Text 96, 1693 rader
Skriven 2006-01-07 16:11:00 av KURT WISMER (1:123/140)
Ärende: News, January 7 2006
============================
[cut-n-paste from sophos.com]
Name W32/Rbot-BHQ
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.Rbot.aie
* W32/Sdbot.worm.gen.bi
Prevalence (1-5) 2
Description
W32/Rbot-BHQ is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-BHQ spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7,
Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011)
(CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware
(CAN-2003-1030), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Rbot-BHQ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Rbot-BHQ spreads:
- to other network computers infected with: Troj/Kuang, Troj/Sub7,
Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012),
WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011)
(CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware
(CAN-2003-1030), PNP (MS05-039) and ASN.1 (MS04-007)
- by copying itself to network shares protected by weak passwords
W32/Rbot-BHQ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Rbot-BHQ copies itself to <System>\windows32.exe.
The following registry entries are created to run windows32.exe on
startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update
windows32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Update
windows32.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\OLE
Microsoft Update
windows32.exe
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name Troj/Horst-C
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Forges the sender's email address
* Uses its own emailing engine
* Records keystrokes
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Horst-C is a keylogging Trojan for the Windows platform.
When run Troj/Horst-C may display a fake error message box with the
title "Version" and the message "Software incompatibility occured!
Please download another version."
Advanced
Troj/Horst-C is a keylogging Trojan for the Windows platform.
When run Troj/Horst-C may display a fake error message box with the
title "Version" and the message "Software incompatibility occured!
Please download another version."
When Troj/Horst-C is installed the following files are created:
<System>\hookreg.dll
<System>\ks.dll
<System>\wsock32.exe
The files hookreg.dll, ks.dll and wsock32.exe are also detected as
Troj/Horst-C.
wsock32.exe is a keylogger Trojan which when run periodically steals
information and sends the stolen information out via SMTP (port 25)
to a remote address. The files hookreg.dll and ks.dll are helper DLL
components used to provide keylogging functionality.
Troj/Horst-C may also create the files C:\payload.dat and
<System>\verify.dat. These files can be safely deleted.
The following registry entry is created to run wsock32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
wsock32
<System>\wsock32.exe
Name W32/Rbot-ALO
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Records keystrokes
Aliases
* WORM_RBOT.ALO
Prevalence (1-5) 2
Description
W32/Rbot-ALO is a network worm and IRC backdoor Trojan for the
Windows platform.
W32/Rbot-ALO spreads using a variety of techniques including
exploiting weak passwords on computers and SQL servers, exploiting
operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV
and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-ALO can be controlled by a remote attacker over IRC
channels. The backdoor component of W32/Rbot-ALO can be instructed by
a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
W32/Rbot-ALO will attempt to terminate processes associated with
security and anti-virus products.
Advanced
W32/Rbot-ALO is a network worm and IRC backdoor Trojan for the
Windows platform.
W32/Rbot-ALO spreads using a variety of techniques including
exploiting weak passwords on computers and SQL servers, exploiting
operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV
and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-ALO can be controlled by a remote attacker over IRC
channels. The backdoor component of W32/Rbot-ALO can be instructed by
a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
W32/Rbot-ALO will attempt to terminate processes associated with the
following filenames:
'bbeagle.exe'
'd3dupdate.exe'
'irun4.exe'
'javaw.exe'
'lsrv.exe'
'msblast.exe'
'MSBLAST.exe'
'msconfig.exe'
'mscvb32.exe'
'msnins.exe'
'navapw32.exe'
'navw32.exe'
'ndowupdate.exe'
'netstat.exe'
'PandaAVEngine.exe'
'Penis32.exe'
'rate.exe'
'rxhost.exe'
'scvhost.exe'
'scvhost32.exe'
'ssate.exe'
'svhost.exe'
'svhost32.exe'
'sys32.exe'
'sysinfo.exe'
'SysMonXP.exe'
'system32.exe'
'syswin32.exe'
'taskmon.exe'
'teekids.exe'
'wincfg32.exe'
'winlogin.exe'
'winsys.exe'
'winsys.exe'
'winsys32.exe'
'winupd.exe'
'winupdate.exe'
'winupdate32.exe'
'wuamgrd.exe'
'wuamgrd32.exe'
'wuauclt1.exe'
The worm copies itself to a file named npmsys.exe in the Windows
system folder and creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Norton Personal Firewall
"npmsys.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Norton Personal Firewall
"npmsys.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Norton Personal Firewall
"npmsys.exe"
Patches for the operating system vulnerabilities exploited by
W32/Rbot-ALO can be obtained from Microsoft at:
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx
Name W32/Sdbot-DIC
Type
* Spyware Worm
How it spreads
* Network shares
* Chat programs
* Peer-to-peer
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Deletes files off the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Aliases
* WORM_SDBOT.DIC
Prevalence (1-5) 2
Description
W32/Sdbot-DIC is a network worm with backdoor Trojan functionality
for the Windows platform.
