<?xml version="1.0" encoding="iso-8859-1"?>

<rss version="2.0" xmlns:rev="http://www.purl.org/stuff/rev/" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Virus warnings</title>
    <link>http://www.norman.com</link>
    <description>Overview of current virus threats</description>
    <language>en</language>
    <pubDate>Fri, 09 May 2008 16:19:34 +0200</pubDate>
    <generator>Lime CMS 3.5</generator>
    <webMaster>web@norman.no</webMaster>
    <item>
      <title><![CDATA[Pidief.A]]></title>
      <description><![CDATA[This piece of malware uses&#160;exploit code in PDF files that utilize a known vulnerability in Adobe Acrobat and Adobe Reader. Quite a lot of these PDF files have been spammed out and have used this exploit to execute arbitrary code on an affected system.
You will find more information about the vulnerability here.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/49634</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2007-10-24T20:44:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Tibs]]></title>
      <description><![CDATA[This is a large malware family (10000+ discrete detections) with a variety of components and functionality. The first variants of this series were seen as early as 2005. These trojans are designed to download and install a number of other trojans. How they are installed on a machine varies - some can be installed via malicious web sites, while others can be sent via mail or be found on the peer2peer networks. In a handful of documented cases this trojan has also been associated with child pornography. Below is a list of different Tibs-related malware and its functionality.
Downloaders
These variants usually install themselves as %SYSTEM%\kernels64.exe on the local machine; but some variants use names like kernels8.exe or kernels88.exe. They create registry keys to run from startup and every time Explorer is started. In addition, the Task Manager is disabled.
Registry changes:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run &#8220;System&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices &#8220;SystemTools&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon &quot;Shell&quot;=&quot;Explorer.exe %SYSTEM%\kernels64.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System &quot;DisableTaskMgr&quot;= 1
Payload:
They download a set of malware components from a distribution site. These additional components are installed using random file names in the %SYSTEM% folder:
%SITE%\proxy.exe : Downloader for more components 
%SITE%\search.exe : Downloader trojan 
%SITE%\tibs.exe : Downloader for a porn dialer 
%SITE%\tool.exe : Downloader for more components 
%SITE%\winlogon.exe : Installer for a rogue spyware application
Some variants do not download directly, but instead access a PHP script which determines which file is to be downloaded. Usually information about the local machine processor and Windows version will be uploaded to the attacker at the same time.
Email address harvesters:
This type of component searches through local files and address books looking for email addresses and posts the findings to a malicious web site. These email addresses are certainly used for spam purposes.
Mail proxies:
By installing a mail proxy, the attacker can send mail through another person&#8217;s mailserver. This is very useful for a spammer. Machines infected with this type of trojan will have an open port 25 (SMTP).
Peer-to-peer bot:
Some variants are able to connect to other machines also infected and thus create networks of infected machines. A large amount of these files were spammed out on email shortly after the large storm that hit Europe in January 2007 and the malware was given the name Stormy by some. This is a remote-controllable trojan (bot). It carries with it a list of controlling IP addresses, which it can contact to fetch information about other infected machines, and also register itself as a new peer in the network. Many variants of this also install a rootkit to hide themselves. 

Once run, it drops a file with the name wincom32.sys in the %SYSTEM% folder. It then registers this as a service. The trojan may also create a file called wincom32.ini, as well as download and install more malware.
Registry changes:
HKLM\System\CurrentControlSet\Services\wincom 
&quot;ImagePath&quot;=&quot;C:\WINDOWS\SYSTEM32\wincom32.sys&quot; 
&quot;DisplayName&quot;=&quot;wincom32&quot; 

The trojan communicates with peers on ports 4000, 7871 and 11271.
Email worm installation:
Tibs-related malware may also be downloaded and installed by the Luder email worm/virus combo. Luder drops many copies of itself in various locations, and then adds a small codepiece to innocent applications in such a way that when such infected files are run, the main virus is executed as well.
&#160;
NOTE: The variables %SITE% and %SYSTEM% refers to specific web sites used, and the Windows System folder, respectively.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/42490</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2007-01-24T14:33:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Stration]]></title>
      <description><![CDATA[This is a large family of email worms.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/38510</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2006-09-25T20:59:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Small.KI]]></title>
      <description><![CDATA[This is an email worm written in Visual Basic. File size is 95690 bytes. This worm has CME ID 24.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/28031</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2006-01-18T13:46:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Bagle.CS]]></title>
      <description><![CDATA[This is a rudimentary description only. More&nbsp;information may be added later if needed.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/24587</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-09-12T22:26:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Zotob.B]]></title>
      <description><![CDATA[Zotob.B is a worm that exploits a vulnerability in the Windows Plug and Play service (MS05-039) in order to propagate.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/24317</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-08-17T10:50:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Mytob]]></title>
      <description><![CDATA[The Mytob family is a big family of worms that can spread via email and via security vulnerabilities in the operating system. This is a general description of the family.Mytob is loosely based on two other worm series: The Mydoom email worms and the SDBot/Spybot network worms. The SDBot series of worms is very common, but does not have email spreading. In addition, SDBots are rather plugin-based and&nbsp;easy to&nbsp;adjust to&nbsp;new technologies, so that they finally got equipped with email-spreading came as no surprise.They appear to at least initially be spammed out from the author(s). New variants have occurred at a high frequency, with a regularity which looks almost scheduled.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/23458</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-06-08T14:52:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AQ]]></title>
      <description><![CDATA[Another worm in the MyDoom series; file size usually 25771 bytes. This appears to be more or less a repackaging of an earlier variant, although small differences exist.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/20316</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-02-17T08:24:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.L]]></title>
      <description><![CDATA[W32/MyDoom.L@mm is a mass mailing worm compressed using UPX. Filesizes may vary as the worm appends random data to itself, but samples seem to be at least 28kbytes.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/16382</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-07-26T17:19:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Netsky.P]]></title>
      <description><![CDATA[This is an email and network worm. File size is 29568 bytes, but size may vary when the worm comes in a zip file.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/14645</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-03-25T16:16:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Viking.GT]]></title>
      <description><![CDATA[This is a worm with file infecting capabilities. Standalone file size : 68303 bytes.When it first executes on a machine it installs itself and creates registry entries to make sure it is run from bootup. It also installs a number of files:File system changes:%WINDIR%\uninstall\rundl132.exe%WINDIR%\Logo_1.exe%WINDIR%\RichDll.dll%root%\_desktop.iniInfects executable files.May leave temporary BAT files in various locations and&nbsp;with semi-random names.The files rundl132.exe and Logo_1.exe are identical and contain the main worm, while the DLL file RichDll.dll is a backdoor/downloader trojan. _desktop.ini is a text file that contains the date of infection.File infection procedure:The virus looks for files to infect in two possible ways;&nbsp;first by enumerating mapped drives from C: to Z and searching for executable files in these, and also by connecting to network shares it gets access to and searching these. If an eligible file is found, the virus makes a temporary copy of this using the original file name but with an extra ".exe" extension, and proceeds to infect this by prepending its own code. It then deletes the original file and renames the temporary copy (now infected) back to the original name. Sometimes, if&nbsp;for some reason it cannot remove the original file, the virus circumvents this problem by making a temporary looping batch file that&nbsp;will delete&nbsp;the original file and install the infected file once the file becomes deletable - f.ex. if the application in question&nbsp;is closed.&nbsp;The virus will&nbsp;not infect files that are over 16MB in size or&nbsp;files residing&nbsp;under the following folders:systemsystem32windowsDocuments and SettingsSystem Volume InformationRecycledwinntProgram FilesWindows NTWindowsUpdateWindows Media PlayerOutlook ExpressInternet ExplorerComPlus ApplicationsNetMeetingCommon FilesMessengerInstallShield Installation InformationMicrosoft FrontpageMovie MakerMSN Gaming ZoneRegistry changes:HKLM\Software\Microsoft\Windows\CurrentVersion\Run load=%WINDIR%\uninstall\rundl132.exeHKLM\Software\Soft\DownloadWWW auto = 1Network activity:&nbsp;The worm pings the local subnet to establish whether machines are available, using the string "Hello,World!" as request data.&nbsp; It then attempts to log&nbsp;on to&nbsp;found machines using the WNetAddConnection API, with the following&nbsp;combinations for username/passwords:administrator/no passwordadministrator/default passworddefault user/default passwordno user/no passwordIf it finds machines that it can connect to, it will attempt to copy itself over as a standalone file to the remote ADMIN$ share, using the file name it is currently running under (be it rundl132.exe or logo_1.exe). If it has been granted administrator rights on the remote machine it then proceeds to set the remote file up as a sceduled task on the remote machine using NetScheduleJobAdd. If it is unable to connect to the ADMIN$ share, or if it is running under Win9x/ME, it finds visible shares on the machine using Windows Networking and attempts to connect to these using the following credentials:default user/default passworddefault user/no passwordIf connection is successful, it attempts to infect files remotely using the file infection procedure described above. This procedure also happens&nbsp;once&nbsp;the worm&nbsp;is done pinging the 255 lowest IP's on the local network, it then starts enumerating network resources looking for shares and files to infect in the same manner.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/45535</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2007-03-05T09:54:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Feebs]]></title>
      <description><![CDATA[Feebs is a family of email and peer-to-peer worms.&nbsp;&nbsp;They normally attempt to steal some confitential information, as well as disable some security-related software.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/28338</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2006-01-27T09:11:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AH]]></title>
      <description><![CDATA[W32/MyDoom.AH is a mass-mailing peer-to-peer worm, compressed using UPX to a file size of 31,744 bytes.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/19569</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2005-01-16T20:09:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[SDBot]]></title>
      <description><![CDATA[SDBots are worms that propagate via network shares. They also contain backdoor functionality, which connects to an IRC channel and waits for commands.&nbsp;Because of the similarities between many of the SDBot variants this is a generic desciption.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/14822</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2004-04-22T14:22:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Netsky.Q]]></title>
      <description><![CDATA[Netsky.Q is a mass mailing worm compressed with Petite to a filesize of 28,008 bytes.]]></description>
      <link>http://www.norman.com/Virus/Virus_descriptions/14658</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2004-03-30T09:26:00+02:00</dc:date>
    </item>

  </channel>
</rss>