Worm/VBbot.L - Worm

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	Worm/VBbot.L
Descoperit pe data de:	05/09/2005
Tip:	Vierme
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut spre mediu
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	61.440 Bytes
MD5:	0121a7a330f446e43a84df481e3503c9

General Metoda de raspandire:
   • Messenger

Alias:
   • Kaspersky: Backdoor.Win32.VBbot.l
   • TrendMicro: BKDR_VBBOT.F

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Blocheaza accesul la website-uri ale firmelor de securitate
   • Inchide aplicatiile de securitate
   • Descarca fisiere malware
   • Reduce setarile de securitate
   • Modificari in registri
   • Posibilitatea accesului neautorizat la computer

Imediat dupa lansarea in executie, pe ecran este afisat:

Fisiere Se copiaza in urmatoarea locatie:
• %SYSDIR%\%combinatie de caractere aleatoare%\svshost.exe

Sterge copia initiala a virusului.

Este creat fisierul:

– %TEMPDIR%\temp.bat Fisierul este executat dupa ce a fost creat. Fisierul batch este folosit pentru stergerea unui fisier.

Registrii sistemului Urmatoarele chei sunt adaugate in registri pentru a rula procesul la repornirea sistemului:

– HKLM\software\microsoft\windows\currentversion\run
   • "svshost"="%SYSDIR%\%combinatie de caractere aleatoare%\svshost.exe"

– HKCU\software\microsoft\windows\currentversion\run
   • "svshost"="%SYSDIR%\%combinatie de caractere aleatoare%\svshost.exe"

Urmatoarea cheie din registri este modificata:

– HKLM\system\currentcontrolset\services\sharedaccess
   Vechea valoare:
   • "Start"=dword:%setarile utilizatorului%
   Noua valoare:
   • "Start"=dword:00000004

Messenger Se raspandeste prin messenger. Caracteristicile sunt:

– AIM Messenger
– MSN Messenger

Catre:
Toate intrarile din lista de contacte.

Mesaj
Mesajul transmis arata ca unul din urmatoarele:

   • Hej, download this if you want free Emotions and more Extras for your messenger : %link%

   • rofl you gotta see this %link%

   • Hey I found new Winks and Emoticons for your messenger and alot more Check them out here : %link%

   • Messeger PLUS just have been released Check it out it got alot of extra features that makes your Messenger alot better. Download it here : %link%

   • are bored of your emoticons and winks ? download this tool : %link%

   • Hej, you already got the new Messenger ? :D %link%

   • Messenger Plus 6.0 Beta released....get it here :) %link%

   • Hej, wanna update your Messenger :D ? %link%

   • lmao, this is awesome! %link%

   • lol I just updated my Messenger and I call tell you it ROCKS!! %link%

   • Check this out bro, its awsome :D !! %link%

   • lol, you should check out the new Messenger Plus...it rocks! :o %link%

   • LOL this is one of the funniest things i've ever seen! %link%

   • lmao this is so funny %link%

   • you 've got to see this! %link%

%link%
In timp ce wildcard-ul este:
   • www.asianvideo.be/download.php?**********&do=download

IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverul IRC:

Server: 67.18.50.**********
Port: 37737
Canal: #.antixnew
Nick: [XP|5|%combinatie de caractere aleatoare%]
Parola: w000000t

– Acest malware poate obtine si trimite urmatoarele informatii:
    • Cantitatea de memorie

– In plus, poate efectua urmatoarele operatii:
    • Lanseaza atacuri DDoS ICMP
    • Lanseaza atacuri DDoS SYN
    • Lanseaza atacuri DDoS TCP
    • Lanseaza atacuri DDoS UDP
    • descarcare fisier
    • executarea unui fisier
    • Porneste rutina de raspandire
    • terminare proces malware
    • Se actualizeaza singur
    • Vizitarea unui website

Fisiere host Fisierul

– In acest caz inregistrarile existente raman nemodificate.