The worm spreads through network shares protected by weak passwords,
MS-SQL servers, AOL Instant Messenger (AIM) and through various
operating system vulnerabilities such as ASN.1 (MS04-007).
W32/Sdbot-DIC connects to a predetermined IRC channel and awaits
further commands from remote users.
Advanced
W32/Sdbot-DIC is a network worm with backdoor Trojan functionality
for the Windows platform.
When first run, W32/Sdbot-DIC copies itself to the Windows system
folder as taskdrv32.exe and modifies the following registry entry in
order to run each time an EXE file is run:
HKCR\exefile\shell\open\command
(default)
taskdrv32.exe \"%1\" %*
The worm spreads through network shares protected by weak passwords,
MS-SQL servers, AOL Instant Messenger (AIM) and through various
operating system vulnerabilities such as ASN.1 (MS04-007).
W32/Sdbot-DIC connects to a predetermined IRC channel and awaits
further commands from remote users. The backdoor component of
W32/Sdbot-DIC can be instructed to perform the following functions:
scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server
terminate anti-virus and security related processes
take part in distributed denial of service (DDoS) attacks
steal usernames and passwords
W32/Sdbot-DIC also spreads via peer to peer (P2P) applications by
creating copies of itself in shared folders.
W32/Sdbot-DIC modifies the HOSTS file (typically located in <Windows
system folder>\drivers\etc) by mapping the following domains to
randomly generated IP addresses:
avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
downloads-eu1.kaspersky-labs.com
downloads-eu2.kaspersky-labs.com
downloads-eu3.kaspersky-labs.com
downloads-eu4.kaspersky-labs.com
downloads-us1.kaspersky-labs.com
downloads-us2.kaspersky-labs.com
downloads-us3.kaspersky-labs.com
downloads-us4.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads4.kaspersky-labs.com
f-secure.com
ftp.avp.com
ftp.ca.com
ftp.customer.symantec.com
ftp.dispatch.mcafee.com
ftp.download.mcafee.com
ftp.downloads-eu1.kaspersky-labs.com
ftp.downloads-eu2.kaspersky-labs.com
ftp.downloads-eu3.kaspersky-labs.com
ftp.downloads-eu4.kaspersky-labs.com
ftp.downloads-us1.kaspersky-labs.com
ftp.downloads-us2.kaspersky-labs.com
ftp.downloads-us3.kaspersky-labs.com
ftp.downloads-us4.kaspersky-labs.com
ftp.downloads1.kaspersky-labs.com
ftp.downloads2.kaspersky-labs.com
ftp.downloads3.kaspersky-labs.com
ftp.downloads4.kaspersky-labs.com
ftp.f-secure.com
ftp.grisoft.com
ftp.kaspersky-labs.com
ftp.kaspersky.com
ftp.liveupdate.symantec.com
ftp.liveupdate.symantecliveupdate.com
ftp.mast.mcafee.com
ftp.mcafee.com
ftp.my-etrust.com
ftp.nai.com
ftp.networkassociates.com
ftp.norton.com
ftp.rads.mcafee.com
