Spyware Warrior

[wawadave]

Keep your fears to yourself but share your courage with others."
Robert Louis Stevenson (1850-1894); British novelist.

- Weekly report on viruses and intruders -
Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com)

Madrid, February 27, 2005 - This week's report on viruses and intruders will
focus on four worms - the A and B variants of Stang, Assiral.A and Sober.M-.

Stang.A and Stang.B spread through MSN Messenger in messages containing
texts like 'Look At This Hot Naked Girl' and an attached file with names
like 'Hey look at my moms dildo!!.pif'. If this file is run, these worms
send themselves out to all of the contacts in this instant messaging
application and turn off the security programs that could be installed on
the computer, such as the Windows personal firewall.

What's more, Stang.A and Stang.B block the Task Manager and Registry Editor
in this operating system. They also try to end the SVCHOST.EXE and LSASS.EXE
processes, which could cause the computer to automatically shut down.

The third worm in today's report is Assiral.A, which spreads via email in a
message with the text 'Re: LOV YA !' in the subject and an attached file
called 'LOVE_LETTER.TXT.EXE'. When this file is run, the computer will be
infected by Assiral.A, which will then look for email addresses to send
itself to.

Assiral.A carries out many different actions on the computer it infects,
including the following:

- Prevent access to the Windows Registry Editor.

- Hide the Run option in the Start menu.

- Disable the command-line.

- Modify the home page in Internet Explorer.

- Try to end the processes belonging to different antivirus and firewall
applications.

- When it is run, it displays a message on screen which announces its
mission to rid the Internet of the actions of the Bropia worms.

We are going to finish this week's report with Sober.M, a worm that spreads
via email in a message that can be written in English or German. If the mail
domain ends in de, ch, at or li, both the subject and message will be
written in German.

After infecting a computer, Sober.M opens Notepad and displays a text and
then an error message.

For further information about these and other computer threats, visit Panda
Software's Encyclopedia:
http://www.pandasoftware.com/virus_info/encyclopedia/

Additional information

- LSASS.EXE: a process corresponding to local security and user
authentication policies. If this process is closed, a countdown message is
displayed and then the computer will be restarted.

- SVCHOST.EXE: a process that handles services run from DLLs (Dynamic Link
Libraries).

More definitions of virus and antivirus terminology at:
http://www.pandasoftware.com/virus_info/glossary/default.aspx
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

