
INTDEL.EXE
INTREN.EXE
IOMON98.EXE
IPARMOR.EXE
IRIS.EXE
ISASS.EXE
ISRV95.EXE
ISTSVC.EXE
JAMMER.EXE
JDBGMRG.EXE
JEDI.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KAVPF.EXE
KAZZA.EXE
KEENVALUE.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
KERIO-WRP-421-EN-WIN.EXE
KERNEL32.EXE
KILLPROCESSSETUP161.EXE
LAUNCHER.EXE
LDNETMON.EXE
LDPRO.EXE
LDPROMENU.EXE
LDSCAN.EXE
LNETINFO.EXE
LOADER.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LORDPE.EXE
LSETUP.EXE
LUALL.EXE
LUAU.EXE
LUCOMSERVER.EXE
LUINIT.EXE
LUSPT.EXE
MAPISVC32.EXE
MCAGENT.EXE
MCMNHDLR.EXE
MCSHIELD.EXE
MCTOOL.EXE
MCUPDATE.EXE
MCVSRTE.EXE
MCVSSHLD.EXE
MD.EXE
MFIN32.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGAVRTCL.EXE
MGAVRTE.EXE
MGHTML.EXE
MGUI.EXE
MINILOG.EXE
MMOD.EXE
MONITOR.EXE
MOOLIVE.EXE
MOSTAT.EXE
MPFAGENT.EXE
MPFSERVICE.EXE
MPFTRAY.EXE
MRFLUX.EXE
MSAPP.EXE
MSBB.EXE
MSBLAST.EXE
MSCACHE.EXE
MSCCN32.EXE
MSCMAN.EXE
MSCONFIG.EXE
MSDM.EXE
MSDOS.EXE
MSIEXEC16.EXE
MSINFO32.EXE
MSLAUGH.EXE
MSMGT.EXE
MSMSGRI32.EXE
MSSMMC32.EXE
MSSYS.EXE
MSVXD.EXE
MU0311AD.EXE
MWATCH.EXE
N32SCANW.EXE
NAV.EXE
NAVAP.NAVAPSVC.EXE
NAVAPSVC.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVENGNAVEX15.NAVLU32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVSTUB.EXE
NAVW32.EXE
NAVWNT.EXE
NC2000.EXE
NCINST4.EXE
NDD32.EXE
NEOMONITOR.EXE
NEOWATCHLOG.EXE
NETARMOR.EXE
NETD32.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NETUTILS.EXE
NISSERV.EXE
NISUM.EXE
NMAIN.EXE
NOD32.EXE
NORMIST.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NOTSTART.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NPSCHECK.EXE
NPSSVC.EXE
NSCHED32.EXE
NSSYS32.EXE
NSTASK32.EXE
NSUPDATE.EXE
NT.EXE
NTRTSCAN.EXE
NTVDM.EXE
NTXconfig.EXE
NUI.EXE
NUPGRADE.EXE
NVARCH16.EXE
NVC95.EXE
NVSVC32.EXE
NWINST4.EXE
NWSERVICE.EXE
NWTOOL16.EXE
OLLYDBG.EXE
ONSRVR.EXE
OPTIMIZE.EXE
OSTRONET.EXE
OTFIX.EXE
OUTPOST.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PATCH.EXE
PAVCL.EXE
PAVPROXY.EXE
PAVSCHED.EXE
PAVW.EXE
PCC2002S902.EXE
PCC2K_76_1436.EXE
PCCIOMON.EXE
PCCNTMON.EXE
PCCWIN97.EXE
PCCWIN98.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCIP10117_0.EXE
PCSCAN.EXE
PDSETUP.EXE
PENIS.EXE
PERISCOPE.EXE
PERSFW.EXE
PERSWF.EXE
PF2.EXE
PFWADMIN.EXE
PGMONITR.EXE
PINGSCAN.EXE
PLATIN.EXE
POP3TRAP.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
POWERSCAN.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PRIZESURFER.EXE