ftp.sandbox.norman.com
ftp.secure.nai.com
ftp.securityresponse.symantec.com
ftp.sophos.com
ftp.symantec.com
ftp.symantecliveupdate.com
ftp.symatec.com
ftp.trendmicro.com
ftp.uk.trendmicro-europe.com
ftp.update.symantec.com
ftp.updates.symantec.com
ftp.updates1.kaspersky-labs.com
ftp.updates2.kaspersky-labs.com
ftp.updates3.kaspersky-labs.com
ftp.updates4.kaspersky-labs.com
ftp.us.mcafee.com
ftp.viruslist.com
grisoft.com
kaspersky-labs.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
my-etrust.com
nai.com
networkassociates.com
norton.com
pandasoftware.com
rads.mcafee.com
sandbox.norman.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
symantecliveupdate.com
symatec.com
trendmicro.com
uk.trendmicro-europe.com
update.symantec.com
updates.symantec.com
updates1.kaspersky-labs.com
updates2.kaspersky-labs.com
updates3.kaspersky-labs.com
updates4.kaspersky-labs.com
us.mcafee.com
viruslist.com
virusscan.jotti.org
virustotal.com
www.avp.com
www.ca.com
www.customer.symantec.com
www.dispatch.mcafee.com
www.download.mcafee.com
www.downloads-eu1.kaspersky-labs.com
www.downloads-eu2.kaspersky-labs.com
www.downloads-eu3.kaspersky-labs.com
www.downloads-eu4.kaspersky-labs.com
www.downloads-us1.kaspersky-labs.com
www.downloads-us2.kaspersky-labs.com
www.downloads-us3.kaspersky-labs.com
www.downloads-us4.kaspersky-labs.com
www.downloads1.kaspersky-labs.com
www.downloads2.kaspersky-labs.com
www.downloads3.kaspersky-labs.com
www.downloads4.kaspersky-labs.com
www.f-secure.com
www.grisoft.com
www.kaspersky-labs.com
www.kaspersky.com
www.liveupdate.symantec.com
www.liveupdate.symantecliveupdate.com
www.mast.mcafee.com
www.mcafee.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.norton.com
www.pandasoftware.com
www.rads.mcafee.com
www.sandbox.norman.com
www.secure.nai.com
www.securityresponse.symantec.com
www.sophos.com
www.symantec.com
www.symantecliveupdate.com
www.symatec.com
www.trendmicro.com
www.uk.trendmicro-europe.com
www.update.symantec.com
www.updates.symantec.com
www.updates1.kaspersky-labs.com
www.updates2.kaspersky-labs.com
www.updates3.kaspersky-labs.com
www.updates4.kaspersky-labs.com
www.us.mcafee.com
www.viruslist.com
www.virustotal.com
W32/Sdbot-DIC attempts to terminate the following services and
processes:
_avpcc.exe
_avpm.exe
ackwin32.exe
advxdwin.exe
agentsvr.exe
agv.exe
ahnsd.exe
alertsvc.exe
alogserv.exe
amon.exe
amon9x.exe
amonavp32.exe
antivir.exe
antivirus.exe
ants.exe
antssircam.exe
apimonitor.exe
aplica32.exe
apvxdwin.exe
atcon.exe
atguard.exe
ats.exe
atscan.exe
atupdater.exe
atwatch.exe
autodown.exe
autotrace.exe
autoupdate.exe
avconsol.exe
ave32.exe
avgcc32.exe
avgctrl.exe
avgserv.exe
avgserv9.exe
avgserv9schedapp.exe