2/28: PWSteal.Ldpinch-D Trojan Steals Info
PWSteal.Ldpinch.D is a Trojan horse program that attempts to steal information from an
infected computer and send it to the author of the Trojan.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,b3bw,bj2,9s3s,a9gz
------------------------------------------------------------
5. 2/28: Trojan Lazar Downloads Programs
Trojan.Lazar is a downloader for other programs.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,hfb9,5t5q,9s3s,a9gz
------------------------------------------------------------
6. 2/28: Mytob Worm Harvests Addresses
W32.Mytob@mm is a mass-mailing worm that uses it own SMTP engine to send an email to
addresses that it retrieves from the Windows Address Book on the infected computer.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,cy4u,kljx,9s3s,a9gz
------------------------------------------------------------
7. 2/28: Conycspa-G Worm Executes Files
W32.Conycspa.G@mm is a mass mailing worm that downloads and executes files from the
Internet.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,l92s,l4to,9s3s,a9gz
------------------------------------------------------------
8. 2/28: Holcas-A Worm Emails Itself Out
W32.Holcas.A@mm is a mass-mailing worm that uses MAPI commands to send itself to all
addresses found in the Microsoft Outlook Address book.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,4x60,3o0l,9s3s,a9gz
------------------------------------------------------------
9. 2/28: Elitper-A Worm Uses MAPI
Some security vendors have issued alerts for W32.Elitper.A@mm, a mass-mailing worm that
spreads using MAPI and through file-sharing networks.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,d426,b8c3,9s3s,a9gz
------------------------------------------------------------
10. 2/28: Mytob-B Worm Gathers Addresses
Some security vendors have issued alerts for W32.Mytob.B@mm, a mass-mailing worm that
uses it own SMTP engine to send an email to addresses that it gathers from the Windows
Address Book on the compromised computer.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,4tmm,j3ks,9s3s,a9gz
------------------------------------------------------------
11. 2/28: Mytob-A Worm Uses Own Engine
Some security vendors have issued alerts for Mytob.A, a worm with backdoor
characteristics.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,9btd,dz4m,9s3s,a9gz
------------------------------------------------------------
12. 2/28: Forbot-CW Worm Hits Remote Shares
W32/Forbot-CW is a worm that attempts to spread to remote network shares and computers
vulnerable to common exploits.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,g7xz,1nh8,9s3s,a9gz
------------------------------------------------------------
13. 2/28: MyDoom-BG Worm Has Backdoor
Some security vendors have issued alerts for W32/MyDoom-BG, a mass-mailing worm with IRC
backdoor functionality which can also infect computers vulnerable to the LSASS (MS04-011)
exploit.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,cxbu,9d0,9s3s,a9gz
------------------------------------------------------------
14. 2/28: Bropia-S Worm Uses MSN Messenger
W32/Bropia-S is a worm for the Windows platform that spreads using the MSN Messenger
application.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,m2wp,k435,9s3s,a9gz
------------------------------------------------------------
15. 2/28: Rbot-UC a Worm and Trojan
W32/Rbot-UC is a network worm and IRC backdoor Trojan for the Windows platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,b768,4yge,9s3s,a9gz
------------------------------------------------------------
16. 2/28: Poebot-I Worm Usess Bad Passwords
W32/Poebot-I is a worm that attempts to spread to remote network shares with weak
passwords.
http://nl.internet.com/ct.html?rtr=on&s=1,1f8p,1,fq6w,ipx3,9s3s,a9gz
------------------------------------------------------------
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

CABIR MOBILE PHONE VIRUS HITS THE US
Bluetooth hijacker spreading slowly but surely.
http://www.net-security.org/news.php?id=7203
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

Wow viruses are really picking up!!!!!!!!!!!



1. Wave of Trojans Slamming the Internet
A flood of Trojans, which are being spammed out, are washing over the Internet today.
BagleDl-L downloads code and tampers with security software.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,e3cu,fug6,9s3s,a9gz

3/1: Tooso-D Trojan Hits Security Apps
Trojan.Tooso.D is a Trojan horse that disables security software by terminating
processes, stopping services, removing registry entries, and deleting files.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,d235,6rdu,9s3s,a9gz
------------------------------------------------------------
6. 3/1; Assiral-B a Mass-Mailing Worm
W32/Assiral-B is a mass-mailing worm.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,68ss,jehg,9s3s,a9gz
------------------------------------------------------------
7. 3/1: Troj_Bagle-BE Arrives as ZIP File
Troj_Bagle.BE usually arrives on a system as a .ZIP compressed file attached on an email
message.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,hooc,9xgb,9s3s,a9gz
------------------------------------------------------------
8. 3/1: Bagle-BE Worm a 'Medium Risk Alert'
Security vendor Trend Micro has declared a medium risk alert to control the spread of
Worm_Bagle.BE, which is spreading in New Zealand and Australia.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,bdwo,le8e,9s3s,a9gz
------------------------------------------------------------
9. 3/1: Trojan.Eman a Browser Helper Object
Trojan.Eman is a Browser Helper Object that attempts to download and execute arbitrary
code from a predetermined website.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,kqvb,i10f,9s3s,a9gz
------------------------------------------------------------
10. 3/1: Trojan.Mumuboy-C Steals Info
Trojan.Mumuboy.C is a Trojan horse application that steals potentially confidential
computer information and e-mails details to an attacker.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,42yp,535n,9s3s,a9gz
------------------------------------------------------------
11. 3/1: Trojan.Tooso-B Disables Security
Trojan.Tooso.B is a Trojan horse that attempts to disable security-related software by
terminating processes, stopping services, removing registry entries, and deleting files.

