If you came to this page directly, click the icon at the left to be taken to our Home Page| If you came to this page directly, click the icon at the left to be taken to our Home Page |
||||
|
|
||||
|
|
March 2004 Select the links for detailed information and removal tools for the latest viruses
|
|
|
W32.Netsky.D@mm W32.Netsky.D@mm is a mass-mailing worm that is a variant of W32.Netsky.C@mm. The worm scans drives C through Z for email addresses and sends itself to those that are found. The Subject,
Body, and Attachment names vary. The attachment will have a .pif file
extension. Read
the full Symantec report: W32.Netsky.E@mm W32.Netsky.E is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. This worm also searches drives C through Y for folders that have names containing "Shar," and then copies itself to those folders. The Subject, Body, and Attachment vary. Read
the full Symantec report: W32.Beagle.H@mm W32.Beagle.H@mm is a mass-mailing worm that opens a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. It also sends the attacker the port on which the backdoor listens, as well as the IP address. The email attachment is a randomly named .exe file inside a .zip file. The embedded .exe file is password-protected with a random password. Read
the full Symantec report: W32.Beagle.I@mm W32.Beagle.I@mm is a mass-mailing worm that opens a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. It also sends the attacker the port on which the backdoor listens, as well as the IP address. The email attachment is a randomly named .exe file inside a .zip file. The embedded .exe file is password-protected with a random password. W32.Beagle.I@mm also attempts to spread across file-sharing networks, such as Kazaa and iMesh, by dropping itself into the directories that contain "shar" in their names. From: <spoofed> W32.Beagle.I@mm is functionally identical to W32.Beagle.H@mm. Read
the full Symantec report: W32.Mydoom.G@mm The W32.Mydoom.G@mm worm: Is a mass-mailing
worm that opens a backdoor on TCP ports 80 and 1080 The worm
arrives as an attachment with the file extension .bat, .com, .cmd, .exe,
.pif, .scr, or .zip. The From: line of the email may be spoofed. • May delete the files with certain extensions. For example, .jpg, .avi, and .bmp. • Performs DoS against www.symantec.com. • Allows unauthorized remote access. Read
the full Symantec report: W32.Hiton@mm
Symantec Security Response has received reports of a new mass-mailing worm. At this time we have received no customer submissions of this threat. A sample has been obtained and we will provide information as our analysis progresses. Read
the full Symantec report: W32.Beagle.J@mm
W32.Beagle.J@mm is a mass-mailing worm that opens a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. It also sends the attacker the port on which the backdoor listens, as well as the IP address. The email attachment is a randomly named .exe file inside a .zip file, or an executable .pif file. The zip file will be password-protected. The from address is spoofed to appear as though its coming from the one of the following addresses at the recipients domain: management, administration, staff, noreply, or support. W32.Beagle.J@mm also attempts to spread across file-sharing networks, such as Kazaa and iMesh, by dropping itself into the directories that contain "shar" in their names.
Read
the full Symantec report: W32.Netsky.F@mm W32.Netsky.F@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The Subject, Body, and Attachment vary. Note: Symantec Security Response is currently investigating this worm. More information will be published as soon as it is available. Read
the full Symantec report: W32.Beagle.K@mm The W32.Beagle.K@mm worm: Is a variant
of W32.Beagle.J@mm that opens a backdoor on TCP port 2745 and uses its
own SMTP engine to spread through email. The email
has the following characteristics: Read
the full Symantec report: W32.Mydoom.H@mm The W32.Mydoom.H@mm worm: Is a mass-mailing
worm that opens a backdoor on TCP ports 80 and 1080 The worm
arrives as an attachment with the file extension .bat, .com, .cmd, .exe,
.pif, .scr, or .zip. The From: line of the email may be spoofed. Read
the full Symantec report: W32.Netsky.G@mm W32.Netsky.G@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The Subject, Body, and Attachment vary. If an infected computer's time is between 6:00 A.M. and 9:00 A.M. on Tuesday, March 10, 2004, the PC speaker will beep in a continuous loop. Each beep will be for a random period of time, at a random frequency.Read
the full Symantec report: W32.Netsky.H@mm W32.Netsky.H@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The Subject, Body, and Attachment vary. If an infected computer's system clock is between 11:00 A.M. and 12:00 P.M. on March 8th, 2004, the PC speaker will beep in a continuous loop. Each beep will be for a random period of time, at a random frequency. Read
the full Symantec report: W32.Netsky.I@mm W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The email
has the following characteristics: Mail account
expired Body: (One of the following) Your mail
account expired. Please follow the link to reactivate. Read