avgw.exe
avkpop.exe
avkserv.exe
avkservice.exe
avkwcl9.exe
avkwctl9.exe
avnt.exe
avp.exe
avp32.exe
avpcc.exe
avpccavpm.exe
avpdos32.exe
avpexec.exe
avpinst.exe
avpm.exe
avpmonitor.exe
avptc.exe
avptc32.exe
avpupd.exe
avpupdates.exe
avrescue.exe
avsched32.exe
avsynmgr.exe
avwin95.exe
avwinnt.exe
avwupd32.exe
avxgui.exe
avxinit.exe
avxlive.exe
avxmonitor9x.exe
avxmonitornt.exe
avxnews.exe
avxquar.exe
avxsch.exe
avxw.exe
backlog.exe
bd_professional.exe
bidef.exe
bidserver.exe
bipcp.exe
bisp.exe
blackd.exe
blackice.exe
blackiceblackd.exe
bootwarn.exe
borg2.exe
bs120.exe
bullguard.exe
ccapp.exe
ccevtmgr.exe
ccimscan.exe
ccpwdsrc.exe
ccpxysvc.exe
ccsetmgr.exe
cdp.exe
cfiadmin.exe
cfiaudit.exe
cfinet.exe
cfinet32.exe
claw95.exe
claw95cf.exe
clean.exe
cleaner.exe
cleaner3.exe
cleanpc.exe
cmgrdian.exe
cmon016.exe
codered.exe
connectionmonitor.exe
conseal.exe
cpd.exe
cpf9x206.exe
ctrl.exe
defalert.exe
defence.exe
defense.exe
defscangui.exe
defwatch.exe
deputy.exe
doors.exe
dpf.exe
drwatson.exe
drweb32.exe
dvp95.exe
dvp95_0.exe
ecengine.exe
edisk.exe
efpeadm.exe
esafe.exe
escanh95.exe
escanhnt.exe
escanv95.exe
espwatch.exe
etrustcipe.exe
evpn.exe
expert.exe
fameh32.exe
fast.exe
fch32.exe
fih32.exe
findviru.exe
firewall.exe
fix-it.exe
flowprotector.exe
fnrb32.exe
fprot.exe
frw.exe
fsaa.exe
fsav32.exe
fsav95.exe
fsave32.exe
fsgk32.exe
fsm32.exe
fsma32.exe
fsmb32.exe
fwenc.exe
gbmenu.exe
gbpoll.exe
gedit.exe
generics.exe
grief3878.exe
guard.exe
guarddog.exe
hackereliminator.exe
hh.exe
hijackthis.exe
iamapp.exe
iamserv.exe
iamstats.exe
ibmasn.exe
ibmavsp.exe
icload95.exe
icloadnt.exe
icmon.exe
icsupp95.exe
icsuppnt.exe
iface.exe
ifw2000.exe
inoculateit.exe
iomon98.exe
iparmor.exe
iris.exe
isrv95.exe
jammer.exe
jedi.exe
kav.exe
kavpf.exe
kavsvc.exe
ldnetmon.exe
ldpromenu.exe
ldscan.exe
localnet.exe
lockdown.exe
lockdown2000.exe
lookout.exe
luall.exe
lucomserver.exe
luspt.exe
mcafee.exe
mcagent.exe
mcmnhdlr.exe
mcshield.exe
mcshieldvvstat.exe
mctool.exe
mcupdate.exe
mcvsrte.exe
mcvsshld.exe
mgavrtcl.exe
mgavrte.exe
mghtml.exe
mgui.exe
minilog.exe
mon.exe
monitor.exe
monsys32.exe
monsysnt.exe
moolive.exe
mpfservice.exe
mpftray.exe
mrflux.exe
msconfig.exe
msinfo32.exe
mwatch.exe
mxtask.exe
n32scanw.exe
nav.exe
nav32.exe
navalert.exe
navap.exe
navapsvc.exe
navapw32.exe
navdx.exe
navengnavex15.exe
navlu32.exe
navnt.exe
navrunr.exe
navstub.exe
navw32.exe
navwnt.exe
nc2000.exe
ndd32.exe
neomonitor.exe
neowatchlog.exe
net2000.exe
netarmor.exe
netcommando.exe
netinfo.exe
netmon.exe
netpro.exe
netprotect.exe
netscanpro.exe
netstat.exe
netutils.exe
netutils].exe
nimda.exe
nisserv.exe
nisum.exe
nisumnisservnisum.exe
nmain.exe
nod32.exe
norman.exe
norman_32.exe
norman_av.exe