PRMT.EXE
PRMVR.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
PROCEXPLORERV1.0.EXE
PROGRAMAUDITOR.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
PURGE.EXE
PUSSY.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAPAPP.EXE
RAV7.EXE
RAV7WIN.EXE
RAV8WIN32ENG.EXE
RAY.EXE
RB32.EXE
RCSYNC.EXE
REALMON.EXE
REGED.EXE
REGEDIT.EXE
REGEDT32.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCAN.EXE
RTVSCN95.EXE
RULAUNCH.EXE
RUN32DLL.EXE
RUNDLL.EXE
RUNDLL16.EXE
RUXDLL32.EXE
SAFEWEB.EXE
SAHAGENT.EXE
SAVE.EXE
SAVENOW.EXE
SBSERV.EXE
SC.EXE
SCAM32.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SCRSVR.EXE
SCVHOST.EXE
SD.EXE
SERV95.EXE
SERVICE.EXE
SERVLCE.EXE
SERVLCES.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SHOWBEHIND.EXE
SMC.EXE
SMS.EXE
SMSS32.EXE
SOAP.EXE
SOFI.EXE
SPERM.EXE
SPF.EXE
SPHINX.EXE
SPOLER.EXE
SPOOLCV.EXE
SPOOLSV32.EXE
SPYXX.EXE
SREXE.EXE
SRNG.EXE
SS3EDIT.EXE
SSG_4104.EXE
SSGRATE.EXE
ST2.EXE
START.EXE
STCLOADER.EXE
SUPFTRL.EXE
SUPPORT.EXE
SUPPORTER5.EXE
SVC.EXE
SVCHOSTC.EXE
SVCHOSTS.EXE
SVSHOST.EXE
SWEEP95.EXE
SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
SYMPROXYSVC.EXE
SYMTRAY.EXE
SYSEDIT.EXE
SYSTEM.EXE
SYSTEM32.EXE
SYSUPD.EXE
TASKMG.EXE
TASKMO.EXE
TASKMON.EXE
TAUMON.EXE
TBSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS-3.EXE
TDS2-98.EXE
TDS2-NT.EXE
TEEKIDS.EXE
TFAK.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRICKLER.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
TSADBOT.EXE
TVMD.EXE
TVTMD.EXE
UNDOBOOT.EXE
UPDAT.EXE
UPDATE.EXE
UPGRAD.EXE
UTPOST.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VET32.EXE
VET95.EXE
VETTRAY.EXE
VFSETUP.EXE
VIR-HELP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC32.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCAN40.EXE
VSCENU6.02D30.EXE
VSCHED.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBDAV.EXE
WEBSCANX.EXE
WEBTRAP.EXE
WFINDV32.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
WIMMUN32.EXE
WIN-BUGSFIX.EXE
WIN32.EXE
WIN32US.EXE
WINACTIVE.EXE
WINDOW.EXE
WINDOWS.EXE
WININETD.EXE
WININIT.EXE
WININITX.EXE
WINLOGIN.EXE
WINMAIN.EXE
WINNET.EXE
WINPPR32.EXE
WINRECON.EXE
WINSERVN.EXE
WINSSK32.EXE
WINSTART.EXE
WINSTART001.EXE
WINTSK32.EXE
WINUPDATE.EXE
WKUFIND.EXE
WNAD.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WUPDATER.EXE
WUPDT.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZONALM2601.EXE
ZONEALARM.EXE