the full Symantec report: W32.Sober.D@mm W32.Sober.D@mm is a mass-mailing worm that replicates in the form of an email using its own SMTP client engine. The subject and the body of the email varies and is written in either English or German. W32.Sober.D@mm is a Visual Basic application, packed with UPX. Sober.D disguises itself as a Microsoft Update in both English and German language versions. Copies of the Sober.D worm arrive in e-mail messages with the subject "Microsoft Alert: Please Read!" or "Microsoft Alarm: Bitte Lesen!" said the antivirus company. The worm file is embedded in file attachments with the .exe or .zip file extension and names such as "Patch," "MS-Security" and "UpDate." The worm displays the following messages: • This
patch has been successfully installed. Read
the full Symantec report: W32.Netsky.J@mm W32.Netsky.J@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The sent email will have the following characteristics: Subject:
One of the following: Where %s is the portion of the "To" address before the "@". Body: One
of the following: Where %i is a random number. Attachment:One
of the following: Where %s
is the portion of the "To" address before the "@". Read
the full Symantec report: W32.Keco@mm W32.Keco@mm is a mass mailing worm that spreads via its own SMTP engine. It mails itself to all email addresses it finds on an infected computer. If the mail cannot be sent, the worm continues to open ports sequentially. This could freeze a system. Displays a message box that says, "Now this will try to send a mail to Askel ;D" Creates a file C:\coke.txt, which contains rude messages to other worm writers. Creates a
mail message which may contain one of the following subjects: The subject
may be preceded with Re: , re: , Fwd: or FWD: It attempts
to connect to predefined IRC servers via IRC port 6667. User names are
random, but always end with domain "@foo.bar." Read
the full Symantec report: W32.Netsky.K@mm W32.Netsky.K@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has .pif as extension. The email has the following characteristics:From: Spoofed Subject: The subject line is one of the following: Re: Your
website Message: The message is one of the following: Your file
is attached. Attachment: The attachment is one of the following: your_website.pif
If the system time is between 6:00 A.M. and 9:00 A.M. on Tuesday, March 2, 2004, the PC speaker will beep in a continuous loop. Each beep will be for a random period of time, at a random frequency. Read
the full Symantec report: W32.Cone.C@mm W32.Cone.C@mm is a minor variant of W32.Cone@mm. The worm sends itself to the email addresses it gathers from the files on an infected computer. The worm also modifies the local hosts file to prevent access to various websites. The attachment will have an .exe, .scr, or .zip file extension. From: <Spoofed> Subject:
(One of the following) Attachment:
(One of the following) Read
the full Symantec report: W32.Netsky.L@mm
W32.Netsky.L@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has a .pif extension. The email has the following characteristics:From: <Spoofed> Subject: The subject line is one of the following: Re: Important
Message: The message is one of the following: Your file
is attached. Attachment: The attachment is one of the following: your_file_%s.pif
where %s is the portion of the "To" address before the "@". Read
the full Symantec report: W32.Netsky.M@mm
W32.Netsky.M@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has a .pif extension. The email has the following characteristics:From: <Spoofed> Subject: The subject line is one of the following: Re: <%s>
Requested file Message: The message is one of the following: Details for
%s. Attachment: The attachment is one of the following: improved_%s.pif
where %s
is the portion of the "To" address before the "@". Read
the full Symantec report: W32.Cone.D@mm W32.Cone.D@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it gathers from the files on an infected computer. The attachment will have an .exe or .zip file extension. The email has the following characteristics:From: Spoofed Subject: The subject is one of the following: RE: the attachment
is in the SKY [weN] where %s is the recipient name. Message: The message is one of the following: Hi lucky, Dear user of <recipient name>, We warn you
about some attacks on your e-mail account. Your computer may contain viruses,
in order to keep your computer and e-mail account safe, The Management, take it easy
Warning!!! Read
the full Symantec report: W32.Beagle.M@mm The W32.Beagle.M@mm is a polymorphic mass-mailing worm that uses its own SMTP engine to spread through email. Like previous Beagle variants, this worm opens a backdoor (it listens on TCP port 2556), and attempts to spread through file-sharing networks by copying itself to folders that contain "shar" in their names. W32.Beagle.M@mm also infects files with the EXE extension. The email has the following characteristics: From: Spoofed to appear as though it is coming from the one of the following addresses at the recipient's domain: management
Subject:
One of the following: Attachment:
A randomly named .exe file, stored inside a .zip file or a .rar file,
or a .pif file. The .zip and .rar files file may be password-protected.