norman32.exe
normanav.exe
normist.exe
norton.exe
norton_av.exe
nortonav.exe
notstart.exe
npfmessenger.exe
npfw.exe
npfw32.exe
nprotect.exe
npscheck.exe
npssvc.exe
nresq32.exe
nsched32.exe
nschednt.exe
nsplugin.exe
ntrtscan.exe
ntvdm.exe
ntxconfig.exe
nui.exe
nupgrade.exe
nvarch16.exe
nvc95.exe
nvsvc32.exe
nwservice.exe
nwtool16.exe
offguard.exe
opscan.exe
ostronet.exe
outpost.exe
padmin.exe
panda.exe
pandaav.exe
panixk.exe
pav.exe
pavcl.exe
pavproxy.exe
pavsched.exe
pavw.exe
pccclient.exe
pccguide.exe
pcciomon.exe
pccntmon.exe
pccwin97.exe
pccwin98.exe
pcfwallicon.exe
pcscan.exe
periscope.exe
persfw.exe
pf2.exe
pfwadmin.exe
pingscan.exe
platin.exe
pop3trap.exe
poproxy.exe
portdetective.exe
portmonitor.exe
ppinupdt.exe
pptbc.exe
ppvstop.exe
procdump.exe
processmonitor.exe
processmonitor.exe
procexplorerv10#.exe
programauditor.exe
proport.exe
protectx.exe
pspf.exe
purge.exe
pview95.exe
pw32.exe
qconsole.exe
rav.exe
rav7.exe
rav7win.exe
realmon.exe
regedit32.exe
regrun2.exe
rescue.exe
rrguard.exe
rshell.exe
rtvscn95.exe
rulaunch.exe
safeweb.exe
savscan.exe
sbserv.exe
sbservice.exe
scan.exe
scan32.exe
scan95.exe
scanpm.exe
scrscan.exe
sd.exe
sens.exe
serv95.exe
sfc.exe
sh.exe
sharedaccess.exe
shn.exe
smc.exe
sofi.exe
sophos.exe
sophos_av.exe
sophosav.exe
spf.exe
sphinx.exe
spy.exe
spygate.exe
spyx.exe
spyxx.exe
srwatch.exe
ss3edit.exe
st2.exe
supftrl.exe
supp95.exe
supporter5.exe
sweep95.exe
sweepnet.exe
sweepsrv.sys.exe
sweepsrv.sysvshwin32.exe
swnetsup.exe
symantec.exe
symlcsvc.exe
symproxysvc.exe
symtray.exe
sysedit.exe
taskmon.exe
taumon.exe
tauscan.exe
tbscan.exe
tc.exe
tca.exe
tcm.exe
tctca.exe
tfak.exe
tfak5.exe
tgbob.exe
titanin.exe
titaninxp.exe
trendmicro.exe
trjscan.exe
trojantrap3.exe
truevector.exe
undoboot.exe
update.exe
vbcmserv.exe
vbcons.exe
vbust.exe
vbwin9x.exe
vbwinntw.exe
vccmserv.exe
vcontrol.exe
vet32.exe
vet95.exe
vettray.exe
virus.exe
virusmdpersonalfirewall.exe
vnlan300.exe
vnpc3000.exe
vpc32.exe
vpfw30s.exe
vptray.exe
vscan40.exe
vsched.exe
vsecomr.exe
vshwin32.exe
vshwin32vbcmserv.exe
vsmain.exe
vsmon.exe
vsstat.exe
vswin9xe.exe
vswinntse.exe
w9x.exe
watchdog.exe
webscanx.exe
webtrap.exe
wfindv32.exe
wgfe95.exe
whoswatchingme.exe
wimmun32.exe
Windows Firewall
Windows Security Center
Windows Update
winrecon.exe
winroute.exe
winsfcm.exe
wnt.exe
wqkmm3878.exe
wradmin.exe
wrctrl.exe
wsbgate.exe
wyvernworksfirewall.exe
zapro.exe
zatutor.exe
zauinst.exe
zonalm2601.exe
zonealarm.exe
When spreading via P2P, W32/Sdbot-DIC uses the following filenames:
2 Find MP3 8.2.0.exe
2pac - tupac full album battle before his dead.exe
Adobe InDesign CS 2.exe
Adobe keygen for photoshop indesign incopy SERIAL crack.exe
Adobe Photoshop CS 2.exe
