June 2004

Select the links for detailed information and removal tools for the latest viruses

W32.Gaobot.AUS 6/28/2004 2
W32.Randex.ATX 6/28/2004 2
W32.Bugbear.K 6/26/2004 2
W32.Korgo.R 6/24/2004 2
W32.Korgo.Q 6/24/2004 2
JS.Scob.Trojan 6/24/2004 2
W32.Korgo!gen 6/23/2004 2
W32.Randex.ATS 6/23/2004 2
W32.Korgo.L 6/17/2004 2
W32.Paps.A 6/13/2004 2
W32.Erkez.B 6/10/2004 2
W32.Sasser.G 6/10/2004 2
W32.Tubty.A 6/8/2004 2
W32.Gaobot.AQS 6/7/2004 2
W32.Korgo.I 6/7/2004 2
W32.Korgo.H 6/7/2004 2
VBS.Pub 6/5/2004 2
W32.Joot.A 6/4/2004 2
W32.Svoy.A 6/4/2004 2
W32.Gaobot.AOL 6/4/2004 2
W32.Dabber.B 6/4/2004 2
W32.Donk.R 6/3/2004 2
W32.Korgo.G 6/2/2004 2
W32.Explet.A 6/2/2004 2
W32.Korgo.F 6/1/2004 3

W32.Korgo.F
Discovered June 1, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.F is a minor variant of W32.Korgo.E. It is a worm that attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (BID 10108) on TCP port 445. It also listens on TCP ports 113 and 3067.

Degrades performance: Network propagation routines may degrade overall network performance.
Releases confidential info: Backdoor functionality allows unauthorized access.
Compromises security settings: Backdoor functionality may compromise security settings.
Ports: TCP 445, 113, 3067, and 6667. May listen on random ports as well.
Target of infection: Unpatched machines vulnerable to the Microsoft LSASS Windows exploit.

Read the full Symantec report here

W32.Explet.A@mm
Discovered June 2, 2004
Systems Affected: All Windows32 Systems

W32.Explet.A@mm is a mass-mailing worm that:

Retrieves email address from files with .htm, .html, .php, .tbb, and .txt extensions, on all fixed drives from C through Y.
Uses its own SMTP engine to send itself to the email addresses it finds.
Spreads through network shares and the Kazaa file-sharing network.
Attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) and the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) through TCP ports 135 and 445.
Listens on TCP port 1250 and a random TCP port.

The email has the following characteristics:

Subject: (One of the following)
RE: order
For you
Hi, Mike
Good offer.
RE:

Attachment: (One of the following)
SecUNCE.exe
AtlantI.exe
AGen1.03.exe
demo.exe
release.exe

Large scale e-mailing: Sends itself to the email addresses that it finds from the files on the infected system
Modifies files: Overwrites hosts file
Compromises security settings: Listen on TCP port 1250 and a random TCP port
Subject of email: RE: order For you Hi, Mike Good offer. RE:
Name of attachment: SecUNCE.exe AtlantI.exe AGen1.03.exe demo.exe release.exe
Ports: TCP 1250, a random TCP port
Shared drives: Copies itself to network shares
Target of infection: Copies itself to KaZaA shared folder

Read the full Symantec report here

W32.Korgo.G
Discovered June 2, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.G is a minor variant of W32.Korgo.C. It is a worm that attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (BID 10108) on TCP port 445. It also listens on TCP ports 113, 3067, and other random ports.

Degrades performance: Network propagation routines may degrade overall network performance
Releases confidential info: Backdoor functionality allows unauthorized access.
Compromises security settings: Backdoor functionality may compromise security settings
Ports: TCP 445, 113, 3067, and 6667 May listen on random ports as well.
Target of infection: Unpatched machines vulnerable to the Microsoft LSASS Windows exploit.

Read the full Symantec report here

W32.Donk.R
Discovered June 3, 2004
Systems Affected: All Windows32 Systems

W32.Donk.R is a worm that propagates through open network shares. It attempts to spread by exploiting these vulnerabilities:

Microsoft DCOM RPC (as described in Microsoft Security Bulletin MS03-026).
Microsoft Windows LSASS Buffer Overrun Vulnerability (as described in Microsoft Security Bulletin MS04-011).

The worm can also function as a backdoor server program.

Degrades performance: Terminates a number of programs including several antivirus programs.
Compromises security settings: Allows Backdoor access.
Shared drives: Targets administrative shares using weak login/password combinations.
Target of infection: Hosts on the local area network.

Read the full Symantec report here

W32.Dabber.B
Discovered June 4, 2004
Systems Affected: All Windows32 Systems

W32.Dabber.B is a variant of W32.Dabber.A. This worm propagates by exploiting a vulnerability in the FTP server component of W32.Sasser.Worm and its variants.

W32.Dabber.B is based on available exploit code. It installs a backdoor on infected hosts and tries to listen on port 9898. If the attempt fails, W32Dabber.A tries to listen on ports 9899 through 9999 in sequence until it finds an open port.

Payload: Opens the backdoor on the system.
Compromises security settings: System-level remote access available to attackers.
Ports: 5554, 8967, 9898
Target of infection: Systems infected with variants of W32.Sasser.Worm.

Read the full Symantec report here

W32.Gaobot.AOL
Discovered June 4, 2004
Systems Affected: All Windows32 Systems

W32.Gaobot.AOL is a worm that spreads through open network shares and several Windows vulnerabilities. The vulnerabilities are:

The Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026).
The Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS03-049).
The Microsoft Windows WebDAV Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS03-007).
The Microsoft UPnP NOTIFY Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS01-059).
The Microsoft SQL Server Web Task Stored Procedure Privilege Escalation Vulnerability (described in Microsoft Security Bulletin MS02-061).
The Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011).

The worm can act as a backdoor and attack other computers. It also attempts to kill the processes of many antivirus and security programs.

Releases confidential info: Steals CD-keys from a large number of games.
Compromises security settings: Gives the creator backdoor access to the system via IRC.
Shared drives: Will attempt to copy itself to systems with weak passwords.
Target of infection: Uses six different vulnarabilities in an attempt to spread.

Read the full Symantec report here

W32.Svoy.A@mm
Discovered June 4, 2004
Systems Affected: All Windows32 Systems

W32.Svoy.A@mm is a mass mailing worm that uses Mapi.dll to send itself to all the email addresses that it finds from the files with extensions that match the following: .in?, .htm, .html, .tx?, .me, /doc, .db?, .log, .wa?, .ad?, .md?, .xls, .cnv, .csv, .ab?, .his.

Read the full Symantec report here

W32.Joot.A@mm
Discovered June 4, 2004
Systems Affected: All Windows32 Systems

W32.Joot.A@mm is a mass mailing worm that attempts to send itself to email addresses found on the system. It also attempts

to spread via open shares and the peer-to-peer file-sharing networks Kazaa, iMesh and Grokster.

The worm will also attempt to disable the processes of several antivirus and personal firewall applications.

This threat is written in C++ and packed with UPX, however due to bugs in the code it may not function as intended.

Read the full Symantec report here

VBS.Pub
Discovered June 5, 2004
Systems Affected: All Windows32 Systems

VBS.Pub is a VBScript file-infecting and mass-mailing worm. VBS.Pub infects files with the extensions .ASP, .HTA, .HTM, .HTT, .HTML, .VBE, and .VBS. The worm also mails itself out via Microsoft Outlook to everyone in the address book. If the day is the 6th, 13th, 21st, or 28th, the worm deletes all the files on the system.

Read the full Symantec report here

W32.Korgo.H
Discovered June 7, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.H is a variant of W32.Korgo.F. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (BID 10108), described in Microsoft Security Bulletin MS04-011. It uses TCP port 445 to do this.

W32.Korgo.H listens on TCP ports 113, 3067, and a random port (256-8191).

Read the full Symantec report here

W32.Korgo.I
Discovered June 7, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.I is a variant of W32.Korgo.F. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445. It also listens on TCP ports 113, 3067, and other random ports (256-8191).

Degrades performance: Network propagation routines may degrade overall network performance.
Releases confidential info: Backdoor functionality allows unauthorized access.
Compromises security settings: Backdoor functionality may compromise security settings.
Ports: TCP 445, 113, 3067, and 6667. May listen on random ports as well.
Target of infection: Unpatched machines vulnerable to the Microsoft LSASS Windows exploit.

Read the full Symantec report here

Download the removal tool here

W32.Gaobot.AQS
Discovered June 7, 2004
Systems Affected: Windows 2000, Windows NT, Windows XP

W32.Gaobot.AQS is a worm that spreads through open network shares and several Windows vulnerabilities including:

The DCOM RPC Vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
The WebDav Vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
Exploits the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011).

W32.Gaobot.AQS can act as a backdoor server program and attack other systems. It attempts to stop the processes of many antivirus and security programs.

Read the full Symantec report here

W32.Tubty.A@mm
Discovered June 8, 2004
Systems Affected: All Windows32 Systems

W32.Tubty.A@mm is a mass-mailing worm that uses its own SMTP engine to send itself to all the contacts in the Windows Address Book. The email hast he subject: "MESSAGE_ID:" and the attachment is "photos.exe."