The filename, minus the extension, is one of the following: Read
the full Symantec report: W32.Beagle.N@mm W32.Beagle.N@mm is a polymorphic mass-mailing worm that uses its own SMTP engine to spread through email. Like previous Beagle variants, this worm opens a backdoor (it listens on TCP port 2556), and attempts to spread through file-sharing networks by copying itself to folders that contain "shar" in their names. W32.Beagle.N@mm also infects files with the EXE extension.The email has the following characteristics: From: Spoofed to appear as though it is coming from the one of the following addresses at the recipient's domain: management
Subject:
One of the following: Attachment:
A randomly named .exe file, stored inside a .zip file or a .rar file,
or a .pif file. The .zip and .rar files file may be password-protected.
The filename, minus the extension, is one of the following: Read
the full Symantec report: W32.Netsky.N@mm W32.Netsky.N@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has a .pif extension. The email has the following characteristics:From: <Spoofed> Subject: The subject line is composed of multiple parts. The first part may be one of the following: Re:
my
application
Authentication
required. Followed
by: application_%s
where %s
is the portion of the "To" address before the "@". Read
the full Symantec report: W32.Netsky.O@mm W32.Netsky.O@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The "sender" of the email is spoofed, and its subject line and message body of the email vary. The attachment is one of the following: readme.pif
Read
the full Symantec report: W32.Beagle.O@mm W32.Beagle.O@mm is a polymorphic mass-mailing worm that uses its own SMTP engine to spread through email. The worm opens a backdoor on TCP port 2556 and attempts to spread through file-sharing networks by copying itself to the folders that contain "shar" in their names. W32.Beagle.O@mm also infects files with the .exe file extension. The email has the following characteristics: From: Spoofed
to appear as though it is coming from a predetermined addresses at the
recipient's domain. W32.Beagle.O@mm
exploits the vulnerability described in Microsoft Security Bulletin MS03-040
to propagate. Symantec Security Response is currently investigating this
aspect of the threat and will post more information as it becomes available.
Read
the full Symantec report: W32.Beagle.R@mm W32.Beagle.R@mm is a variant of W32.Beagle.O@mm. This worm attempts to send an HTML email to the addresses found in the files on an infected computer. The email does not contain an attachment of the worm. Instead, the HTML email uses the Microsoft Internet Explorer Object Tag Vulnerability that allows for the automatic download and execution of a file hosted on a remote Web site. This file is a copy of the worm, but may change in the future. The worm also opens a backdoor, starts a Web server on port 81 to serve the worm, and attempts to spread through file-sharing networks by copying itself to the folders with "shar" in their names. The worm is also a file infector that appends itself to the .exe files found in the c:\emails folder on the computer.
Obtain the patch as described in Microsoft Security Bulletin MS03-040 Uses its own SMTP engine to send itself to the email addresses it collected. The worm contains its own MIME-encoding routine and will compose the email in memory. The email has the following characteristics: From: (One
of the following)
Read
the full Symantec report: W32.Beagle.S@mm W32.Beagle.S@mm is a variant of W32.Beagle.O@mm. This worm attempts to send an HTML email to addresses found in files on an infected computer. The email does not contain an attachment of the worm. Instead, the HTML email uses the Microsoft Internet Explorer Object Tag Vulnerability that allows for the automatic download and execution of a file hosted on a remote Web site. This file is a copy of the worm, but may change in the future. The worm also opens a backdoor, starts a Web server on TCP port 81 to serve the worm, and attempts to spread through file-sharing networks by copying itself to the folders with "shar" in their names. The worm is also a file infector that appends itself to the .exe files found in the c:\emails folder on the computer. Obtain the
patch as described in Microsoft
Security Bulletin MS03-040 Read
the full Symantec report: W32.Beagle.T@mm W32.Beagle.T@mm is a variant of W32.Beagle.R@mm. This worm attempts to send an HTML email to the addresses found in the files on an infected computer. The email does not contain an attachment of the worm. Instead, the HTML email uses the Microsoft Internet Explorer Object Tag Vulnerability that allows for the automatic download and execution of a file hosted on a remote Web site. This file is a copy of the worm, but may change in the future. The worm
also opens a backdoor, starts a Web server on port 81 to serve the worm,
and attempts to spread through file-sharing networks by copying itself
to folders with "shar" in their names. The worm is also a file
infector that appends itself to the .exe files found on the computer. Obtain the patch as described in Microsoft Security Bulletin MS03-040 Read
the full Symantec report: W32.HLLW.Lovgate.N@mm W32.HLLW.Lovgate.N@mm is a variant of W32.HLLW.Lovgate@mm. This variant is also a mass-mailing worm that attempts to email itself to all the email addresses it finds in the system. The "sender" of the email is spoofed, and its subject line and message body of the email vary. This worm
also attempts to copy itself to all the computers on a local network and
the KaZaA shared folder. Compromises security settings: Terminates processes belonging to various security programs. Replies to all the incoming messages when they arrive in the mailbox of certain MAPI-compliant email clients, which include Microsoft Outlook. If the original email is: Subject:
<subject> the worm will attempt to send the following email: Subject:
Re: <subject> <sender's domain> account auto-reply: followed by one of the following: If you can
keep your head when all about you > Get your FREE <sender's domain>now! < Attachment: The attachment is one of the following: the hardcore
game-.pif Read
the full Symantec report: W32.HLLW.Polybot W32.HLLW.Polybot is a worm that attempts to spread through network shares that have weak passwords and allows attackers to access an infected computer using a predetermined IRC channel. The worm uses multiple vulnerabilities to spread, including: • The
DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026)
using TCP port 135. Releases
confidential info: Allows unauthorized remote access. Allows an attacker to remotely control a compromised computer and perform any of the following actions: • Download
and execute files Read
the full Symantec report: W32.HLLW.Antinny.G The W32.HLLW.Antinny.G worm is a variant of W32.HLLW.Antinny. It spreads using the Winny file-sharing network. The worm steals personal information, including name, email and files, and sends it to a file-sharing network. The worm has the Notepad icon or a Windows folder icon. Read
the full Symantec report: W32.Witty.Worm W32.Witty.Worm utilizes a Vulnerability in ICQ Parsing by ISS Products. The worm sends itself out to multiple IP addresses on source port 4000/UDP and a random destination port. The worm is a memory-only based threat and does not create files on the system. The worm has a payload of overwriting random sectors of a random hard disk. NOTE: If your system is not running a vulnerable version of one of the products affected, then you will not be infected. Products affected by this vulnerability are listed below: BlackICE™
Agent for Server 3.6 ebz, ecd, ece, ecf If you are running a product that has the vulnerability used by the worm, we recommend that you apply the relevant patch as soon as possible. Patches for this vulnerability are available at http://blackice.iss.net/update_center/index.php. Read
the full Symantec report: W32.Netsky.Q@mm W32.Netsky.Q@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The "sender" of the email is spoofed, and its subject line and message body of the email vary. The attachment name varies with .exe, .pif, .scr, or .zip file extension. The worm also trys to spread itself via varies file-sharing methods by copying itself into directories with enticing filename. Deletes these values:Explorer from the
registry key:
system. from the
registry key:
Explorer from the
registry key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\PINF
The email has the following characteristics: From: <Spoofed> Subject: The subject line is one of the following: Re: Encrypted
Mail
"@microsof"
Read
the full Symantec report: W32.Netsky.P@mm W32.Netsky.P@mm (also known as W32.Netsky.Q@mm) is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The worm also tries to spread through various file-sharing programs by copying itself into various shared folders. The From line of the email is spoofed, and its Subject line and message body of the email vary. The attachment name varies with the .exe, .pif, .scr, or .zip file extension. The worm
uses the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment
vulnerability to cause unpatched systems to auto-execute the worm when
reading or previewing an infected message. Read
the full Symantec report: Download the removal tool here W32.HLLW.Lovgate.O@mm W32.HLLW.Lovgate.O@mm is a variant of W32.HLLW.Lovgate@mm. This variant is also a mass-mailing worm that attempts to reply to all the email messages in the Microsoft Outlook Inbox. The "sender" of the email is spoofed, and its subject line and message vary. The attachment name varies with a .exe, .pif, or .scr file extension. This worm
also attempts to copy itself to all the computers on a local network and
to Kazaa-shared folders. Compromises security settings: Terminates processes belonging to various antivirus programs. Replies to all the incoming messages when they arrive in the mailbox of certain MAPI-compliant email clients, which include Microsoft Outlook. If the original email is: Subject:
<subject> the worm will attempt to send the following email: Subject:
Re: <subject> Message: <domain.com> account auto-reply: If you can
keep your head when all about you > Get your FREE <domain.com> account now! < Attachment: The attachment is one of the following: the hardcore
game-.pif Read
the full Symantec report: W32.Gaobot.SA
W32.Gaobot.SA is a worm that attempts to spread through network shares that have weak passwords and allows attackers to access an infected computer using a predetermined IRC channel. The worm uses multiple vulnerabilities to spread, including: The DCOM
RPC vulnerability (described in Microsoft Security Bulletin MS03-026)
using TCP port 135. Modifies files: Modifies hosts file. Compromises security settings: Terminates many security software processes. Allows total system compromise. Ports: Opens backdoors on two randomly selected TCP ports. TCP 80 and 135. Shared drives: Copies itself to network shares. Read
the full Symantec report: W32.Blackmal@mm W32.Blackmal@mm is a massmailing worm. It uses its own SMTP engine to email itself to all the contacts in the MSN Messenger, Yahoo Pager, and in the files whose extensions are .htm or .dbx . The email message has a randomly chosen subject line, message, and attachment. The attachment will have .src, .exe, .zip, or .tgz file extension. W32.Blackmal@mm uses Windows Media Player presentation to mask its malicious intentions and attempts to delete security software and system files. Large scale e-mailing: Email itself to all the contacts in the MSN Messenger, Yahoo Pager, , as well as in the files whose extensions are either .htm or .dbx.Deletes files: All files or executables in the following directories: %Program Files%\Norton AntiVirus\ %Program Files%\McAfee\McAfee VirusScan\Vso\ %Program Files%\Trend Micro\PC-cillin 2002\ %Program Files%\Trend Micro\PC-cillin 2003\ %Program Files%\Trend Micro\Internet Security\ %Program Files%\Symantec\LiveUpdate\ Email Routine Details The worm uses its own SMTP engine to email itself to all the email address listed in the MSN Messenger, Yahoo Pager, as well as in all the files whose extensions are either .htm or .dbx. It attempts to send the email through the default SMTP server address, which the infected computer uses. If the worm cannot find this information, then it will use one of the many SMTP server addresses that are hard-coded into the worm. Subject:
(Some possible subject lines are listed below.) Body: (Some possible message bodies are listed below.) This email
is sent to you because one Cum and check
this fun group out...Sexy ladies!! Come post your ad,..this is a real
swingers group!! Attachments: (Some possible file names are listed below.) Julia_1997_Fucking.MPEG_.scr
or hard_babe
The above
filenames are followed by one or two of the following file extenstion:
Read
the full Symantec report: W32.Snapper.A@mm W32.Snapper.A@mm
is a worm that spreads to all the contacts in the Windows Address Book.
The email has the following characteristics: From: <Spoofed> <HTML><BODY><IFRAME src='http://<omitted>/banner.htm' style='display:none'></IFRAME></HTML></BODY> Payload:
May display popup advertisements. Uses its own SMTP engine to send a message to all the contacts in the Windows Address Book. The message has the following format: From: <Spoofed> Subject: Re: Message: The message body consists of the following HTML code, which will appear to be a blank message when loaded by most mail clients: <HTML><BODY><IFRAME src='http://(omitted)/banner.htm' style='display:none'></IFRAME></HTML></BODY> When an email client loads this message, it downloads and displays the file Banner.htm.
Htmlhelp.cgi Read
the full Symantec report: W32.Beagle.U@mm W32.Beagle.U@mm
is a variant of W32.Beagle.T@mm. The worm Read
the full Symantec report: W32.Sober.E@mm The Subject: and Body: of the email vary and is written in English. Displays the following messages:Graphic Modul
not found The From
field will consist of one of the following strings followed by @gmx.net
or @gmx.de The Subject
will consist of one of the following strings: followed
by The Body
of the message will contain: The Attachment
filename will be one of the following: Read
the full Symantec report: W32.Beagle.V@mm W32.Beagle.V@mm
is a variant of W32.Beagle.U@mm. The worm sends itself as Read
the full Symantec report: W32.Netsky.R@mm W32.Netsky.R@mm is a mass-mailing worm, and a variant of W32.Netsky.Q@mm. This worm has been packed with a known runtime compression utility. Emails all addresses found in certain files on the system. Launches many threads, that may result in system instability. Searches files on the system for email addresses. The worm will search local and mapped drives. The worm contains its own SMTP engine, and it will compose an email message with the following characteristics. Subject From Body Attachment The worm
will send an email message to all contacts that were found when scanning
the system for email addresses, and it may send an email message to jena@yahoo.cz. Read
the full Symantec report: |
|
|
©
Copyright 1999 - 2004 The Computer Wizard
|
||||
