My Board

W32.Bugbear.M@mm
Discovered on: September 03, 2004
Last Updated on: September 04, 2004 12:43:28 PM

W32.Bugbear.M@mm is a mass-mailing worm that sends itself to email addresses it gathers from certain files on the system, using its own SMTP engine.

Variants: W32.Bugbear@mm
Type: Virus, Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX

Technical Details:

When W32.Bugbear.M@mm runs, it does the following:


Creates the following files:

%System%\<random filename>.nls
%System%\<random filename>.dat
%System%\<random filename>.tmp
%System%\<random filename>.dll
%System%\<random filename>.exe


Attempts to add the value:

"<random value>" = "%System%\<random filename>.exe"

in the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the worm starts when Windows starts.


Attempts to append its code to the following files in the %Windir% folder and %ProgramFiles% folder:

scandskw.exe
regedit.exe
mplayer.exe
hh.exe
notepad.exe
winhelp.exe
Internet Explorer\iexplore.exe
adobe\acrobat 7.0\reader\acrord32.exe
WinRAR\WinRAR.exe
Windows Media Player\mplayer2.exe
Real\RealPlayer\realplay.exe
Outlook Express\msimn.exe
Far\Far.exe
CuteFTP\cutftp32.exe
Adobe\Acrobat 6.0\Reader\AcroRd32.exe
Adobe\Acrobat 5.0\Reader\AcroRd32.exe
Adobe\Acrobat 4.0\Reader\AcroRd32.exe
ACDSee32\ACDSee32.exe
MSN Messenger\msnmsgr.exe
WS_FTP\WS_FTP95.exe
QuickTime\QuickTimePlayer.exe
StreamCast\Morpheus\Morpheus.exe
Zone Labs\ZoneAlarm\ZoneAlarm.exe
Trillian\Trillian.exe
Lavasoft\Ad-aware 6\Ad-aware.exe
AIM95\aim.exe
Winamp\winamp.exe
DAP\DAP.exe
ICQ\Icq.exe
kazaa\kazaa.exe
winzip\winzip32.exe

The worm is a polymorphic file infector.

Note:
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.


Scans all hard disks for files with file paths containing any of the following strings:

BEAR
DONKEY
DOWNLOAD
FTP
HTDOCS
HTTP
MORPHEUS
ICQ
KAZAA
LIME
MULE
INCOMING
SHAR
UPLOAD


If a file within these folders contains files with an .exe extension, the worm will attempt to infect those files.
Otherwise, it will copy itself as <original filename.ext>.exe (where .ext is the original file's extension).


Gathers email address from files whose filename contains any of the following strings:

.dbx
.tbb
.eml
.mbx
.nch
.mmf
Inbox
.ods
.htm
.asp
.txt
.sht


Uses its own SMTP engine to email itself to the email addresses that it collects.

The email has the following characteristics:
Subject: Starts with "Re: "

Attachment:
The worm searches for a specific folder by querying the following registry value:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell\Folders\Personal

Once the worm locates the name of the folder, it looks for a file that does not have a .INI, .ini, .rdp extentions. The worm uses the filename and then changes the file extension to .jpg and uses it as an attachment of the email.

Otherwise, the attachment may be one of the following:
a000032.jpg.scr
song.wav.scr
music.mp3.scr
video.avi.scr
photo.jpg.scr
pic.jpg.scr
message.txt.scr
image.jpg.scr
news.doc.scr
myphoto.jpg.scr
you.jpg.scr
love.jpg.scr
readme.txt.scr


Locates the following information from the infected computer and sends it to the attacker:

Cookies
Clipboard contents
Logged keystrokes
Text from open windows

Removal Instructions:

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode or VGA mode.
Run a full system scan, delete or repair all the files detected as W32.Bugbear.M@mm.
Reverse the changes made to the registry.

Click Start, and then click Run. (The Run dialog box appears.)


Type regedit

Then click OK. (The Registry Editor opens.)


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\


In the right pane, delete the value:

"<random value>" = "%System%\<random filename>.exe"


Exit the Registry Editor.


