Virus Update

[StRiDeR]

W32/Mimail-V

Aliases

I-Worm.Mimail.r, VBS/Inor, Win32/Moba.A, W32.Opasa@mm, HTML_MOBA.A

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

A detailed analysis of W32/Mimail-V will be published here shortly. Please check again later.

Recovery

Please follow the instructions for removing worms.

[StRiDeR]

W32/Netsky-Z

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


Sophos has received several reports of this worm from the wild.


Description

W32/Netsky-Z is an internet worm which spreads by emailing itself to addresses found within files on the local computer.
When first run W32/Netsky-Z copies itself to the Windows folder as Jammer2nd.exe and creates the following registry entry so that Jammer2nd.exe is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Jammer2nd = <WINDOWS>\Jammer2nd.exe

Copies of the worm in Base64 encoded and ZIP form are created in the Windows folder with names matching pk_zip?.log where ? is a number.

The emails use a subject and message randomly selected from the following:

Subject lines:
Information
Hi
Document
Important

Message texts:
Important bill!
Important notice!
Important document!
Important data!
Important textfile!
Important details!
Important informations!
Important!
Important notice!

Attached file(Zip archive):
Bill.zip
Notice.zip
Important.zip
Data.zip
Textfile.zip
Details.zip
Part-2.zip
Informations.zip

W32/Netsky-Z also opens a listening port on TCP 665

Thw worm will launch a denial of service attack on the following sites after 5 May 2004:

www.educa.ch
www.medinfo.ufl.edu
www.nibis.de


Recovery

Please follow the instructions for removing worms.

[StRiDeR]

W32/Agobot-EV

Aliases

W32/Gaobot.worm.gen.g virus, Win32/Agobot.IH trojan, W32.HLLW.Gaobot.gen

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

W32/Agobot-EV is an IRC backdoor Trojan and peer-to-peer (P2P) worm which
opens TCP ports to listen for and process commands received from a remote intruder.
This worm will move itself into the Windows System32 folder under the
filename regsvc32.exe and create the following registry entries so that it can
execute automatically on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Generic Service Process = regsvc32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Generic Service Process = regsvc32.exe

W32/Agobot-EV will attempt to terminate anti-virus and software firewall
processes, in addition to other viruses, worms or Trojans.

This worm will search for shared folders on the internet with weak passwords
and copy itself into them.

W32/Agobot-EV can sniff HTTP, VULN, FTP and IRC network traffic and steal data
from them. This worm can also exploit the DCOM vulnerability on unpatched
systems and manipulate registry keys.

This worm will attempt to test the available bandwidth by posting data to
the following sites:

yahoo.co.jp
www.nifty.com
www.d1asia.com
www.st.lib.keio.ac.jp
www.lib.nthu.edu.tw
www.above.net
www.level3.com
nitro.ucsc.edu
www.burst.net
www.cogentco.com
www.rit.edu
www.nocster.com
www.verio.com
www.stanford.edu
www.xo.net
de.yahoo.com
www.belwue.de
www.switch.ch
www.1und1.de
verio.fr
www.utwente.nl
www.schlund.net

W32/Agobot-EV can also be used to initiate denial-of-service (DoS) and
synflood/httpflood/udpflood attacks against remote systems.

This worm can redirect TCP and GRE data and steal the Windows Product ID
and keys from several computer games.

W32/Agobot-EV maps several anti-virus and security-related websites to
localhost within the windows hosts file so that they appear unreachable
when a user tries to access them.


Recovery

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Generic Service Process = regsvc32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Generic Service Process = regsvc32.exe

and delete them if they exist.

Close the registry editor.

[StRiDeR]

Troj/Legmir-K

Aliases

PSW.QQpass.ak, Lemir-Gen, Legmir-AH

Type

Trojan

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this Trojan from the wild.


Description

Troj/LegMir-K is a password-stealing Trojan.
In order to run automatically when Windows starts up the Trojan copies
itself to the file intrenat.exe in the Windows folder and adds the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Intrenat = C:\WINDOWS\intrenat.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Intrenat = C:\WINDOWS\intrenat.exe

Troj/LegMir-K also creates the file exp1orer.dll in the Windows folder. This file is already detected as Troj/LegMir-E.

To avoid detection, Troj/LegMir-K attempts to terminate the following processes:

EGHOST.EXE
MAILMON.EXE
KAVPFW.EXE
RAVTIMER.EXE
RAVMON.EXE
CCENTER.EXE
NAVAPW32.EXE

Troj/LegMir-K stores stolen passwords in the HKCR section of the registry
and sends them to the author via email. The destination email address and
the exact location in the registry can both be configured by the author.


Recovery

Please follow the instructions for removing Trojans.

Change any passwords that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Intrenat = C:\WINDOWS\intrenat.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Intrenat = C:\WINDOWS\intrenat.exe

and delete them if they exist.

Close the registry editor.

[StRiDeR]

Troj/StartPa-AE

Aliases

Trojan.WinREG.StartPage

Type

Trojan

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this Trojan from the wild.


Description

Troj/StartPa-AE changes browser settings for Microsoft Internet Explorer each
time Windows is started.
Troj/StartPa-AE is simply a text file (typically named sysdll.reg) which can
be used as an input to Regedit to set the following registry entries:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\HOMEOldSP
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\HOMEOldSP
HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys = "regedit -s sysdll.reg"

The last of these registry entries causes the registry to be updated using
Troj/StartPa-AE each time Windows is started.

Troj/StartPa-AE may be installed on the computer by Troj/AdClick-AE.


Recovery

Please follow the instructions for removing Trojans.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

Windows NT/2000/XP

In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys = "regedit -s sysdll.reg"

and delete it if it exists.

Close the registry editor.

[StRiDeR]

Troj/Banker-S

Type

Trojan

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this Trojan from the wild.


Description

Troj/Banker-S is a password stealing Trojan that attempts to capture keylogs
associated with web browsing.
Troj/Banker-S creates the following files which are all detected by this
identity:

<Windows>\dllreg.exe
<Windows>\sock64.dll
<StartUp>\rundllw.exe
<Windows System>\load32.exe
<Windows System>\vxdmgr32.exe

In order to run on system restart Troj/Banker-S creates the following
registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\load32

Troj/Banker-S adds the name of one of the copies of itself to the Run= line of
win.ini and the shell= line of system.ini.

Troj/Banker-S uses it's own SMTP engine to send results of the keylogger to a
russian email address.


Recovery

Please follow the instructions for removing Trojans.

[StRiDeR]

W32/Agobot-MN

Aliases

Backdoor.Agobot.mn

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

W32/Agobot-MN is an IRC backdoor Trojan and network worm.
W32/Agobot-MN is capable of spreading to computers on the local network
protected by weak passwords.

When first run, W32/Agobot-MN copies itself to the Windows system folder as
runtime.exe and creates the following registry entries to run itself on
startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
smrtdrv = runtime.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
smrtdrv = runtime.exe

On NT based versions of Windows the worm creates a new service named
"Smart Drive" with a display name of "smrtdrv" and a startup property of
automatic, so that the service starts automatically each time Windows is
started.

The Trojan runs continuously in the background providing backdoor access to
the computer.

The Trojan attempts to terminate and disable various anti-virus and security
related programs and modifies the HOSTS file located at
%WINDOWS%\System32\Drivers\etc\HOSTS, mapping selected anti-virus websites
to the loopback address 127.0.0.1 in an attempt to prevent access to these
sites. Typically the following mappings will be appended to the HOSTS file:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com


Recovery

Please follow the instructions for removing worms.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the worm has made.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
smrtdrv = runtime.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
smrtdrv = runtime.exe

and delete them if they exist.

Close the registry editor.

[StRiDeR]

VBS/Yarr-A

Aliases

HTML_MOBA.A, VBS/Inor trojan

Type

Visual Basic Script worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

VBS/Yarr-A overwrites notepad.exe with the W32/Mimail-V worm.

Recovery

Please follow the instructions for removing worms.

[StRiDeR]

W32/Netsky-AA

Aliases

W32/Netsky.aa@MM virus, INFECTED I-Worm.NetSky.ab

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received no reports from users affected by this worm. However, we have issued this advisory following enquiries to our support department from customers.


Description

W32/Netsky-AA is a mass mailing worm. When started the worm copies itself to the Windows folder using the name winlogon.scr and sets the following registry entry to auto start on user logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
SkynetsRevenge = <WINDOWS>\winlogon.scr

W32/Netsky-AA will harvest email addresses from files on any fixed drives with the following extensions:

EML TXT PHP CFG MBX MDX ASP WAB DOC VBS RTF UIN SHTM CGI DHTM ADB TBB DBX PL HTM HTML SHT OFT MSG ODS STM XLS JSP WSH XML MHT MMF NCH PPT

The subject lines and message texts are constructed randomly from the following building blocks:

Subject Lines:

Re: Document
Re: Approved
Re: Text
Re: Thank you!
Re: Details
Re: Photos
Re: Private
Re: Information
Re: Hi
Re: Hello
Re: Summary
Re: Step by Step
Re: Music
Re: Application
Re: Tel. Numbers
Re: List
Re: Text file
Re: Paint file
Re: Contacts
Re: e-Books
Re: Bill
Re: Error
Re: Missed
Re: Letter
Re: Product
Re: Website
Re: Movie
Re: Presentation
Re: Advice
Re: Fax number
Re: Cheaper
Re: War
Re: Demo
Re: Final
Re: Poster
Re: Patch
Re: Pricelist
Re: Job

Message Texts:

For furher details see the attached file.
Your file is attached.
Please read the attached file.
Please have a look at the attached file.
Please take the attached file.
See the attached file for details.
Please view the attached file.
Here is the file.
Your document is attached.

Attachment names:

Your_Job.pif
Your_Pricelist.pif
Your_Patch.pif
Your_Poster.pif
Your_Final_Document.pif
Your_Demo.pif
Osam_Bin_Laden_Articel_42.pif
Your_Product_List.pif
My_Fax_Numbers.pif
My_Advice.pif
Your_Presentation.pif
Your_Movie.pif
Your_Website.pif
Your_Product.pif
Your_Letter.pif
Your_Excel_Document.pif
Your_Error.pif
Your_Bill.pif
Your_E-Books.pif
Your_Contacts.pif
Your_Paint_File.pif
Your_Text_File.pif
Your_List.pif
My_Telephone_Numbers.pif
Your_Software.pif
Your_Music.pif
Your_Description.pif
Your_Summary.pif
Your_Digicam_Pictures.pif
Your_Information.pif
Your_Private_Document.pif
Your_Pics.pif
Your_Details.pif
Your_Document_Part3.pif
Your_Text.pif
Your_Document.pif


Recovery

Please follow the instructions for removing worms.

[StRiDeR]

W32/Netsky-AB

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


Sophos has received several reports of this worm from the wild.


Description
W32/Netsky-AB is a mass-mailing worm that uses its own SMTP engine to
email itself to addresses harvested from files on local drives.
In order to run automatically when the user logs on to the computer the worm
copies itself to the file csrss.exe in the Windows folder and creates the following registry entry to point to it:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BagleAV

The worm will delete registry entries under this key that point to files named
drvsys.exe and ssgrate.exe. These are copies of files related to the Bagle
family of worms that may have been dropped by previous infections.

W32/Netsky-AB will gather information about infected systems in a log file
called C:\Detlog.txt.

Emails have the following characteristics:

Subject lines chosen from:

Correction
Hurts
Privacy
Password
Wow
Criminal
Pictures
Text
Money
Stolen
Found
Numbers
Funny
Only love?
More samples
Picture
Letter
Question

Message texts chosen from:

Please use the font arial!
How can I help you?
Still?
Ive your password. Take it easy!
Why do you show your body?
Hey, are you criminal?
Your pictures are good!
The text you sent to me is not so good!
True love letter?
Do you have no money?
Do you have asked me?
Ive found your creditcard. Check the data!
Are your numbers correct?
You have no chance...
Wow! Why are you so shy?
Do you have more samples?
Do you have more photos about you?
Do you have written the letter?
Does it hurt you?
Please do not sent me your illegal stuff again!!!

Attached filename chosen from:

corrected_doc.pif
hurts.pif
document1.pif
passwords02.pif
image034.pif
myabuselist.pif
your_picture01.pif
your_text01.pif
your_letter.pif
your_bill.pif
my_stolen_document.pif
visa_data.pif
pin_tel.pif
your_text.pif
loveletter02.pif
all_pictures.pif
your_letter_03.pif
your_picture.pif
abuses.pif

W32/Netsky-AB will attempt to terminate antivirus-related processes whose
filenames contain text taken from the following list:

iruslis
antivir
sophos
freeav
andasoftwa
skynet
messagelabs
aspersky
itdefender
f-secur
ymantec
antivi
icrosoft

W32/Netsky-AB will try to establish a connection with the following addresses:

212.7.128.162
212.7.128.165
193.193.158.10
194.25.2.131
194.25.2.132
194.25.2.133
194.25.2.134
62.155.255.16
212.185.252.73
212.185.253.70
212.185.252.136
194.25.2.129
194.25.2.130
195.20.224.234
217.5.97.137
194.25.1.129
193.193.144.12
193.141.40.42
145.253.2.171
193.189.244.205
213.191.74.19
151.189.13.35
195.185.185.195
212.44.160.8

W32/Netsky-AB harvests email addresses from files with the following
extensions:

ppt,nch,mmf,mht,xml,wsh,jsp,xls,stm,ods,msg,oft,sht,html,htm,pl,dbx,tbb,adb,
dhtm,cgi,shtm,uin,rtf,vbs,doc,wab,asp,mdx,mbx,cfg,php,txt,eml

W32/Netsky-AB contains the text 'Hey Bagle, feel our revenge!.


Recovery

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Delete the file C:\Detlog.txt if it exists.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BagleAV

and delete it if it exists.

Close the registry editor.

[StRiDeR]

Troj/StartPa-AE

Aliases

Trojan.WinREG.StartPage

Type

Trojan

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this Trojan from the wild.

Note: The IDE issued for Troj/StartPa-AE at 15:54 GMT on 22 April also contained detection for Troj/Mixtar-B, Troj/Agent-E, Troj/Ketch-B, Troj/StartPa-GH, Troj/DeathCo-B, W32/FlyVB-A, Troj/Agent-L and Troj/IEStart-H. This IDE has now been updated to enhance detection of Troj/Agent-L.


Description

Troj/StartPa-AE changes browser settings for Microsoft Internet Explorer each
time Windows is started.
Troj/StartPa-AE is simply a text file (typically named sysdll.reg) which can
be used as an input to Regedit to set the following registry entries:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\HOMEOldSP
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\HOMEOldSP
HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys = "regedit -s sysdll.reg"

The last of these registry entries causes the registry to be updated using
Troj/StartPa-AE each time Windows is started.

Troj/StartPa-AE may be installed on the computer by Troj/AdClick-AE.


Recovery

Please follow the instructions for removing Trojans.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

Windows NT/2000/XP

In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys = "regedit -s sysdll.reg"

and delete it if it exists.

Close the registry editor.

[StRiDeR]

W32/Agobot-NA

Aliases

Backdoor.Agobot.gen, W32/Gaobot.worm.gen.j, W32.HLLW.Gaobot.gen

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

W32/Agobot-NA is a backdoor Trojan and worm which spreads to computers protected by weak passwords.
When first run, W32/Agobot-NA copies itself to the Windows system folder as wmiprvsw.exe and creates the following registry entries to run itself on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Updater Service = wmiprvsw.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
System Updater Service = wmiprvsw.exe

The worm runs continuously in the background providing backdoor access to the computer.

W32/Agobot-NA attempts to terminate and disable various anti-virus and security-related programs. The worm also modifies the HOSTS file located at
%WINDOWS%\System32\Drivers\etc\HOSTS,
mapping selected anti-virus websites to the loopback address 127.0.0.1 in an attempt to prevent access to these sites. Typically the following mappings will be appended to the HOSTS file:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com

W32/Agobot-NA will also attempt to retrieve data from the following websites:
www.st.lib.keio.ac.jp
www.nocster.com
www.rit.edu
nitro.ucsc.edu
www.ryan1918.com
www.nifty.com
de-tschakka.no-ip.info
yahoo.co.jp
www.ryan1918.org
www.utwente.nl
de.yahoo.com
www.d1asia.com
www.belwue.de
www.burst.net
www.above.net
www.schlund.net


Recovery

Please follow the instructions for removing worms.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the worm has made.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Updater Service = wmiprvsw.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
System Updater Service = wmiprvsw.exe

and delete them if they exist.

Close the registry editor.

[StRiDeR]

How To: Detect Internet Worms


Your anti-virus software can't always detect new worm viruses, which are transmitted so quickly across the Internet that thousands of computers can be infected before even the anti-virus software developers are aware of their existence.

However, it's easy to detect them yourself and avoid infection by using the software between your ears! By following a few simple steps you can detect most email-borne worm viruses.

Remember, most worms are activated by running a program or opening a Word or Excel document containing macros. This is usually attached to an email and disguised as a document or image file. The worm is only activated when you open the attachment, so the text of the message usually asks you to do that.

So here's what to do. Whenever you receive an email that contains an attachment, ask yourself:

"Do I know the person who has sent me this message with an attachment?"

"Was I expecting to receive the attached file from this person?"

"Does the text of the accompanying message look as if it was written by the person from whom the message seems to have come?"

If the answer to one or more of these questions is "No", it's quite possible that the message was automatically generated by a worm virus. Do not open the attachment. Either delete the message immediately, or reply to the sender asking if they really sent the message and don't open the attachment unless they say they did.

[StRiDeR]

W32/Sasser-D

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


Sophos has received several reports of this worm from the wild.


Description

W32/Sasser-D is a network worm which spreads by exploiting the Microsoft LSASS vulnerability on port 445.
For further information on this vulnerability see Microsoft Security Bulletin MS04-011.

When first run W32/Sasser-D copies itself to the Windows folder with the filename skynetave.exe and creates the following registry entry, so the worm is run automatically each time Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
skynetave.exe = %WINDOWS%\skynetave.exe

A harmless text file is created in the C:\ root folder named win2.log.


Recovery

Please read the instructions for removing W32/Sasser-D.

[StRiDeR]

W32/Bugbear-G

Aliases

W32.Bugbear.E@mm, W32/Bugbear.gen@MM virus

Type

Win32 worm

Detection

A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the June 2004 (3.82) release of Sophos Anti-Virus.

Customers using Enterprise Manager, PureMessage and any
of the Sophos small business solutions will be automatically protected at their next scheduled update.


At the time of writing, Sophos has received just one report of this worm from the wild.


Description

W32/Bugbear-G is a worm which spreads via email. The subject line and attached file of the email sent by the worm are variable and may be taken from information on the infected computer. The attached file has an extension of PIF.
W32/Bugbear-G creates a copy of itself with a randomly generated name in the
Windows system folder. To ensure that the copy of the worm is run each time
Windows is started the worm adds a randomly named value to the registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

The worm creates several other files with random names in the Windows system
folder. One of the files is a DLL used to monitor the user's keystrokes. This
DLL will be detected by Sophos Anti-Virus as W32/Bugbear-B.

W32/Bugbear-G terminates the following anti-virus and security related
processes:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
ACKWIN32.EXE
ANTI-TROJAN.EXE
APVXDWIN.EXE
AUTODOWN.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCTRL.EXE
AVKSERV.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVWIN95.EXE
AVWUPD32.EXE
BLACKD.EXE
BLACKICE.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
CLAW95.EXE
CLAW95CF.EXE
CLEANER.EXE
CLEANER3.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
ESAFE.EXE
ESPWATCH.EXE
F-AGNT95.EXE
F-PROT.EXE
F-PROT95.EXE
F-STOPW.EXE
FINDVIRU.EXE
FP-WIN.EXE
FPROT.EXE
FRW.EXE
IAMAPP.EXE
IAMSERV.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFACE.EXE
IOMON98.EXE
JEDI.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LUALL.EXE
MOOLIVE.EXE
MPFTRAY.EXE
N32SCANW.EXE
NAVAPW32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVW32.EXE
NAVWNT.EXE
NISUM.EXE
NMAIN.EXE
NORMIST.EXE
NUPGRADE.EXE
NVC95.EXE
OUTPOST.EXE
PADMIN.EXE
PAVCL.EXE
PAVSCHED.EXE
PAVW.EXE
PCCWIN98.EXE
PCFWALLICON.EXE
PERSFW.EXE
RAV7.EXE
RAV7WIN.EXE
RESCUE.EXE
SAFEWEB.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SERV95.EXE
SMC.EXE
SPHINX.EXE
SWEEP95.EXE
TBSCAN.EXE
TCA.EXE
TDS2-98.EXE
TDS2-NT.EXE
VET95.EXE
VETTRAY.EXE
VSCAN40.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSSTAT.EXE
WEBSCANX.EXE
WFINDV32.EXE
ZONEALARM.EXE


Recovery

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.