Autocad 2002 Crack.exe
Autocad 2004 Crack.exe
Autocad 2005 Crack.exe
Autocad 2006 Crack.exe
BEST HACK TOOL FOR REAL HACKERS KEYLOGGER WEBCAM SPY! - PRIVATE.exe
Counter strike - cs full version.exe
Counter strike keygen WORKING FOR ONLINE STEAM.exe
credit card generator.exe
Fifa 2006 FULL with crack.exe
Fifa 2007 FULL with crack.exe
flash 8.exe
Free SMS Bomber.exe
Google hack tutorial for beginners.exe
HalfLife 2 WORKING Steam crack.exe
Hotmail account hacker in 30 minutes.exe
Hotmail hacker.exe
hotmail_account_sniffer.exe
Hotmailhacker v1.0.exe
IP Changer.exe
Microsoft Office Activation Crack.exe
Microsoft Office Professional Crack.exe
Microsoft Office Professional Serial.exe
Microsoft Office Professional Universal Crack without serial.exe
Microsoft Office Universal Activator v1.0.exe
MSN hacker - password stealer.exe
norton anti virus FULL NEWEST VERSION.exe
Norton AntiVirus 2005 crack.exe
Norton AntiVirus 2006 crack.exe
Norton antivirus crack.exe
Norton firewall 2006 crack.exe
porn.exe
porn_account_cracker.exe
porn_account_hacker.exe
psx2 - playstation 2 emulator.exe
toon boom.exe
UniVersal GSM unlocker for removing simlock
(NOKIA,ERICSSON,SONY,SAMSUNG,OTHERS).exe
WinRAR 4 beta.exe
yahoo_cracker.exe
yahoo_hacker.exe
Yahoo_mail_cracker.exe
ZoneAlarm crack (keygen).exe
Name Troj/Icyfox-B
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
Troj/Icyfox-B is a backdoor Trojan for ASP servers. It allows an
intruduer to run arbitary scripts on the server side.
Intruders can access the backdoor through HTTP Submit traffic, and
embed the script in the request.
Troj/Icyfox-B may also be packaged with various client side scripts
which allow an intruder to carry out various predefined exploits.
Name W32/Rbot-BHT
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Backdoor.Win32.Rbot.alt
* W32/Sdbot.worm.gen.bh
* W32.Spybot.Worm
* WORM_SDBOT.CTV
Prevalence (1-5) 2
Description
W32/Rbot-BHT is a worm with backdoor functionality for the Windows
platform.
W32/Rbot-BHT attempts to spread by copying itself to network shares
protected by weak passwords.
W32/Rbot-BHT runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
The worm contains functionality to modify the system hosts file and
to terminate certain processes.
Advanced
W32/Rbot-BHT is a worm with backdoor functionality for the Windows
platform.
W32/Rbot-BHT attempts to spread by copying itself to network shares
protected by weak passwords.
W32/Rbot-BHT runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
The worm contains functionality to modify the system hosts file and
to terminate certain processes.
When first run W32/Rbot-BHT copies itself to <Windows system
folder>\MStools1.exe.
The following registry entries are created to run MStools1.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Service TOols
MStools1.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Service TOols
MStools1.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Service TOols
MStools1.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Service TOols
MStools1.exe
Registry entries are set as follows:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Microsoft Service TOols
MStools1.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Microsoft Service TOols
MStools1.exe
HKCU\Software\Microsoft\OLE
Microsoft Service TOols
MStools1.exe
HKLM\SOFTWARE\Microsoft\Ole
Microsoft Service TOols
MStools1.exe
Name W32/Rbot-BHZ
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
* Leaves non-infected files on computer
Aliases
* Backdoor.Win32.Rbot.alw
Prevalence (1-5) 2
Description
W32/Rbot-BHZ is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-BHZ spreads to other network computers by exploiting common
buffer
overflow vulnerabilities, including: RPC-DCOM (MS04-012), PNP
(MS05-039) and
ASN.1 (MS04-007).
Advanced
W32/Rbot-BHZ is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-BHZ spreads to other network computers by exploiting common
buffer
overflow vulnerabilities, including: RPC-DCOM (MS04-012), PNP
(MS05-039) and
ASN.1 (MS04-007).
W32/Rbot-BHZ runs continuously in the background, providing a
backdoor server
which allows a remote intruder to gain access and control over the
computer via
IRC channels.
When first run W32/Rbot-BHZ copies itself to <System>\smb32.exe and
creates the
file <Windows>\SoftWareProtector\rc-bot.pr (data file, may be safely
deleted).
The following registry entries are created to run smb32.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows SMB Manager
smb32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows SMB Manager
smb32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows SMB Manager
smb32.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name W32/Rbot-BIA
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* W32/Sdbot.worm.gen.bq
Prevalence (1-5) 2
Description
W32/Rbot-BIA is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-BIA spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812),MSSQL
(MS02-039)and ASN.1 (MS04-007).
W32/Rbot-BIA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Rbot-BIA is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-BIA spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812),MSSQL
(MS02-039)and ASN.1 (MS04-007).
W32/Rbot-BIA runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Rbot-BIA moves itself to <System>\wupdate.exe file
with the system, read-only, hidden attribites.
The following registry entries are created to run wupdate.exe on
startup:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update Manager
wupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update Manager
wupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Update Manager
wupdate.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name Troj/IRCBot-CX
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
Prevalence (1-5) 2
Description
Troj/IRCBot-CX is a Trojan for the Windows platform.
The Trojan connects to an IRC server and awaits commands from remote
attackers.
Advanced
Troj/IRCBot-CX is a Trojan for the Windows platform.
When run, Troj/IRCBot-CX copies itself to the Windows system folder
as smsbvl32.exe and sets the following registry entries in order to
run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ApplicationProtocolRun
"smsbvl32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ApplicationProtocolRun
"smsbvl32.exe"
The Trojan connects to an IRC server and awaits commands from remote
attackers.
Name Troj/Progent-P
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Steals information
* Drops more malware
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.ProAgent.t
* PWS-Progent
* Trojan.Progent
Prevalence (1-5) 2
Description
Troj/Progent-P is a backdoor Trojan for the Windows platform.
Troj/Progent-P includes functionality to:
- access the internet and communicate with a remote server via HTTP
- steal information and passwords from a number of games and
applications
- send notification messages to remote locations
- log key presses
Advanced
Troj/Progent-P is a backdoor Trojan for the Windows platform.
Troj/Progent-P includes functionality to:
- access the internet and communicate with a remote server via HTTP
- steal information and passwords from a number of games and
applications
- send notification messages to remote locations
- log key presses
When first run Troj/Progent-P copies itself to <Windows>\qservice.exe
and creates the following files:
<Temp>\htmpl.htm
<Windows>\kurlmon.dll
<Windows>\services.dll
<System>\HookApi.dll
<System>\drivers\KeenSense.sys
<System>\drivers\ksdevice.sys
where DLL files are components of the Trojan and the rest are text
files that are not malicious on their own and may safely be deleted.
The following registry entry is created to run qservice.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
qservices
<Windows>\qservice.exe
Troj/Progent-P sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4
Name Troj/Bandler-J
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Steals information
* Downloads code from the internet
* Reduces system security
* Records keystrokes
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banker.zp
* PWS-Banker.gen.b
* PWSteal.Banpaes
Prevalence (1-5) 2
Description
Troj/Bandler-J is an information stealing Trojan for the Windows
platform.