http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,ldsz,kxla,9s3s,a9gz
------------------------------------------------------------
12. 3/1: Trojan.Tooso-C Shuts Down Security
Trojan.Tooso.C is a Trojan horse that attempts to disable security-related software.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,htwy,lmmx,9s3s,a9gz
------------------------------------------------------------
13. 3/1: Beagle-BG Worm Lets Hackers In
W32.Beagle.BG@mm is a mass-mailing worm that uses its own SMTP engine to spread.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,fqrc,6qz3,9s3s,a9gz
------------------------------------------------------------
14. 3/1: Beagle-BH Worm Uses SMTP Engine
W32.Beagle.BH@mm is a mass-mailing worm that uses its own SMTP engine to spread.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,biiv,cn22,9s3s,a9gz
------------------------------------------------------------
15. 3/1: Mitglieder-BO Trojan Attacks Security Tools
Mitglieder.BO is a Trojan that heavily attacks several security tools, such as antivirus
programs and firewalls belonging to different companies, if they are installed on the
affected computer.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,e1cs,4nnf,9s3s,a9gz
------------------------------------------------------------
16. 3/1: MyDoom-BI Worm Mails Itself Out
W32/MyDoom.bi@MM is a variant of the MyDoom family of worms and combines the MyDoom
mass-mailing functionality with W32/Sdbot.worm functionality.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,31jy,12uy,9s3s,a9gz
------------------------------------------------------------
17. 3/1: Agobot-OV Worm Has Backdoor
W32/Agobot-OV is a network worm with IRC backdoor functionality.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,dzjd,99nq,9s3s,a9gz
------------------------------------------------------------
18. 3/1: Kelebek-G a Backdoor Trojan
Troj/Kelebek-G is a backdoor Trojan for the Windows platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,m0to,m3h5,9s3s,a9gz
------------------------------------------------------------
19. 2/28: Mytob-C Worm Gathers Addresses
W32.Mytob.C@mm is a mass-mailing worm that uses it own SMTP engine to send an email to
addresses that it gathers from the Windows Address Book on the compromised computer.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,gugg,esk4,9s3s,a9gz
------------------------------------------------------------
20. 2/28: Spybot-KHC Worm Has DoS Ability
W32.Spybot.KHC is a worm that has distributed denial of service and back door
capabilities.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,3e6z,fa1t,9s3s,a9gz
------------------------------------------------------------
21. 2/28: Agobot-QL Worm Lets Hackers In
W32/Agobot-QL is worm that attempts to spread to remote network shares.
http://nl.internet.com/ct.html?rtr=on&s=1,1fcw,1,k199,37hn,9s3s,a9gz
------------------------------------------------------------

*********************************************************************
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

Bagle Attack Picking up Speed
The wave of Bagle worms that started slamming the Internet Monday night is picking up
speed, according to one email security company.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,lspa,5723,9s3s,a9gz
------------------------------------------------------------
3. 3/2: Tofger-AT Trojan Monitors User Accounts
Tofger.AT is a password stealer type Trojan.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,8lf3,kyi6,9s3s,a9gz
------------------------------------------------------------
4. 3/2: Francette-Q Worm Has Keylogging Ability
W32/Francette-Q is network worm with keylogging and backdoor functionality for the
Windows platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,k1tg,arag,9s3s,a9gz
------------------------------------------------------------
5. 3/2: Mytob-A Worm & Trojan Hits IRC Users
W32/Mytob-A is a mass-mailing network worm and backdoor trojan that targets users of
Internet Relay Chat programs.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,j23n,1hea,9s3s,a9gz
------------------------------------------------------------
6. 3/2: Myfip-H Worm Drops into Shared Folders
Worm_Myfip.H propagates through network shares by dropping copies of itself in certain
shared folders using a list of user names and passwords.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,2aow,bjlw,9s3s,a9gz
------------------------------------------------------------
7. 3/2: Jeans-A Worm Arrives in Attachment
Worm_Jeans-A attempts to propagate through email by sending a copy of itself as
attachment.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,j9uf,63k5,9s3s,a9gz
------------------------------------------------------------
8. 3/2: VBS/Speery-A Worm Drops in Files
VBS/Speery-A is a worm for the Windows platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1fg4,1,43na,lega,9s3s,a9gz
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