Read the full Symantec report here

W32.Sasser.G
Discovered June 10, 2004
Systems Affected: Windows 2000, Windows XP

W32.Sasser.G is a minor variant of W32.Sasser.Worm. It attempts to exploit the LSASS vulnerability, described in Microsoft Security Bulletin MS04-011, and spreads by scanning randomly selected IP addresses for vulnerable systems. The worm's function is identical to that of W32.Sasser.E.Worm, but W32.Sasser.G contains an extra PE file section, which is 1 byte in size and appears to have no function. W32.Sasser.G differs from W32.Sasser.Worm as follows:

Uses a different mutex: SkynetNotice.
Uses a different file name: lsasss.exe.
Creates a different value in the registry: "lsasss.exe"
Uses different port numbers, used by FTP server and the remote shell: 1023 and 1022.
After 2 hours of running it displays a message.
It deletes the values from the registry, which are known to be installed by Trojan.Mitglieder, W32.Beagle.W@mm, and W32.Beagle.X@mm.
The name of the file retrieved from the FTP server is followed by _update.exe.
The worm logs data into the file C:\ftplog.txt.
Has an updated routine for finding vulnerable computers. W32.Sasser.G sends an ICMP echo request before attempting to make a connection. This change may prevent the worm from properly executing on Windows 2000 systems.

W32.Sasser.G can run on, but not infect, Windows 95/98/Me computers. Although these operating systems cannot be infected, they can still be used to infect vulnerable computers.

Read the full Symantec report here

Download the removal tool here

W32.Erkez.B@mm
Discovered June 10, 2004
Systems Affected: All Windows32 Systems

W32.Erkez.B@mm is a mass-mailing worm that sends itself to the email addresses found on an infected computer.

Read the full Symantec report here

W32.Paps.A@mm
Discovered June 10, 2004
Systems Affected: All Windows32 Systems

W32.Paps.A@mm is a mass-mailing worm that sends itself as an attachment to the email addresses that it finds on your computer. The email will have a variable subject and file attachment. The attachment will have a .exe file extension.

Read the full Symantec report here

W32.Korgo.L
Discovered June 17, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.L is a variant of W32.Korgo.I. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445. It also listens on TCP ports 113, 3067, and other random ports (256-8191).

Degrades performance: Network propagation and HTTP request routines may degrade overall network performance.
Releases confidential info: Backdoor functionality allows unauthorized access.
Compromises security settings: Backdoor functionality may compromise security settings.
Ports: TCP 445, 113, 3067, and 6667. May listen on random ports as well.
Target of infection: Unpatched machines vulnerable to the Microsoft LSASS Windows exploit.

Read the full Symantec report here

Download the removal tool here

W32.Randex.ATS
Discovered June 23, 2004
Systems Affected: All Windows32 Systems

W32.Randex.ATS is a network-aware worm that attempts to connect to a predetermined IRC server.

Releases confidential info: Releases hardware information about the compromised system via IRC
Compromises security settings: Installs an IRC backdoor on the system
Target of infection: Machines with weak administrator passwords.

Read the full Symantec report here

W32.Korgo!gen
Discovered June 23, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo!gen is a generic detection that detects variants of W32.Korgo.

Read the full Symantec report here

JS.Scob.Trojan
Discovered June 24, 2004
Systems Affected: All Windows32 Systems

JS.Scob.Trojan is a simple Trojan that executes a JavaScript file from a remote server.

Read the full Symantec report here

W32.Korgo.Q
Discovered June 24, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.Q is a variant of W32.Korgo.I. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445. It also listens on random TCP ports between 256 and 8191.

Read the full Symantec report here

Download the removal tool here

W32.Korgo.R
Discovered June 24, 2004
Systems Affected: Windows 2000, Windows XP

W32.Korgo.R is a variant of W32.Korgo.M. This worm attempts to propagate by exploiting the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS04-011) on TCP port 445. It also listens on TCP port 113 and other random ports between 2000 and 8192

Read the full Symantec report here

Download the removal tool here

W32.Bugbear.K@mm
Discovered June 26, 2004
Systems Affected: All Windows32 Systems

W32.Bugbear.K@mm worm is:

• A variant of W32.Bugbear.B@mm and W32.Bugbear.E@mm.
• A mass-mailing worm that also spreads through network shares.
• Polymorphic and also infects .exe files.
• Possesses keylogging capabilities.

Read the full Symantec report here

W32.Randex.ATX
Discovered June 28, 2004
Systems Affected: All Windows32 Systems

W32.Randex.ATX is a network-aware worm that may be remotely controlled using IRC.

Deletes files: Deletes the C$, D$, IPC$, and ADMIN$ shares.
Releases confidential info: Releases system information and CD keys from the compromised computer via IRC.
Compromises security settings: Installs an IRC backdoor on the computer.
Target of infection: Computers with weak administrator passwords.

Read the full Symantec report here

W32.Gaobot.AUS
Discovered June 28, 2004
Systems Affected: All Windows32 Systems

W32.Gaobot.AUS is a repacked variant of W32.Gaobot.SN. The worm spreads through open network shares and through backdoors that the Mydoom family of worms open. It allows attackers to access an infected computer using a predetermined IRC channel.

Releases confidential info: Steals CD keys from a number of computer games.
Compromises security settings: Gives the creator backdoor access to the computer via IRC
Shared drives: Attempts to copy itself to computers with weak passwords.

Read the full Symantec report here