Troj/Bandler-J includes functionality to:
-access the internet and communicate with a remote server via HTTP
-download, install and run new software
-log keypresses
Troj/Bandler-J will also attempt to terminate Anti-virus and security
related applications.
Advanced
Troj/Bandler-J is an information stealing Trojan for the Windows
platform.
Troj/Bandler-J includes functionality to:
-access the internet and communicate with a remote server via HTTP
-download, install and run new software
-log keypresses
Troj/Bandler-J will also attempt to terminate Anti-virus and security
related applications.
When first run Troj/Bandler-J copies itself to <Windows>\smss.exe.
The following registry entry may be set to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zsmss
<Windows>\smss.exe
Name Troj/Stinx-K
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Installs itself in the Registry
Aliases
* Backdoor.Ryknos
Prevalence (1-5) 2
Description
Troj/Stinx-K is a backdoor Trojan for the Windows platform.
Advanced
Troj/Stinx-K is a backdoor Trojan for the Windows platform.
When first run Troj/Stinx-K copies itself to <System>\smsogx32.exe
and creates the following files:
<Temp>\648.bat
<Temp>\774.bat
The following registry entries are created to run smsogx32.exe on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SystemComputerLog
smsogx32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SystemComputerLog
smsogx32.exe
Name W32/IRCBot-BR
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Aliases
* Backdoor.Win32.IRCBot.jm
Prevalence (1-5) 2
Description
W32/IRCBot-BR is a worm and IRC backdoor Trojan for the Windows
platform.
W32/IRCBot-BR spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including ASN.1 (MS04-007).
W32/IRCBot-BR runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/IRCBot-BR includes functionality to download, install and run new
software.
The following patches for the operating system vulnerabilities
exploited by W32/IRCBot-BR can be obtained from the Microsoft website:
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx
Advanced
W32/IRCBot-BR is a worm and IRC backdoor Trojan for the Windows
platform.
W32/IRCBot-BR spreads to other network computers by exploiting common
buffer overflow vulnerabilities, including ASN.1 (MS04-007).
W32/IRCBot-BR runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/IRCBot-BR includes functionality to download, install and run new
software.
When first run W32/IRCBot-BR copies itself to the Windows system
folder and creates the file <System>\drivers\isa32.sys. The file
isa32.sys is detected by Sophos as Troj/NtRootK-N.
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<original filename of the worm executable>
The following patches for the operating system vulnerabilities
exploited by W32/IRCBot-BR can be obtained from the Microsoft website:
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx
Name Troj/Zlob-CE
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Zlob.du
* Trojan-Downloader.Win32.Zlob.dq
* Trojan-Downloader.Win32.Zlob.dx
* Trojan-Downloader.Win32.Zlob.dk
* Downloader-AQW
* Trojan.Zlob
Prevalence (1-5) 2
Description
Troj/Zlob-CE is a Trojan for the Windows platform.
Troj/Zlob-CE may download further malicious code.
Advanced
Troj/Zlob-CE is a Trojan for the Windows platform.
Troj/Zlob-CE may download further malicious code.
When Troj/Zlob-CE is installed the following files are created:
<User>\Application Data\Microsoft\Protect\credhist
<System>\hp????.tmp
<System>\msvol.tlb
<System>\ncompat.tlb
where ???? is a randomly generated string.
The file ncompat.tlb is also detected as Troj/Zlob-CE.
The Trojan may be installed with further components of the following
names:
mssearchnet.exe
nvctrl.exe
ld????.tmp
The file hpAF7.tmp is registered as a COM object and Browser Helper
Object (BHO) for Microsoft Internet Explorer, creating registry
entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects\(e0103cd4-d1ce-411a-b75b-4fec072867f4)
HKCR\CLSID\(E0103CD4-D1CE-411A-B75B-4FEC072867F4)
Troj/Zlob-CE changes search settings for Microsoft Internet Explorer
by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Search\
The following registry entry is created to run nvctrl.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
nvctrl.exe
nvctrl.exe
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|