VIRUS ALERTS:

During the last week, Secunia issued 1 MEDIUM RISK virus alert.
Please refer to the grouped virus profile below for more information:

Bagle.BE - MEDIUM RISK Virus Alert - 2005-03-01 12:58 GMT+1
http://secunia.com/virus_information/15815/bagle.be/
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

New Senate Bill Looks to Hook Phishers
A veteran lawmaker says current fraud laws allow phishers to bait, switch and flee.
http://nl.internet.com/ct.html?rtr=on&s=1,1fjh,1,9vx4,gs0m,9s3s,a9gz
------------------------------------------------------------
2. Searchmeup Targets Weak PCs
A new adware exploit takes advantage of IE LoadImage vulnerability.
http://nl.internet.com/ct.html?rtr=on&s=1,1fjh,1,gb9n,9hsc,9s3s,a9gz
------------------------------------------------------------
3. Fraud Concerns No Match For eCommerce Growth
VeriSign's stats say Internet Commerce increased 88 percent during recent holiday
season.
http://nl.internet.com/ct.html?rtr=on&s=1,1fjh,1,xdd,ae5w,9s3s,a9gz
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

Virus Alerts [A new wave of malware with variants of Bagle and Mi tglieder now threatens users - 03/01/05] Inbox

Virus Alerts
<virusalerts@pandasoftware.com> to VIRUSALERTSCOM
More options Mar 1 (4 days ago)
- A new wave of malware with variants of Bagle
and Mitglieder now threatens users -
Virus Alerts, by Panda Software (http://www.pandasoftware.es)

MADRID, March 1st, 2005- In the last few hours, PandaLabs has detected the
appearance of six variants (BN, BO, BP, BQ, BR and BS) of the Bagle email
worm, as well as four variants (BO, BP, BQ and BR) of the Mitglieder Trojan.
Of these, the most active at present are Bagle.BN and Mitglieder.BO.
According to Panda Software's international tech support network, the latter
is causing incidents in users' computers around the globe, and is already
one of the viruses most frequently detected by Panda ActiveScan, the free
online scanner.

Bagle.BN and Mitglieder.BO work hand-in-glove to spread as widely as
possible. Mitglieder.BO reaches computers in an email message, in an
attachment that could have names like price.zip or price2.zip. If a user
runs this file, the Trojan activates and tries to connect to an Internet
address from which it downloads the Bagle.BN worm onto the system. Once
Bagle.BN is installed on a computer, it sends Mitglieder.BO to the addresses
that it finds in a file called EML.EXE, which is also downloaded from the
Internet. To do this the worm uses its own SMTP engine.

In addition, Mitglieder.BO terminates processes belonging to various
antivirus and security programs, and overwrites the Windows 'hosts' file to
prevent users from connecting to certain web pages.

"We are up against a similar wave of viruses to the one witnessed in 2004.
It would seem that given the similarities that we have detected in the
source code, the new Bagle and Mitglieder variants are the work of the same
person or of an organized group. In fact, the whole process began with the
massive, manual sending of thousands of emails infected with Mitglieder.BO.
Moreover, in order to confuse both antivirus vendors and users alike, a
large number of variants have been created and circulated in a very short
period of time. For this reason it is possible that new variants of both
malicious codes will continue to appear over the next few hours", explains
Luis Corrons, director of PandaLabs.

As Panda Software's International Tech Support has already detected
incidents caused by the new malicious code, users are advised to take
precautions and keep their antivirus software updated. Panda Software
clients already have the updates available to detect and disinfect the new
malicious code.

Panda Software's clients can already access the updates for installing the
new TruPreventTM Technologies along with their antivirus protection,
providing a preventive layer of protection against new malicious code. For
users with a different antivirus program installed, Panda TruPreventTM
Personal is the perfect solution, as it is both compatible with and
complements these products, providing a second layer of preventive
protection that acts while the new virus is still being studied and the
corresponding update is incorporated into traditional antivirus programs,
decreasing the risk of infection. More information about TruPreventTM
Technologies at http://www.pandasoftware.com/truprevent.