W32/Agobot-AAZ will also hide all files which contain the string 'soun'.





Name   W32/Rbot-RF

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.Rbot.gen
    * W32/Sdbot.worm.gen.j
    * WORM_SPYBOT.HF

Prevalence (1-5) 2

Description
W32/Rbot-RF is a network worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-RF spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

W32/Rbot-RF can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-RF can be instructed by a remote user 
to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)

Advanced
W32/Rbot-RF is a network worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-RF spreads using a variety of techniques including exploiting 
weak passwords on computers and SQL servers, exploiting operating system 
vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using 
backdoors opened by other worms or Trojans.

W32/Rbot-RF can be controlled by a remote attacker over IRC channels. 
The backdoor component of W32/Rbot-RF can be instructed by a remote user 
to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)

The worm copies itself to a file named WindowsSP.exe in the Windows 
system folder and creates the following registry entries:

HKCU\Software\Microsoft\OLE
Microsoft Service Pack
"WindowsSP.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Service Pack
"WindowsSP.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Service Pack
"WindowsSP.exe"

Patches for the operating system vulnerabilities exploited by 
W32/Rbot-RF can be obtained from Microsoft at:

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx





Name   W32/Kassbot-D

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information

Aliases  
    * Backdoor.Win32.Delf.zq

Prevalence (1-5) 2

Description
W32/Kassbot-D is a network worm with backdoor functionality for the 
Windows platform.

The backdoor component joins a predetermined IRC channel and awaits 
further commands from remote attackers.

W32/Kassbot-D monitors internet sessions and begins logging keypresses 
when it detects traffic to certain banking websites.

Advanced
W32/Kassbot-D is a network worm with backdoor functionality for the 
Windows platform.

When run, W32/Kassbot-D copies itself to the Windows system folder as 
spools.exe and sets the following registry entry in order to run each 
time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Spools Service Controller
<Windows system folder>\spools.exe

W32/Kassbot-D drops a helper file to the Windows system folder as 
xee32.dll. Sophos's anti-virus products detect xee32.dll as 
W32/Kassbot-C.

The backdoor component joins a predetermined IRC channel and awaits 
further commands from remote attackers. The backdoor can be instructed 
to perform various tasks, including:

-start a proxy server
-take part in distributed denial of service (DDoS) attacks
-download and execute arbitrary files
-download updated copies of itself
-monitor internet sessions for visits to certain banking websites
-log keypresses
-serve as an email relay, allowing remote users the ability to route 
 email through the infected computer
-list/terminate processes
-redirect HTTP requests to alternate sites
-list,modify or delete files/folders
-execute arbitrary commands
-search the infected computer for specified files

To achieve the functionality of redirecting of HTTP requests, 
W32/Kassbot-D modifies the HOSTS file (typically located in <Windows 
system folder>\Drivers\etc). The worm initially appends data to the 
HOSTS file which prevents access to the following domains, though it can 
be instructed to append additional data via backdoor commands:

barclays.co.uk
d-eu-1f.kaspersky-labs.com
d-eu-1h.kaspersky-labs.com
d-eu-2f.kaspersky-labs.com
d-eu-2h.kaspersky-labs.com
d-ru-1f.kaspersky-labs.com
d-ru-1h.kaspersky-labs.com
d-ru-2f.kaspersky-labs.com
d-ru-2h.kaspersky-labs.com
d-us-1f.kaspersky-labs.com
d-us-1h.kaspersky-labs.com
downloads1.kaspersky.ru
downloads2.kaspersky.ru
downloads3.kaspersky.ru
downloads4.kaspersky.ru
downloads5.kaspersky.ru
hsbc.co.uk
ibank.barclays.co.uk
kaspersky-labs.com
kaspersky.ru
lloydstsb.co.uk
nwolb.com
online.lloydstsb.co.uk
personal.barclays.co.uk
www.barclays.co.uk
www.hsbc.co.uk
www.kaspersky-labs.com
www.kaspersky.ru
www.lloydstsb.co.uk
www.lloydstsb.com
www.nwolb.com

W32/Kassbot-D monitors internet sessions and begins logging keypresses 
when it detects traffic to any URLs containing the following strings:

194.145.64.98
amfederal
apobank.de
bank.eldersruralbank.com.au
banking.apobank.de
banking.apobank.de
banking.bankhaus-mayer.de
banking.bmwbank.de
banking.bw-bank.de
banking.cc-bank.de
banking.degussa-bank.de
banking.diba.de
banking.donner.de
banking.elba.at
banking.europace.ie
banking.hypo.at
banking.ing-diba.at
banking.martinbank.de
banking.privatbank.at
banking.raiffeisen.at
banking.santander.de
banking.seb.de
banking.vkb-bank.at
baufinanzierung.dslbank.de
billscenter.paytrust.com
bob.bankwest.com.au
brokerage.comdirect.de
cash.rin.ru
creditplus.de
davis-company.com
dfbonline.deutsche-factoring.de
dws-direkt.deutsche-bank.de
e-bank.feibbank.com
e-bank.wuestenrot.de
ebank.laiki.com
ebanker.arabbank.com.au
ebanking.bawag.com
ebanking.bgl.lu
ern.nnctx.com.ru
etimebanker.bankofthewest.com
ewm.ubs.com
fiservdmecom
fnc.asbbank.co.nz
hbci-banking.allbank.de
homebank.tsbbank.co.nz
ib.national.com.au
ib2.inetbank.net.au
ibank.stgeorge.com.au
inetbnkp.adelaidebank.com.au
internetbanking.gad.de
internetbanking.suncorpmetway.com.au
investing.schwab.com
konto.xcom-bank.de
leu.directnet.com
mbk.rbc.ru
mein.raiffeisen.at
my.banklenz.de
my.hypovereinsbank.de
my.ingretirementplans.com
netbanking.sozialbank.de
noname.de
olb.westpac
online-banking.weberbank.de
online-service.allianz.de
online.btfunds.com.au
online.westpac.com.au
onlineservices.amp.com.au
personal.macquarie.com.au
portal01.commerzbanking.de
portal1.izb.de
privatebanking.debema.de
privatkunden.union-investment.de
sec.westpac.co.nz
secure.accu.com.au
secure.americanfederal.net
secure.bankone.com.au
secure.dnetz-b2b.de
secure.easy-car-credit.de
secure.nationalinterbank.com
secure.rabobank.com.au
services.credit-suisse.de
ssl.4alpha.de
sso.americanexpress.com
swkbank.de
union-investment.de
uniservices3.uobgroup.com
upib.unionplanters.com
web.cplnn.com
web.da-us.citibank.com
webbank.standardchartered.com
wertpapier.schwaebische-bank.de
ww2.homebanking-berlin.de
www.abnamrofutures.com
www.amazon.com
www.americanexpress.com
www.anb.com.sa
www.anz.com
www.asia.citibank.com
www.axabanque.fr
www.bacaf.at
www.bamernet.hn
www.banco-general.com
www.banking.co.at
www.bankingonline.de
www.bankofindia.com
www.bankone.com
www.bankone.com.au
www.banpais.hn
www.barclaycard.de
www.bendigobank.com.au
www.berenbergbank.de
www.bks-banking.at
www.blcdirect.banquelaurentienne.ca
www.bnz.co.nz
www.boq.com.au
www.bv-activebanking.de
www.cashcards.net
www.cebit.de
www.cetelem.de
www.cetelembank.de
www.citibank.com.au
www.cortalconsors.de
www.creditmutuel.fr
www.daimlerchrysler-bank.com
www.dhbbank.com
www.dresdner-privat.de
www.dslstar.de
www.e-gold.com
www.ebank.hsbc.co.nz
www.ebankinter.com
www.efirstbank.com
www.eservices.baj.com.sa
www.fcb-e-bank.com
www.fh-vie.ac.at
www.firstbanks.com
www.fiservdmecom1.net
www.fiservdmecom1.net
www.fiservla3.com
www.generalibank.at
www.global-banking.de
www.goldpouchexpress.com
www.hoernerbank.de
www.kiwibank.co.nz
www.loyalbank.com
www.midamericabank.com
www.mmgbank.com
www.myaxa.de
www.national-bank.de
www.ncrbanks.com
www.necu.com.au
www.netbank-money.de
www.netbanking.at
www.oberbank-banking.at
www.portal-banking.de
www.regions.com
www.sabadellatlantico.com
www.saradar.com
www.servicebank.at
www.site-secure.com
www.southtrust.com
www.sovereign.com
www.superbank.co.nz
www.usbank.com
www.visionsfcu.com
www.vr-ebanking.de
www.vr-networld-ebanking.de
www.westlbmarkets.net
www.winweb.seceti.it
www.wsk-bank.at
www0.advisernet.com.au
www1.internet-trading1.com
www1.netbank.commbank.com.au
www2.bankingonline.de





Name   W32/Mytob-BZ

Type  
    * Worm

How it spreads  
    * Email attachments
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer
    * Steals information
    * Drops more malware

Prevalence (1-5) 2

Description
W32/Mytob-BZ is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

W32/Mytob-BZ is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011).

W32/Mytob-BZ harvests email addresses from files on the infected 
computer and from the Windows address book.

Advanced
W32/Mytob-BZ is a mass-mailing worm and backdoor Trojan that can be 
controlled through the Internet Relay Chat (IRC) network.

When first run W32/Mytob-BZ copies itself to the Windows system folder 
as taskgmr.exe and creates the following registry entries:

HKCU\System\CurrentControlSet\Control\Lsa
W1NTASK
taskgmr.exe

HKCU\Software\Microsoft\OLE
W1NTASK
taskgmr.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
W1NTASK
taskgmr.exe

HKLM\System\CurrentControlSet\Control\Lsa
W1NTASK
taskgmr.exe

HKLM\Software\Microsoft\Ole
W1NTASK
taskgmr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
W1NTASK
taskgmr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
W1NTASK
taskgmr.exe

W32/Mytob-BZ copies itself to the root folder as:

funny_pic.scr
my_photo2005.scr
see_this!!.scr

and drops a file called hellmsn.exe (detected by Sophos as W32/Mytob-D) 
in the same location. This component attempts to spread the worm by 
sending the aforementioned SCR files through Windows Messenger to all 
online contacts.

W32/Mytob-BZ also appends the following to the HOSTS file to deny access 
to security related websites:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.trendmicro.com

W32/Mytob-BZ is capable of spreading through email and through various 
operating system vulnerabilities such as LSASS (MS04-011). Email sent by 
W32/Mytob-BZ has the following properties:

Subject line:

document
Good day
Mail Delivery System
Mail Transaction Failed
message
readme
Server Report
Status

Message text:

'This is a multi-part message in MIME format.'

'Mail transaction failed. Partial message is available.'

'The message contains Unicode characters and has been sent as a binary 
attachment.'

'The message cannot be represented in 7-bit ASCII encoding and has been 
sent as a binary attachment.'

'The original message was included as an attachment.'

'Here are your banks documents.'

The attached file consists of a base name followed by the extentions 
PIF, SCR, EXE or ZIP. The worm may optionally create double extensions 
where the first extension is DOC, TXT or HTM and the final extension is 
PIF, SCR, EXE or ZIP.

W32/Mytob-BZ harvests email addresses from files on the infected 
computer and from the Windows address book. The worm avoids sending 
email to addresses that contain the following:

.gov
.mil
accoun
acketst
admin
anyone
arin.
avp
berkeley
borlan
bsd
bsd
bugs
ca
certific
contact
example
feste
fido
foo.
fsf.
gnu
gold-certs
google
google
gov.
help
iana
ibm.com
icrosof
icrosoft
ietf
info
inpris
isc.o
isi.e
kernel
linux
linux
listserv
math
me
mit.e
mozilla
mydomai
no
nobody
nodomai
noone
not
nothing
ntivi
page
panda
pgp
postmaster
privacy
rating
rfc-ed
ripe.
root
ruslis
samples
secur
sendmail
service
site
soft
somebody
someone
sopho
submit
support
syma
tanford.e
the.bat
unix
unix
usenet
utgers.ed
webmaster
you
your





Name   Troj/Vidlo-J

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Vidlo.m
    * Downloader-AAP

Prevalence (1-5) 2

Description
Troj/Vidlo-J is a downloading Trojan for the Windows platform that 
downloads from a predefined web location a prev.exe file detected by 
Sophos's anti-virus products as Troj/Dloader-NN

Advanced
Troj/Vidlo-J is a downloading Trojan for the Windows platform that 
downloads from a predefined web location a prev.exe file detected by 
Sophos's anti-virus products as Troj/Dloader-NN.

Troj/Vidlo-J will inject its downloading code into Internet Explorer in 
an attempt to hide its activity and bypass firewalls.





Name   W32/Opanki-I

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Aliases  
    * IM-Worm.Win32.Opanki.b
    * WORM_OPANKI.I

Prevalence (1-5) 2

Description
W32/Opanki-I is an instant-messanging worm that attempts to spread via 
AOL Instant Messenger (AIM).

W32/Opanki-I sends the message "check out my pictures" to the infected 
user's contacts with a link to download a PIF file from 
http://redblock.co.kr. At the time of writing this file was unavailable 
for download.





Name   W32/Oscabot-F

Type  
    * Worm

How it spreads  
    * Chat programs

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * TROJ_DLOADER.LS

Prevalence (1-5) 2

Description
W32/Oscabot-F is an instant messaging worm that can exploit users of AOL 
Instant Messaging clients.

W32/Oscabot-F connects to a specific channel on an IRC service and waits 
for an attacker to instruct the bot to send messages to contacts in the 
infected user's AOL contacts list. The message will read:

"lol have you seen this?"

The word "this" is a link to the W32/Oscabot-F executable on the 
infected computer.

Advanced
W32/Oscabot-F is an instant messaging worm that can exploit users of AOL 
Instant Messaging clients.

W32/Oscabot-F connects to a specific channel on an IRC service and waits 
for an attacker to instruct the bot to send messages to contacts in the 
infected user's AOL contacts list. The message will read:

"lol have you seen this?"

The word "this" is a link to the W32/Oscabot-F executable on the 
infected computer.

When run W32/Oscabot-F copies itself to the Windows folder as a 
read-only, hidden, system file named userint32.exe.

W32/Oscabot-F then performs the following actions to run itself on user 
logon:

creates the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Manager
%WINDOWS%\userint32.exe

changes the following registry entry:

from:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe

to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe %WINDOWS%\userint32.exe

changes the following entry in %WINDOWS%\system.ini:

from:
[boot]
shell = explorer.exe

to:
[boot]
shell = Explorer.exe %WINDOWS%\userint32.exe





Name   Troj/Zapchas-J

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry

Aliases  
    * Backdoor.Win32.mIRC-based
    * Backdoor.IRC.Zapchast
    * IRC/Flood.mirc

Prevalence (1-5) 2

Description
Troj/Zapchas-J is an mIRC-based backdoor Trojan.

The Trojan creates several files in the Windows\system folder. One of 
these files, svchost.exe, is a renamed copy of the mIRC application, one 
is a mIRC script file (also detected as Troj/Zapchas-J) and the 
remainder are configuration settings for the Trojan.

Advanced
Troj/Zapchas-J is an mIRC-based backdoor Trojan.

The Trojan creates several files in the Windows\system folder. One of 
these files, svchost.exe, is a renamed copy of the mIRC application, one 
is a mIRC script file (also detected as Troj/Zapchas-J) and the 
remainder are configuration settings for the Trojan.

Troj/Zapchas-J may create the following registry entry in order to be 
automatically run at logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
GNP Generic Host Process
C:\WINNT\system\svchost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SNP Generic Host Process
C:\WINDOWS\system\svchost.exe

Troj/Zapchas-J connects to a preconfigured IRC server and joins a 
channel in which it can receive further instructions from any of a list 
of usernames specified in one of the configuration files.

Harmless files dropped in windows\system:

aliases.ini
control.ini
mirc.ico
mirc.ini
nicks.txt
remote.ini
servers.ini
sup.bat
sup.reg
users.ini





Name   Troj/Vidlo-J

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Vidlo.m
    * Downloader-AAP

Prevalence (1-5) 2

Description
Troj/Vidlo-J is a downloading Trojan for the Windows platform that 
downloads from a predefined web location a prev.exe file detected by 
Sophos's anti-virus products as Troj/Dloader-NN

Advanced
Troj/Vidlo-J is a downloading Trojan for the Windows platform that 
downloads from a predefined web location a prev.exe file detected by 
Sophos's anti-virus products as Troj/Dloader-NN.

Troj/Vidlo-J will inject its downloading code into Internet Explorer in 
an attempt to hide its activity and bypass firewalls.





Name   W32/Mytob-CJ

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Modifies data on the computer

Prevalence (1-5) 2

Description
W32/Mytob-CJ is a member of the W32/Mytob family of email worms.

Once installed, W32/Mytob-CJ attempts to logon to remote IRC servers and 
open a backdoor to allow remote commands to be executed. W32/Mytob-CJ 
also tries to download files from a remote website and run them.

W32/Mytob-CJ also terminates anti-virus and system related processes.

W32/Mytob-CJ also modifies the HOSTS file to deny access to anti-virus 
and security related websites.

W32/Mytob-CJ will harvest email addresses and server related information 
from the Windows Address Book and the Microsoft Internet Account 
Manager. Email messages sent by W32/Mytob-CJ has the following 
characteristics:

Subject line chosen from:

'Notice: **Last Warning**'

'Your email account access is restricted'

'Your Email Account is Suspended For Security Reasons'

'Notice:***Your email account will be suspended***'

'Security measures'

'Email Account Suspension'

'*IMPORTANT* Please Validate Your Email Account'

'*IMPORTANT* Your Account Has Been Locked'

'*WARNING* Your Email Account Will Be Closed'

<random characters>

Message text chosen from:

'Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.'

'To unblock your email account acces, please see the attachment.'

'Follow the instructions in the attachment.'

'We have suspended some of your email services, to resolve the problem 
you should read the attached document.'

'To safeguard your email account from possible termination, please see 
the attached file.'

'please look at attached document.'

'Account Information Are Attached!'

<random characters>

Attached filenames chosen from:

email-info
email-text
email-doc
information
your_details
document_full
INFO
IMPORTANT
info-text
<random characters>

The attached file consists of any of the abovementioned base names 
followed by the extentions PIF, SCR, EXE, CMD, BAT or ZIP. The worm may 
optionally create double extensions where the first extension is DOC, 
TXT or HTM and the final extension is PIF, SCR, EXE, CMD, BAT or ZIP.

Advanced
W32/Mytob-CJ is a member of the W32/Mytob family of email worms.

In order to run automatically W32/Mytob-CJ copies itself to the file 
sky.exe.exe in the Windows system folder and creates the following 
registry entries to run itself on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WINDOWS SKY
sky.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
WINDOWS SKY
sky.exe

The worm also changes the following registry entry from its default 
Windows setting:

from:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000003

to:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
dword:00000004

W32/Mytob-CJ will harvest email addresses and server related information 
from the Windows Address Book and the Microsoft Internet Account 
Manager. Email messages sent by W32/Mytob-CJ has the following 
characteristics:

Subject line chosen from:

'Notice: **Last Warning**'

'Your email account access is restricted'

'Your Email Account is Suspended For Security Reasons'

'Notice:***Your email account will be suspended***'

'Security measures'

'Email Account Suspension'

'*IMPORTANT* Please Validate Your Email Account'

'*IMPORTANT* Your Account Has Been Locked'

'*WARNING* Your Email Account Will Be Closed'

<random characters>

Message text chosen from:

'Once you have completed the form in the attached file , your account 
records will not be interrupted and will continue as normal.'

'To unblock your email account acces, please see the attachment.'

'Follow the instructions in the attachment.'

'We have suspended some of your email services, to resolve the problem 
you should read the attached document.'

'To safeguard you