– Accesul la urmatoarele domenii este blocat:
   • avp.com; www.avp.com; ca.com; dispatch.mcafee.com;
      download.mcafee.com; f-secure.com; fastclick.net; ftp.f-secure.com;
      ftp.sophos.com; liveupdate.symantec.com; customer.symantec.com;
      rads.mcafee.com; mast.mcafee.com; mcafee.com; my-etrust.com; nai.com;
      networkassociates.com; secure.nai.com; securityresponse.symantec.com;
      service1.symantec.com; sophos.com; support.microsoft.com;
      symantec.com; update.symantec.com; updates.symantec.com;
      us.mcafee.com; vil.nai.com; viruslist.com; www.viruslist.com;
      www.awaps.net; www.ca.com; www.f-secure.com; www.fastclick.net;
      www.mcafee.com; www.microsoft.com; www.my-etrust.com; www.nai.com;
      www.networkassociates.com; www.sophos.com; www.symantec.com;
      www3.ca.com; www.grisoft.com; grisoft.com; housecall.trendmicro.com;
      trendmicro.com; www.trendmicro.com; www.pandasoftware.com;
      pandasoftware.com; kaspersky.com; www.kaspersky.com; www.zonelabs.com;
      zonelabs.com; antivir.com; antivir.de; www.spywareinfo.com;
      spywareinfo.com; www.merijn.org; merijn.org

Fisierul hosts modificat va arata astfel:

Terminarea proceselor Lista cu procesele oprite:
   • msconfig.exe; kav.exe; kavsvc.exe; mcvsshld.exe; mcagent.exe;
      mcvsrte.exe; mcshield.exe; mcvsftsn.exe; mcdash.exe; mcvsescn.exe;
      mcinfo.exe; mpfagent.exe; mpftray.exe; mpfservice.exe; mskagent.exe;
      mcmnhdlr.exe; sndsrvc.exe; usrprmpt.exe; ccapp.exe; ccevtmgr.exe;
      spbbcsvc.exe; ccsetmgr.exe; symlcsvc.exe; npfmntor.exe; navapsvc.exe;
      issvc.exe; ccproxy.exe; navapw32.exe; navw32.exe; smc.exe;
      outpost.exe; zlclient.exe; vsmon.exe; isafe.exe; pandaavengine.exe;
      msblast.exe; bbeagle.exe; d3dupdate.exe; sysmonxp.exe; i11r54n4.exe;
      irun4.exe; mscvb32.exe; sysinfo.exe; mwincfg32.exe; wincfg32.exe;
      winsys.exe; zapro.exe; winupd.exe; enterprise.exe; regedit.exe;
      hijackthis.exe; gcasdtserv.exe; gcasserv.exe; pcctlcom.exe;
      tmntsrv.exe; tmproxy.exe; pccguide.exe; tmpfw.exe; pcclient.exe;
      AVGNT.EXE; AVWIN.EXE; taskmgr.exe; AVWUPSRV.EXE; ethereal.exe;
      mcupdmgr.exe; teekids.exe; penis32.exe

Processes containing the following window title (ro)
   • ISSVC; services; GuardDogEXE; microsoft antispyware*; hijackthis*;
      wscsvc; kavsvc; McShield; MCVSRte; MpfService; navapsvc; Symantec Core
      LC; ccEvtMgr; SNDSrvc; ccProxy; ccPwdSvc; ccSetMgr; SPBBCSvc; SAVScan;
      SBService; SmcService; OutpostFirewall; vsmon; CAISafe; PcCtlCom;
      TmPfw; tmproxy; Tmntsrv

Alte informatii Mutex:
Creeaza urmatorul mutex:
• AntiX

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: Visual Basic.

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Pentru o descriere scurta click aici.

Descriere introdusa de Sergiu Oprea la Mon, 05 Sep 2005 13:01 (GMT+1)
Descriere actualizata de Sergiu Oprea la Wed, 07 Sep 2005 15:58 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back