Win32.Bagle.AJ@mm( WORM_BAGLE.AH (TREND) W32/Bagle-AI (Sophos) W32/Bagle.AG@mm (SARC) )
SINTOMAS: The presence of the following files in %SYSDIR% folder:Winxp.exe Winxp.exeopen Winxp.exeopenopen Winxp.exeopenopenopen Winxp.exeopenopenopenopen The presence of the following registry key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\key with value %SYSDIR%\\winxp.exe where %SYSDIR% is a variable representing the system folder (for example: C:\\WINDOWS\\SYSTEM) DESCRIPCIÓN TÉCNICA: This is a mass mailer with backdoor capabilities. It arrives trough e-mail in the following format:Subject Re: Body: One of the following strings: foto3 and MP3 fotogalary and Music fotoinfo Lovely animals Animals Predators The snake Screen and Music If the attachment is password protected zip: :) %image% or Password: %image% Where %image% is a picture with the 5 letter password. Or one of the following: Password: Pass: Key: Followed by the password text. Attachment: The attachment is one of the following: MP3 Music_MP3 New_MP3_Player Cool_MP3 Doll Garry Cat Dog Fish With exe, com, scr, cpl, or zip extension. When the attachment is executed the word does the following: Creates the following list of mutexes: MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D \'D\'r\'o\'p\'p\'e\'d\'S\'k\'y\'N\'e\'t\' _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_ [SkyNet.cz]SystemsMutex AdmSkynetJklS003 ____--->>>>U<<<<--____ _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_ Deletes the following registry keys: My AV Zone Labs Client Ex 9XHtProtect Antivirus Special Firewall Service service Tiny AV ICQNet HtProtect NetDy Jammer2nd FirewallSvr MsInfo SysMonXP EasyAV PandaAVEngine Norton Antivirus AV KasperskyAVEng SkynetsRevenge ICQ Net from HKLM\\Software\\Microsoft\\Windows\\CurentVersion\\Run and HKCU\\Software\\Microsoft\\Windows\\CurentVersion\\Run It copies itself in %SYSDIR% with the file name winxp.exe It adds the following registry key: HKCU\\ Software\\Microsoft\\Windows\\CurentVersion\\Run\\key with value %SYSDIR%\\winxp.exe It terminates the following list of processes: OUTPOST.EXE NMAIN.EXE NORTON_INTERNET_SECU_3.0_407.EXE NPF40_TW_98_NT_ME_2K.EXE NPFMESSENGER.EXE NPROTECT.EXE NSCHED32.EXE NTVDM.EXE NVARCH16.EXE KERIO-WRP-421-EN-WIN.EXE KILLPROCESSSETUP161.EXE LDPRO.EXE LOCALNET.EXE LOCKDOWN.EXE LOCKDOWN2000.EXE LSETUP.EXE CLEANPC.EXE AVprotect9x.exe CMGRDIAN.EXE CMON016.EXE CPF9X206.EXE CPFNT206.EXE CV.EXE CWNB181.EXE CWNTDWMO.EXE ICSSUPPNT.EXE DEFWATCH.EXE DEPUTY.EXE DPF.EXE DPFSETUP.EXE DRWATSON.EXE ENT.EXE ESCANH95.EXE AVXQUAR.EXE ESCANHNT.EXE ESCANV95.EXE AVPUPD.EXE EXANTIVIRUS-CNET.EXE FAST.EXE FIREWALL.EXE FLOWPROTECTOR.EXE FP-WIN_TRIAL.EXE FRW.EXE FSAV.EXE AUTODOWN.EXE FSAV530STBYB.EXE FSAV530WTBYB.EXE FSAV95.EXE GBMENU.EXE GBPOLL.EXE GUARD.EXE GUARDDOG.EXE HACKTRACERSETUP.EXE HTLOG.EXE HWPE.EXE IAMAPP.EXE IAMAPP.EXE IAMSERV.EXE ICLOAD95.EXE ICLOADNT.EXE ICMON.EXE ICSUPP95.EXE ICSUPPNT.EXE IFW2000.EXE IPARMOR.EXE IRIS.EXE JAMMER.EXE ATUPDATER.EXE AUPDATE.EXE KAVLITE40ENG.EXE KAVPERS40ENG.EXE KERIO-PF-213-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE BORG2.EXE BS120.EXE CDP.EXE CFGWIZ.EXE CFIADMIN.EXE CFIAUDIT.EXE AUTOUPDATE.EXE CFINET.EXE NAVAPW32.EXE NAVDX.EXE NAVSTUB.EXE NAVW32.EXE NC2000.EXE NCINST4.EXE AUTOTRACE.EXE NDD32.EXE NEOMONITOR.EXE NETARMOR.EXE NETINFO.EXE NETMON.EXE NETSCANPRO.EXE NETSPYHUNTER-1.2.EXE NETSTAT.EXE NISSERV.EXE NISUM.EXE CFIAUDIT.EXE LUCOMSERVER.EXE AGENTSVR.EXE ANTI-TROJAN.EXE ANTI-TROJAN.EXE ANTIVIRUS.EXE ANTS.EXE APIMONITOR.EXE APLICA32.EXE APVXDWIN.EXE ATCON.EXE ATGUARD.EXE ATRO55EN.EXE ATWATCH.EXE AVCONSOL.EXE AVGSERV9.EXE AVSYNMGR.EXE BD_PROFESSIONAL.EXE BIDEF.EXE BIDSERVER.EXE BIPCP.EXE BIPCPEVALSETUP.EXE BISP.EXE BLACKD.EXE BLACKICE.EXE BOOTWARN.EXE NWINST4.EXE NWTOOL16.EXE OSTRONET.EXE OUTPOSTINSTALL.EXE OUTPOSTPROINSTALL.EXE PADMIN.EXE PANIXK.EXE PAVPROXY.EXE DRWEBUPW.EXE PCC2002S902.EXE PCC2K_76_1436.EXE PCCIOMON.EXE PCDSETUP.EXE PCFWALLICON.EXE PCFWALLICON.EXE PCIP10117_0.EXE PDSETUP.EXE PERISCOPE.EXE PERSFW.EXE PF2.EXE AVLTMAIN.EXE PFWADMIN.EXE PINGSCAN.EXE PLATIN.EXE POPROXY.EXE POPSCAN.EXE PORTDETECTIVE.EXE PPINUPDT.EXE PPTBC.EXE PPVSTOP.EXE PROCEXPLORERV1.0.EXE PROPORT.EXE PROTECTX.EXE PSPF.EXE WGFE95.EXE WHOSWATCHINGME.EXE AVWUPD32.EXE NUPGRADE.EXE WHOSWATCHINGME.EXE WINRECON.EXE WNT.EXE WRADMIN.EXE WRCTRL.EXE WSBGATE.EXE WYVERNWORKSFIREWALL.EXE XPF202EN.EXE ZAPRO.EXE ZAPSETUP3001.EXE ZATUTOR.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE CLEANER3.EXE CLEANPC.EXE CMGRDIAN.EXE CMON016.EXE CPD.EXE CFGWIZ.EXE CFIADMIN.EXE PURGE.EXE PVIEW95.EXE QCONSOLE.EXE QSERVER.EXE RAV8WIN32ENG.EXE REGEDT32.EXE REGEDIT.EXE UPDATE.EXE RESCUE.EXE RESCUE32.EXE RRGUARD.EXE RSHELL.EXE RTVSCN95.EXE RULAUNCH.EXE SAFEWEB.EXE SBSERV.EXE SD.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SFC.EXE SGSSFW32.EXE SH.EXE SHELLSPYINSTALL.EXE SHN.EXE SMC.EXE SOFI.EXE SPF.EXE SPHINX.EXE SPYXX.EXE SS3EDIT.EXE ST2.EXE SUPFTRL.EXE LUALL.EXE SUPPORTER5.EXE SYMPROXYSVC.EXE SYS_XP.EXE SYSXP.EXE SYSEDIT.EXE TASKMON.EXE TAUMON.EXE TAUSCAN.EXE TC.EXE TCA.EXE TCM.EXE TDS2-98.EXE TDS2-NT.EXE TDS-3.EXE TFAK5.EXE TGBOB.EXE TITANIN.EXE TITANINXP.EXE TRACERT.EXE TRJSCAN.EXE TRJSETUP.EXE TROJANTRAP3.EXE UNDOBOOT.EXE VBCMSERV.EXE VBCONS.EXE VBUST.EXE VBWIN9X.EXE VBWINNTW.EXE VCSETUP.EXE VFSETUP.EXE VIRUSMDPERSONALFIREWALL.EXE VNLAN300.EXE VNPC3000.EXE VPC42.EXE VPFW30S.EXE VPTRAY.EXE VSCENU6.02D30.EXE VSECOMR.EXE VSHWIN32.EXE VSISETUP.EXE VSMAIN.EXE VSMON.EXE VSSTAT.EXE VSWIN9XE.EXE VSWINNTSE.EXE VSWINPERSE.EXE W32DSM89.EXE W9X.EXE WATCHDOG.EXE WEBSCANX.EXE CFIAUDIT.EXE CFINET.EXE ICSUPP95.EXE MCUPDATE.EXE CFINET32.EXE CLEAN.EXE CLEANER.EXE LUINIT.EXE MCAGENT.EXE MCUPDATE.EXE MFW2EN.EXE MFWENG3.02D30.EXE MGUI.EXE MINILOG.EXE MOOLIVE.EXE MRFLUX.EXE MSCONFIG.EXE MSINFO32.EXE MSSMMC32.EXE MU0311AD.EXE NAV80TRY.EXE ZAUINST.EXE ZONALM2601.EXE ZONEALARM.EXE It copies itself under all folders that contains the string shar with the following filenames: Microsoft Office 2003 Crack, Working!.exe Microsoft Windows XP, WinXP Crack, working Keygen.exe Microsoft Office XP working Crack, Keygen.exe Porno, sex, oral, anal cool, awesome!!.exe Porno Screensaver.scr Serials.txt.exe KAV 5.0 Kaspersky Antivirus 5.0 Porno pics arhive, xxx.exe Windows Sourcecode update.doc.exe Ahead Nero 7.exe Windown Longhorn Beta Leak.exe Opera 8 New!.exe XXX hardcore images.exe WinAmp 6 New!.exe WinAmp 5 Pro Keygen Crack Update.exe Adobe Photoshop 9 full.exe Matrix 3 Revolution English Subtitles.exe ACDSee 9.exe It searches for e-mail addresses on all fixed drives in files with the following extensions: .wab .txt .msg .htm .shtm .stm .xml .dbx .mbx .mdx .eml .nch .mmf .ods .cfg .asp .php .pl .wsh .adb .tbb .sht .xls .oft .uin .cgi .mht .dhtm .jsp It creates the following files in %SYSDIR%: Winxp.exeopen Winxp.exeopenopen Winxp.exeopenopenopen Winxp.exeopenopenopenopen It tries to update itself from the following list of sites: http://www.bmgs.bund.de/ http://www.gtz.de/ http://www.dwelle.de/ http://www.monster.de/ http://www.regtp.de/ http://www.stufenlos-regelbar.de/ http://www.rapz-records.de/ http://abtacha.wirebrain.de/ http://die-cliquee.de/ http://www.gantke-net.de/ http://www.dar-fantasy.de/ http://www.mdirk.de/ http://www.calistyler.de/ http://tripod.de/ http://sgi1.rz.rwth-aachen.de/ http://www.sysserver1.de/ http://www.vwschubert.de/ http://ronnyackermann.de/ http://www.destatis.de/ http://www.berlinonline.de/ http://www.meinestadt.de/ http://obechmann.de/ http://www.stepstone.de/ http://www.degruyter.de/ http://www.lufthansa.de/ http://www.duden.de/ http://www.pcwelt.de/ http://www.astronomie.de/ http://www.abacho.de/ http://www.bundesliga.de/ http://www.expo2000.de/ http://knecht.cs.uni-magdeburg.de/ http://www.murczak.de/ http://www.murczak.de/ http://www.lupo18t.de/ http://www.hosteurope.de/ http://login.rz.fh-augsburg.de/ http://www.hannobunz.de/ http://dfk-crew.clanintern.de/ http://www.empire-show.de/ http://www.atlantis-show.de/ http://www.superstar-nord.de/ http://www.lords-of-havoc.de/ http://deepiceman.de/ http://www.atlas-hannover.de/ http://begros.de/ http://www.h-p-i.de/ http://www.szakos.de/ http://www.king-alp.de/ http://people-ftp.freenet.de/ http://www.stuttgart.de/ http://www.eumetsat.de/ http://www.gutenberg2000.de/ http://www.heidelberg.de/ http://www.tu-muenchen.de/ http://www.studentenwerke.de/ http://www.stellenmarkt.de/ http://zille.cs.uni-magdeburg.de/ http://www.mupad.de/ http://www.gelbeseiten.de/ http://www.klug-suchen.de/ http://www.niedersachsen.de/ http://www.frankfurter-buchmesse.de/ http://www.freiburg.de/ http://www.messe-duesseldorf.de/ http://www.beck.de/ http://zeus05.de/ http://www.europarl.de/ http://www.onlinereviewguide.com/ http://www.krebsinformation.de/ http://www.brigitte.de/ http://www.webhits.de/ http://www.kabel1.de/ http://www.saarland.de/ http://www.renewables2004.de/ http://www.awi-bremerhaven.de/ http://www.uni-tuebingen.de/ http://www.frankfurt-airport.de/ http://people-ftp.freenet.de/ http://people-ftp.freenet.de/ http://www.szakos.de/ http://www.king-alp.de/ http://niematec.de/ http://symbit.de/ http://pe-data.de/ http://web154.essen082.server4free.de/ http://web216.berlin240.server4free.de/ http://edwinf.surfplanet.de/ http://www.stricker-doerpen.de/ http://www.helmholtz.de/ http://www.staedtetag.de/ http://www.tu-dresden.de/ http://www.immobilienscout24.de/ http://www.karlsruhe.de/ http://www.citypopulation.de/ http://www.schulen-ans-netz.de/ http://www.fernuni-hagen.de/ http://www.stifterverband.de/ http://www.wissenschaft-online.de/ http://www.nuernbergmesse.de/ http://www.dortmund.de/ http://www.uni-marburg.de/ http://www.anwaltverein.de/ http://www.math-net.de/ http://www.finanznachrichten.de/ http://www.uni-bremen.de/ http://www.tu-darmstadt.de/ http://www.aachen.de/ http://www.dasding.de/ http://www.messe-muenchen.de/ http://www.uni-duisburg-essen.de/ http://www.photokina.de/ http://www.umweltbundesamt.de/ http://www.jugendherberge.de/ http://www.bitburger.de/ http://www.munich-airport.de/ http://www.uni-mannheim.de/ http://www.uni-frankfurt.de/ http://www.ruhr-uni-bochum.de/ http://www.medicine-worldwide.de/ http://www.firstgate.de/ http://www.kompetenznetze.de/ http://www.uni-jena.de/ http://www.testdaf.de/ http://www.kalenderblatt.de/ http://www.baden-wuerttemberg.de/ http://www.saarbruecken.de/ http://www.kompetenzz.de/ http://www.aquarius.geomar.de/ http://www.uni-duesseldorf.de/ http://www.urlaubstage.de/ http://www.wiley-vch.de/ http://www.mohr.de/ http://www.bessy.de/ http://www.bayerninfo.de/ http://www.uni-osnabrueck.de/ http://www.stuttgarter-zeitung.de/ http://www.mathguide.de/ http://www.blk-bonn.de/ http://www.slowfood.de/ http://www.schaubuehne.de/ http://www.unibw-muenchen.de/ It avoids sending emails to e-mail addresses containing the following strings: @microsoft rating@ f-secur news update anyone@ bugs@ contract@ feste gold-certs@ help@ info@ nobody@ noone@ kasp admin icrosoft support ntivi unix bsd linux listserv certific sopho @foo @iana free-av @messagelab winzip winrar samples abuse panda cafee spam pgp @avp. noreply local root@ postmaster@ It sends itself to all the e-mail it finds in the format described above. It listens on port 1080 for connections. INSTRUCCIONES DE LIMPIEZA: Let Bitdefender delete all infected files it finds.ANALIZADO POR: Sorin Victor DudeaBitDefender AntiVirus Researcher |