Restart the computer in Normal mode.

[url=\"http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear.m@mm.html\"]source[/url]

W32.Mydoom.R@mm
Discovered on: September 03, 2004
Last Updated on: September 04, 2004 02:43:54 PM

W32.Mydoom.R@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses that it finds on an infected computer. The email contains a spoofed From address. The subject and message body vary, and the attachment has a .bat, .cmd, .exe, .pif, .scr, or .zip extension.

This threat is packed using UPX.


Also Known As: W32/Mydoom.t@MM [McAfee], WORM_MYDOOM.T [Trend], MyDoom.T [F-Secure]
Variants: W32.Mydoom.P@mm
Type: Worm
Infection Length: 37,888 bytes, 8,192 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Novell Netware, OS/2, UNIX

Technical Details:

When W32.Mydoom.R@mm is executed, it does the following:


Copies itself as %System%\tasker.exe.

Notes:
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Creates the file %System%\Nemog.dll(8,192 bytes), which is a component of W32.Mydoom.R@mm.


Creates the file, %Temp%\Message, and then opens it with Notepad.


Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).


Creates a mutex, "EnD-Of-SkyNet", which allows only one instance of the worm to run in memory.


Adds the value:

"Task"="%System%\tasker.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the worm starts when Windows starts.


Adds the value:

"(Default)"="%System%\Nemog.dll"

to the registry key:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32


Creates the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version


May also attempt to open a back door on port 5422 and allow a remote attacker to have unauthorized access to the infected system. This would allow a remote attacker to download and execute remote files.


Copies itself to Kazaa shared folders using one of the following file names:

cleaner
crack
Fixtool
Hotmail hacker
mydoom
netsky
ps2 emulator
SoBig
Upload
Vahos
Viraus
Wenrar
Winzip
xbox emulator
XXX Pictures
XXX Videos
yahoo hacker


Retrieves the email addresses from the files that have the following extensions on drives C through Y:

.adbh
.aspd
.dbxn
.htmb
.phpq
.pl
.shtl
.tbbg
.wab


Retrieves the email addresses from the Windows Address Book files.


Guesses the name of the SMTP server by prepending the following names to the domain names gathered from the local system:

gate.
mail.
mail1.
msx.
mx.
mx1.
ns.
relay.
smtp.


Gathers email addresses form the local system. It also derives email addresses by prepending the following strings to the domain names gathered from the system:

alice
andrew
brenda
brent
brian
claudia
david
debby
george
helen
james
jerry
jimmy
julie
kevin
linda
maria
michael
peter
robert
sandra
smith
steve


Sends itself to the email addresses that it finds.

The email has the following characteristics:

From:
The From address is spoofed.

Subject: The subject may be one of the following:

<Garbage string>
<none>
document
Error
hello
hi
Information
Mail Delivery System
Mail Transaction Failed
message
RE:my .....
RE:test
readme
Server Report
Status
test


Message: The message may be one of the following:

!!!!!!!!!!!, check the attachment!!!.
(Norton Anti Virus : No Virusses Found , Check The Attachment For More Information.
(Norton ANti Virus,Panda,Mcafee No Virusses Found).
Check the attachment for more information!.
check the attachment to get the lastest news.
check.
come back my friend.
error , sorry we can't send the email so check the attachment.
error to send the mail!!!!!.
error, check the attachment for more information.
failed to send the email!, check the attachment for more information.
failed,check the attachment for more information.
hello <img src=\'http://www.killanet.net/forum3/public/s ... /smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
hello check the attachment thx.
hello.
here is what you need,thx.
loooooool <img src=\'http://www.killanet.net/forum3/public/s ... igwink.gif\' class=\'bbc_emoticon\' alt=\';)\' />))
Mail transaction failed. Partial message is available.
sorry we can't send the mail try later , check the attachment for more information.
the attachment for more information.
Try Later, Check the Attachment.
you can check the attachment for more information.
your attachment , thx.


Attachment: The attachment name may be one of the following:

body
data
doc
document
file
message
readme
test
text


with one or two of the following extensions:

.bat
.com
.doc
.exe
.htm
.scr
.tmp
.txt


It avoids sending itself to the email addresses that contains any of the following:

-._!@
abuse
accoun
acketst
admin
anyone
arin.
be_loyal:
berkeley
borlan
certific
contact
example
feste
gold-certs
google
ibm.com
icrosof
icrosoft
inpris
isc.o
isi.e
kernel
linux
listserv
mit.e
mozilla
mydomai
nobody
nodomai
noone
nothing
ntivi
panda
postmaster
privacy
rating
rfc-ed
ripe.
ruslis
samples
secur
sendmail
service
somebody
someone
sopho
submit
support
tanford.e
the.bat
usenet
utgers.ed
webmaster

Removal Instructions:

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode or VGA mode.
Run a full system scan and delete all the files detected as W32.Mydoom.R@mm.
Reverse the changes made to the registry.

Click Start > Run.
Type regedit

Then click OK.


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value:

"Task"="%System%\tasker.exe"


Navigate to the key:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32


In the right pane, delete the value:

"(Default)"="%System%\Nemog.dll"


Navigate to and delete the keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\Version


Exit the Registry Editor.


Restart the computer in Normal mode.

[url=\"http://securityresponse.symantec.com/av ... .r@mm.html\"]source[/url]

A virus has been identified by Sophos anti-virus experts which attempts to talk to end users over their speakers. The worm, known as W32/Amus-A, spreads via e-mail using subject lines such as "Listen and Smile". If users launch the attached file the worm will attempt to spread, and also tries to use the Microsoft Speech engine to read out a greeting as follows:

"hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule."

As well as this the worm changes the users Internet Explorer settings so users see a message in Turkish rather than their usual start page. Graham Cluley, senior technology consultant for Sophos, said the following about the worm:

"It's depressing to see virus writers are active in Turkey. It seems whoever created this worm has complaints about the quality of internet service in his country, but this isn't the proper way to register his opinion. Hopefully if any internet users receive an Amus-infected email they will treat it with suspicion and not launch the attachment."

The worm is not particuarly widespread, nor is it particuarly damaging in its present form. However, users are recommend as always to keep their anti-virus definitions up to date to prevent worms like this from propagating, and to be careful when opening attachments, even if they appear to be from a trusted source.

[url=\"http://itvibe.com/?NewsID=2874\"][Source][/url]

[b]New MyDoom draws on IE flaw to spread[/b]
[i]A new version of MyDoom uses an unpatched flaw in Microsoft's Internet Explorer to spread, antivirus companies warned on Monday.[/i]

[size=1]By Robert Lemos[/size]

The recently discovered vulnerability in the browser software allows the offshoot to infect a PC after a user clicks on a link, according to advisories from security software makers Symantec and McAfee. The program sneaks past antivirus applications that detect malicious software by scanning e-mail messages with attached programs.

The companies said they had only detected a few instances of the infector, which is labelled MyDoom.AG by McAfee and MyDoom.AH by Symantec.

"We have only received one submission from the field, but the technical aspects of this are concerning," said Craig Schmugar, senior virus research manager at McAfee. "It has all the components there to become a significant virus."

It's not the first time a code writer has exploited a flaw in a Microsoft product before the software giant has had a chance to plug the hole. An aggressive advertiser attempted to [url=\"http://news.com.com/Pop-up+toolbar+spreads+via+IE+flaws/2100-1002_3-5229707.html?tag=nl\"]surreptitiously install[/url] a pop-up toolbar in victim's Web browsers using two previously unpatched security flaws in Internet Explorer.

Microsoft said that it was investigating the flaw and was aware of a new virus exploiting the issue.

"As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources," said Microsoft in a statement sent to CNET News.com. "In addition, we continue to encourage customers follow our 'Protect Your PC' guidance of enabling a firewall, getting software updates and installing antivirus software."

The latest MyDoom virus appears as an e-mail in an inbox. The body of the message states: "Look at my homepage with my last webcam photos!" or "FREE ADULT VIDEO! SIGN UP NOW!" Both messages have text that links them to a Web page generated by the virus and hosted on the infected computer that sent the e-mail.

When the victim clicks on the link, a Windows-based PC will call Internet Explorer and load a malicious Web page from the previously infected computer. The page contains the [url=\"http://news.com.com/Exploit+code+makes+IE+flaw+more+dangerous/2100-1002_3-5439370.html?tag=nl\"]IFrame vulnerability recently publicized[/url] on security mailing lists. The virus uses the flaw to execute code on the victim's computer, infecting the system. The virus harvests e-mail addresses on the compromised system, sends out mail to spread the virus further, sets up a Web server and attempts to contact several Internet relay chat (IRC) servers as a way to notify the virus's creator of that a new system has been compromised.

The fact that the virus creates a Web server and uses that server to infect other systems is a significant departure from previous versions of MyDoom, and other viruses in general, Schmugar said.

"There was a decent amount of work that went into this," he said. "There was a good bit of attention (among security researchers) to the demo code (of this flaw). Someone grabbed the demo code and tweaked it quite a bit."

McAfee rates the program a low threat, but Schmugar said he thinks it might spread widely.

[url=\"http://news.com.com/New+MyDoom+draws+on+IE+flaw+to+spread/2100-7349_3-5443828.html?tag=nefd.top\"][Source][/url]

MyDoom worm is back
By JACK KAPICA
Globe and Mail Update



In a development certain to trouble computer security experts, only four days passed between the discovery of a vulnerability in the Internet Explorer browser and the appearance of a worm designed to exploit it.

The virus — in this case, technically a worm — is a variant of the well-known mass-mailing MyDoom infection, with the difference that rather than delivering an attachment, the e-mail just asks recipients to click on a link. The browser is then directed to the infected destination site, where the worm, dubbed Mydoom.ah by McAfee Inc.,

installs itself on the victim's computer.

The worm targets a Microsoft Internet Explorer IFRAME buffer overflow vulnerability, which was discovered and made public by two hackers with aliases "ned" and "SkyLined" on Friday. Only four days later a worm exploiting the weakness was developed and set loose, virus-tracking companies said reported.

The period of time between discovery of a flaw and the appearance of an infection has been shortening recently. Last year, the time difference was, on average, 28 days.

McAfee's Anti-virus and Vulnerability Emergency Response Team (AVERT) raised the risk assessment of MyDoom.ah to medium after receiving close to 100 reports of the virus being stopped or infecting users from the field, from both the virus itself as well as customer submissions. Most of these reports have arrived from the United States.

The new variant is a mass-mailing worm that sends messages with a hyperlink directing people to an infected machine. Following the hyperlink results in an infection occurring on vulnerable Microsoft Internet Explorer Web browsers.

The worm contains its own SMTP engine to construct outgoing messages. It harvests addresses from local files and then uses those addresses in the "From" field to send itself, producing a message with a spoofed return address.

Users should be wary, McAfee warned, and should delete any e-mail with the subject:

"hi!", "hey!", "Confirmation" or just blank. The message body will be one of the following:

"Congratulations! PayPal has successfully charged $175 to your credit card."

"Your order tracking number is A866DEC0, and your item will be shipped within three business days."

"To see details please click this link."

Another variation pretends to be an invitation to a sex site. The text of the message says: "Hi! I am looking for new friends. My name is Jane, I am from Miami, FL. See my homepage with my weblog and last webcam photos! See you!"

McAfee and Symantec, two makers of popular antivirus products, have updated their virus definition files to include MyDoom.ah for subscribers.

Microsoft Corp., which makes the Internet Explorer browser, is expected to issue its monthly batch of security patches later on Tuesday, but it was not immediately clear whether it would include a patch for the new worm.

The company did say that users of Windows XP who had installed Service Pack 2 were at a "reduced risk."

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20041109.gtdoomnov9/BNStory/Technology/\"]source[/url]

New Bropia worm rated "code orange"



SEOUL, Feb. 3 — Korean security specialists at Globeal Hauri are warning of a new variant of the recently discovered Bropia worm, which is more dangerous than its predecessor.

Symptoms include a file, seemingly sent from a "buddy," which is loaded with the virus and infects the PC as soon as it opened. Remote access hijacks the infected PC. Volume differences and right mouse click might indicate the PC user that something is wrong.

Once Bropia infects a system, it resides in the memory and continues spreading through MSN Messenger. Bropia is a member of the Rbot family of worms affecting the Windows platform, which installs a back door on the system and gives an attacker a way of accessing and controlling the infected system remotely. That would allow unauthorized remote access to the infected computer via specific IRC channels while running in the background as a service process.

Another interesting component is that the new Bropia is loaded with a Bot virus component that opens the 1294 port.

The new Bropia copies itself into the system folders and creates one of the following file names: LOL.scr, Webcam.pif, bedroom-thongs.pif, naked_drunk.pif, LMAO.pif, ROFL.pif, underware.pif, Hot.pif or webcam.pif

The infected system folder can vary, depending on each user's configuration, with the most common being C:\Windows\System (Windows 95/98/Me); C:\Winnt\System32 (Windows NT/2000) and C:\Windows\System32 (Windows XP).

The worm can be temporarily disabled bly blocking the 1294 port with any firewall. This is not a "spreading" port but the PC might receive an attack order from this port.

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20050203.gtbropia0203/BNStory/Technology/\"]source[/url]

Is this the same thing that Mess.Be has reported which is spreading through MSN Messenger?

Trend Micro Inc has released an overview of a worm that is currently doing the rounds infecting users PC's and transferring itself through the MSN Messenger service.

MSN Messenger is under attack of a worm that comes with a seductive name and download link. The user clicks on the link and gets the copy of attached worm for his PC. The worm can spread on the network and shared computers. The worm can disable the Anti-Virus software and then infect the Files in PC, It can also spread easily after it disables anti virus program.

Trend Micro Inc. has also raised the threat level on the W32/Bropia worm. The company said that worm could cause more harm in case it spread more through MSN Messenger buddies and Shared Networks. The virus has antidebugging feature also.

The virus logs keystrokes. It can also retrieve credit card numbers and other sensitive information. The W32/Bropia worm contains a variant of the Rbot backdoor Trojan. The virus could be a higher threat to sensitive information as it can store information. It is also capable of using the infected machine to hijack sensitive data.
[url=\"http://www.neowin.net/comments.php?id=26963&category=main\"][Source][/url]

[b][color=\"darkred\"]-------------------------------------------------------[/b][/color]

As of February 2, 2005, 6:55 PM (Pacific Standard Time/GMT -8:00), TrendLabs has declared a Medium-Risk alert to control the spread of this new WORM_BROPIA variant that is spreading in Korea, China, Taiwan, and the United States.

This memory-resident worm propagates itself via MSN Messenger by sending a copy of itself using different file names to all available or online contacts. Thus, users of the said messaging program should not accept or open these files to avoid infection.

System administrators can also block MSN Messenger transfers to control the spread of this worm.

As a general rule, MSN Messenger users should avoid accepting file transfers coming from an untrusted source.

This worm also drops and executes the file SEXY.JPG in the root folder. This normal .JPG file displays the following [url=\"http://www.trendmicro.com/vinfo/images/WORM_BROPIA_F.gif\"]image.[/url]
It also attempts to drop and execute a bot program, which Trend Micro detects as WORM_AGOBOT.AJC.

Unlike its previous variants, this worm also has an anti-debugging technique. That is, this worm will not run if any of the following debugging applications are currently running on the affected system:
* NT-ice
* Softice
It is also capable of setting the affected system's volume levels to zero, which may be used to prevent users from hearing any sound prompts, especially those that may be coming from antivirus and security applications.
[url=\"http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BROPIA.F\"][Source][/url]

[color=\"red\"][url=\"http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FBROPIA%2EF&VSect=Sn\"]REMOVAL INSTRUCTIONS[/url][/color]

<table width="100%" align="center"> <tr> <td bgColor="#ffffff" valign="top"> <font face="Trebuchet MS,Bookman Old Style,Arial" color="#000000" size="3"> <div style="MARGIN-LEFT: 15px; MARGIN-RIGHT: 15px; TEXT-ALIGN: justify"> <font face="Arial" color="#2d8f26"><b>Virus:</b></font>   SoberK <br> <br> <noindex><font face="Arial" color="#2d8f26"><b>Status:</b></font>   <font face="Arial" color="#ff0000"><b><i>Real.</i></b></font> </noindex> <br> <br> <font face="Arial" color="#2d8f26"><b>Example:</b></font>   <font face="Trebuchet MS,Bookman Old Style,Arial" color="#2d8f26"><i> [Collected on the Internet, 2005]</i></font> <br> <br> <table width="90%" align="center" bgColor="#000000" border="0"> <tr> <td bgColor="#eaf2e5"><font face="Verdana" size="2"> <div style="MARGIN: 10px 15px; TEXT-ALIGN: justify"> Dear Sir/Madam, <br> <br> we have logged your IP-address on more than 40 illegal Websites. <br> <br> Important: Please answer our questions!<br> The list of questions are attached. <br> <br> Yours faithfully,<br> M. John Stellford <br> <br> ++-++ Federal Bureau of Investigation -FBI-<br> ++-++ 935 Pennsylvania Avenue, NW, Room 2130<br> ++-++ Washington, DC 20535<br> ++-++ (202) 324-3000 </div> </font></td> </tr> </table> <p><br> <font face="Arial" color="#2d8f26"><b>Origins:</b></font>   In mid-February 2005, <nobr>e-mails</nobr> accusing recipients of having visited "more than <nobr>40 illegal</nobr> Websites" and purporting to come from the Federal Bureau of Investigation began turning up. Those cowed by the charge into opening the attachment (indictment_cit9792.zip) unwittingly released the W32.Sober.K@mm virus into their computers, a mass-mailing worm that uses its own SMTP engine to send itself to <nobr> e-mail</nobr> addresses gathered from compromised computers. <br> <br> The FBI has nothing to do with these letters — these missives are purely the work of the virus originator, his or her way of ensuring the attachment accompanying the <nobr>e-mail</nobr> gets opened and thus its payload triggered. On <nobr>22 February</nobr> 2005, the FBI issued the following <a onmouseover="window.status='FBI press release about virus';return true" onmouseout="window.status='';return true" href="http://www.fbi.gov/pressrel/pressrel05/022205.htm" target="fbi" style="color: #0000FF; text-decoration: underline"> press release</a> about these letters: <br> <font face="Verdana" size="2"></p> <div style="MARGIN: 15px 30px; TEXT-ALIGN: justify"> FBI ALERTS PUBLIC TO RECENT E-MAIL SCHEME <br> <br> E-mails purporting to come from FBI are phony <br> <br> Washington, D.C. - The FBI today warned the public to avoid falling victim to an on-going mass <nobr>e-mail</nobr> scheme wherein computer users receive unsolicited <nobr>e-mails</nobr> purportedly sent by the FBI. These scam <nobr>e-mails</nobr> tell the recipients that their Internet use has been monitored by the FBI’s Internet Fraud Complaint Center and that they have accessed illegal web sites. The <nobr> e-mails</nobr> then direct recipients to open an attachment and answer questions. The attachments contain a computer virus. <br> <br> These e-mails did not come from the FBI. Recipients of this or similar solicitations should know that the FBI does not engage in the practice of sending unsolicited <nobr>e-mails</nobr> to the public in this manner. <br> <br> Opening e-mail attachments from an unknown sender is a risky and dangerous endeavor as such attachments frequently contain viruses that can infect the recipient’s computer. The FBI strongly encourages computer users not to open such attachments. <br> <br> The FBI takes this matter seriously and is investigating. Users receiving <nobr>e-mails</nobr> of this nature are encouraged to report it to the Internet Crime Complaint Center via <a onmouseover="window.status='Internet Crime Complaint Center';return true" onmouseout="window.status='';return true" href="http://www.ic3.gov" target="ICCC" style="color: #0000FF; text-decoration: underline"> [url=\"http://www.ic3.gov</a>\"]http://www.ic3.gov</a>[/url]. </div> </font> <p>This is not the first time a virus has been spread via an <nobr> e-mail</nobr> purporting to come from the FBI. In January 2004, a <a onmouseover="window.status='Sober.C';return true" onmouseout="window.status='';return true" href="http://www.snopes.com/inboxer/hoaxes/download.asp" target="SoberC" style="color: #0000FF; text-decoration: underline"> SoberC</a> variant was passed along in similar fashion with its payload <nobr>e-mails</nobr> serving notice that "your computer was scanned" and the "contents of your computer were confiscated." <!--Symantec offers a <A HREF="http://securityresponse.symantec.com/av ... .tool.html" TARGET=remove>removal tool</A> for Sober.C on their web site.--><br> <br> <font face="Arial" color="#2d8f26"><b>Additional information:</b></font> </p> <table cellSpacing="20" width="277"> <tr> <td width="235"> <font face="Trebuchet MS,Bookman Old Style,Arial" color="#ff0000" size="3"> <a href="http://securityresponse.symantec.com/av ... .k@mm.html"> W32.Sober.K Virus (<i>Symantec</i>)</a></font><a href="http://securityresponse.symantec.com/av ... .k@mm.html"> </a></td> </tr> <tr> <td width="235"> <font face="Trebuchet MS,Bookman Old Style,Arial" color="#ff0000" size="3"> <a href="http://www.sophos.com/virusinfo/analyses/w32soberk.html"> W32.Sober.K (Sophos) (<i>Sophos</i>)</a></font><a href="http://www.sophos.com/virusinfo/analyses/w32soberk.html"> </a></td> </tr> <tr> <td width="235"> <font face="Trebuchet MS,Bookman Old Style,Arial" color="#ff0000" size="3"> <a href="http://www.f-secure.com/v-descs/sober_k ... 32.Sober.K Virus (<i>F-Secure</i>)</a></font></td> </tr> </table> </div> </font></td> </tr> </table></div>

Zafi-D a 'High-Alert' Top Threat

esecurityplanet : Online Threats & Alerts: Zafi-D a 'High-Alert' Top Threat

Success Story - F5 Networks Helps Santa Barbara Charter Fly

IT Management Glossary
data mining
ERP
extranet
grid computing
intranet
network appliance
outsourcing
storage
VPN
virus
FREE Tech Newsletters

Zafi-D a 'High-Alert' Top Threat
March 4, 2005
The Zafi-D worm has not only received 'high alert' threat status, it's become the most widespread malware roaming the Internet.

The worm, which spreads via email attachments and peer-to-peer accounts, received 'high alert' threat status from Sophos, Inc., an anti-virus and anti-spam company with U.S. headquarters in Lynnfield, Mass. Sophos analysts report that the worm harvests email addresses off infected computers and emails copies of itself out to them, and it also installs itself on the computer's registry. When it copies itself to the Windows system folder with the filename Norton Update.exe.

Sophos reports that Zafi-D makes up 30.8 percent of all malware traffic in the wild.

''It looks like the Zafi-D worm is going to be hanging around like a bored teenager for some time to come, unless more home users realise how important it is to update their anti-virus software,'' says Carol Theriault, a security consultant at Sophos. ''This Hungarian worm accounts for almost one in three viruses reported.''

Zafi-D is reported to display a fake error message box with the caption ''CRC: 04F6Bh'' and the text ''Error in packed file!''.


[url=\"http://www.esecurityplanet.com/alerts/article.php/3487646\"]source[/url]

Worm.Win32.Sober.L Alert!


A new variant of the Sober worm is spreading fast. As it's predecessors, Sober.L spreads as an email attachment in emails which are sent to all email addresses found on the victim's harddisk. Even if the executable file is packed in a .ZIP file, many users open the file and activate the worm this way. For novice users it's hard to see that it is a worm generated email because the email subject is "your password + accountnumber !". The email body text is the following:

hi,

i've got an admin mail with a Password and Account info!
but the mail recipient are you! it's probably an esmtp error, i think.
i've copied the full mail text in the Windows text-editor & zipped.
ok, cya...

The recipient is advised to open the attached file "Acc_text.zip". The worm also spreads in a German version, which is used on all German email addresses. The German subject is "ich habe ihre e-mail bekommen !". The email body text is:

Hallo,
jemand schickt ihre privaten Mails auf meinem Account.
Ich schaetze mal, das es ein Fehler vom Provider ist.

Insgesamt waren es jetzt schon 6 Mails!
Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.

Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger nicht mehr auf meinem Account landen, es Nervt naemlich.

Gruss



If you start the worm, you will see this window:

Source & More Information

W32.Kelvir.DA is a worm that spreads a variant of W32.Randex through MSN Messenger.

Type: Worm
Infection Length: 6,442 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When W32.Kelvir.DA is executed, it performs the following actions:

1. Sends the following message with a link to all the MSN Messenger contacts on the compromised computer:

its you in this cartoon!!
[http://]cartoonics.nl/[REMOVED]/cartoon.php?email=[RANDOM EMAIL ADDRESS]

Note: It has been reported that [RANDOM EMAIL ADDRESS] may be called nav_rro@hotmail.com.

2. Drops a variant of W32.Randex on the compromised computer if a recipient clicks on the link and downloads the file [RANDOM EMAIL ADDRESS].

Another recent worm puts the word "fucker" in the mouths of the infected, sends out the message: "you are on this picture and you never told me" and links to a would-be Pearl Jam fansite. The badly spelled "groupicture.php" in the URL gives it away, really. That, and the fact that I have not heard about Pearl Jam for 7 years, let alone be on a picture with them.

Other variations claim you're a staff member at a company/hotel/restaurant/whatever called Millenium ("i didnt know you worked here????"), you have a profile page at the wrongly spelled vbulettin site or that you are starring in a packet of beach pictures. For one last time (figuratively, I'm afraid): pictures and zipfiles do NOT have a .PIF extension... nothing worthwile does, actually. And secondly, never ever click links that end with your MSN Messenger account address.

[url=\"http://securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.da.html\"][u][More information \ Source][/u][/url]

Top Threat:Mitglieder.DQ
Executive Summary
Name: Mitglieder.DQ (Panda)
Affects: Windows 2003/XP/2000/NT/ME/98/95
Size: 36,864 bytes

What it does: Mitglieder.DQ is a Trojan horse program with no direct mechanism for spreading. It is placed on web sites and other media from which users are tricked into downloading and executing it.

It contains a large number of process names belonging to security software and the software that keeps it up to date and it attempts to stop these processes. It then attempts to download the file OSA3.GIF from a large list of web sites. The .GIF extension is meant to trick users and security software; the file is actually an executable.

The program also copies two files, WINSHOST.EXE and WIWSHOST.EXE, to the Windows System directory. The first is a copy of the Trojan, the second a DLL used by it. It also overwrites the Windows HOSTS file with the following text:

127.0.0.1 localhost

It also creates registry values for itself in the HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER Run keys in order to run itself at boot time. It creates one more value:

HKEY_CURRENT_USER\ Software\ FirstRun
FirstRunRR = 0x00000001

as an infection mark, in order to check if it has already affected the computer.

How to avoid it: Install antivirus software and keep it up to date. Only run executables from highly-trusted sources.

How to remove it: Delete the following registry keys from the system:

* HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
winshost.exe = %sysdir%\winshost.exe
* HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
winshost.exe = %sysdir%\winshost.exe
* HKEY_CURRENT_USER\ Software\ FirstRun
FirstRunRR = 0x00000001

(%sysdir% is the Windows system directory)

Then restart the computer. Afterwards delete %sysdir%\winshost.exe and %sysdir%\wiwshost.exe.

It's best also to scan your system with an up-to-date anti-virus scanner at this point.

[url=\"http://www.pcmag.com/article2/0,1895,1832264,00.asp\"]source: PCMag[/url]