Users can also scan and disinfect their computers using Panda ActiveScan,
the free, online scanner available from: www.pandasoftware.com.

More information about the new variants of Bagle and Mitglieder is available
from: http://www.pandasoftware.com/virus_info/encyclopedia/

NOTE: The addresses above may not show up on your screen as single lines.
This would prevent you from using the links to access the web pages. If this
happens, just use the 'cut' and 'paste' options to join the pieces of the
URL.
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[wawadave]

viruses are moveing today!!!!!!!!!!!!!

Zafi-D a 'High-Alert' Top Threat
The Zafi-D worm has not only received 'high-alert' threat status, it also has become the
most widespread malware on the Internet.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,ded3,am6k,9s3s,a9gz
------------------------------------------------------------
5. Netsky-P a Year Old and Going Strong
After a year in the wild, Netsky-P retains its second-place spot on the list of Most
Malicious Malware.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,7uv0,5jyx,9s3s,a9gz
------------------------------------------------------------
6. Zafi-B Worm Grabs Third-Place Spot
Accounting for nearly 10 percent of all malware in the wild, the Zafi-B worm has taken
the third spot in the list of Most Malicous Malware.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,2swg,j2dz,9s3s,a9gz
------------------------------------------------------------
7. Bagle-BK Worm Downloads Code
The Bagle-BK worm has grabbed the fourth-highest spot on eSecurityPlanet's list of Most
Dangerous Malware.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,efqi,5g70,9s3s,a9gz
------------------------------------------------------------
8. After a Year, Netsky-D Still in Top 5
The Netsky-D worm, which spoofs senders' email addresses, has managed to hold onto the
fifth spot in the Most Dangerous Malware list after a full year in the wild.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,a52d,owl,9s3s,a9gz
------------------------------------------------------------
9. 3/4: Wurmark-F Worm Displays Image
W32/Wurmark-F is a mass mailing worm that sends itself as a zip attachment to email
addresses found on the infected computer.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,xnm,lkzd,9s3s,a9gz
------------------------------------------------------------
10. 3/4: Elitper-B Worm uses P2P Apps
Worm_Elitper.B may arrive via the shared folders of popular peer-to-peer (P2P)
applications.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,avju,55kn,9s3s,a9gz
------------------------------------------------------------
11. 3/4; PWSteal.Bankash-B Trojan Steals Info
PWSteal.Bankash.B is a Trojan horse that attempts to steal passwords and user names for
certain financial Web sites.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,c82l,68f7,9s3s,a9gz
------------------------------------------------------------
12. 3/4: Trojan.Feutel-B Logs Keystrokes
Trojan.Feutel.B is a back door Trojan horse program that logs keystrokes and downloads
remote files.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,9hel,6m1r,9s3s,a9gz
------------------------------------------------------------
13. 3/4: Comdor-A Worm Downloads Malware
W32.Comdor.A@mm is a worm that downloads malware and sends itself to addresses found in
the Windows Address Book using its own SMTP engine.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,ebvr,6yez,9s3s,a9gz
------------------------------------------------------------
14. 3/4: Rbot-WV Worm Uses Bad Passwords
W32/Rbot-WV is a network worm with backdoor functionality for the Windows platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,b8r2,gv6h,9s3s,a9gz
------------------------------------------------------------
15. 3/4: Rbot-WW Worm Has Backdoor Ability
W32/Rbot-WW is a network worm with backdoor Trojan functionality for the Windows
platform.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,eo10,3fmn,9s3s,a9gz
------------------------------------------------------------
16. 3/4: Downloader-WJ TDrops Other Trojan
Downloader-WJ is a Trojan that downloads a dropper of a Password Stealing Trojan.
http://nl.internet.com/ct.html?rtr=on&s=1,1fol,1,1y8f,ya3,9s3s,a9gz
------------------------------------------------------------
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd