<?xml version="1.0" encoding="utf-8"?>

<rss version="2.0" xmlns:rev="http://www.purl.org/stuff/rev/" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Virus warnings</title>
    <link>http://www.norman.com</link>
    <description>Overview of current virus threats</description>
    <language>en</language>
    <pubDate>Mon, 15 Mar 2010 16:11:32 +0100</pubDate>
    <generator>Lime CMS 3.6</generator>
    <webMaster>web@norman.no</webMaster>
    <item>
      <title><![CDATA[Conficker]]></title>
      <description><![CDATA[W32/Conficker is a network-propagating worm family. There are several variants. This description mainly describes the B variant. Additional details of the C and D variants are appended.The worm's most interesting feature is that it spreads to other machines via a security vulnerability in the Windows Server Service. This vulnerability allows it to trigger a download of itself to the remote computer without the user's knowledge.When executed, the worm will copy itself as a randomly named DLL to the Windows System folder. It also copies itself to network shares and attempt to execute itself on the remote machines.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/67723</link>
      <rev:rating>High</rev:rating>
      <dc:date>2009-01-08T12:42:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Bredolab]]></title>
      <description><![CDATA[W32/Bredolab is a trojan downloader that connects to the server hard-coded in to the executable and downloads the malware in order to compromise the system security, depending on the instruction available in the server.&nbsp;]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/78550</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2010-03-15T13:39:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Virut]]></title>
      <description><![CDATA[W32/Virut is a polymorphic virus that infects executables and screensaver files, and attempts to downloads additional malware. There are many variants.The Virut.CM variant also injects an iframe object into HTML based files, disables Windows file protection in order to infect essential protected Windows system files. A viral thread, running under winlogon.exe or services.exe, attempts to connect to an IRC backdoor through port 80 or 65520, in order to download additional malware components.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/69284</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2009-06-04T11:17:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Koobface]]></title>
      <description><![CDATA[W32/Koobface is a worm propagating through social networking sites such as Facebook. The worm spreads by sending messages with malicious links to contacts on various social networking sites. These links leads to websites that tries to trick the users into downloading the worm and other malicious software.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/69263</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2009-06-03T23:49:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[AntiVirus 2008]]></title>
      <description><![CDATA[AntiVirus 2008 is a family of "rogue" antivirus software that will display false virus warnings. It creates popups and attempts to connect to a series of websites to make the user download additional malware and trick them into paying for the false services the applications provide.New variants of this family are as of this writing created continously.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55625</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2008-08-15T08:34:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Tibs]]></title>
      <description><![CDATA[This is a large malware family (10000+ discrete detections) with a variety of components and functionality. The first variants of this series were seen as early as 2005. These trojans are designed to download and install a number of other trojans. How they are installed on a machine varies - some can be installed via malicious web sites, while others can be sent via mail or be found on the peer2peer networks. In a handful of documented cases this trojan has also been associated with child pornography. Below is a list of different Tibs-related malware and its functionality.
Downloaders
These variants usually install themselves as %SYSTEM%\kernels64.exe on the local machine; but some variants use names like kernels8.exe or kernels88.exe. They create registry keys to run from startup and every time Explorer is started. In addition, the Task Manager is disabled.
Registry changes:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run &ldquo;System&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices &ldquo;SystemTools&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon &quot;Shell&quot;=&quot;Explorer.exe %SYSTEM%\kernels64.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System &quot;DisableTaskMgr&quot;= 1
Payload:
They download a set of malware components from a distribution site. These additional components are installed using random file names in the %SYSTEM% folder:
%SITE%\proxy.exe : Downloader for more components 
%SITE%\search.exe : Downloader trojan 
%SITE%\tibs.exe : Downloader for a porn dialer 
%SITE%\tool.exe : Downloader for more components 
%SITE%\winlogon.exe : Installer for a rogue spyware application
Some variants do not download directly, but instead access a PHP script which determines which file is to be downloaded. Usually information about the local machine processor and Windows version will be uploaded to the attacker at the same time.
Email address harvesters:
This type of component searches through local files and address books looking for email addresses and posts the findings to a malicious web site. These email addresses are certainly used for spam purposes.
Mail proxies:
By installing a mail proxy, the attacker can send mail through another person&rsquo;s mailserver. This is very useful for a spammer. Machines infected with this type of trojan will have an open port 25 (SMTP).
Peer-to-peer bot:
Some variants are able to connect to other machines also infected and thus create networks of infected machines. A large amount of these files were spammed out on email shortly after the large storm that hit Europe in January 2007 and the malware was given the name Stormy by some. This is a remote-controllable trojan (bot). It carries with it a list of controlling IP addresses, which it can contact to fetch information about other infected machines, and also register itself as a new peer in the network. Many variants of this also install a rootkit to hide themselves. 

Once run, it drops a file with the name wincom32.sys in the %SYSTEM% folder. It then registers this as a service. The trojan may also create a file called wincom32.ini, as well as download and install more malware.
Registry changes:
HKLM\System\CurrentControlSet\Services\wincom 
&quot;ImagePath&quot;=&quot;C:\WINDOWS\SYSTEM32\wincom32.sys&quot; 
&quot;DisplayName&quot;=&quot;wincom32&quot; 

The trojan communicates with peers on ports 4000, 7871 and 11271.
Email worm installation:
Tibs-related malware may also be downloaded and installed by the Luder email worm/virus combo. Luder drops many copies of itself in various locations, and then adds a small codepiece to innocent applications in such a way that when such infected files are run, the main virus is executed as well.
NOTE: The variables %SITE% and %SYSTEM% refers to specific web sites used, and the Windows System folder, respectively.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55943</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2007-01-24T14:33:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Small.KI]]></title>
      <description><![CDATA[This is an email worm written in Visual Basic. File size is 95690 bytes. This worm has CME ID 24.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55920</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2006-01-18T13:46:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Zotob.B]]></title>
      <description><![CDATA[Zotob.B is a worm that exploits a vulnerability in the Windows Plug and Play service (MS05-039) in order to propagate.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55617</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-08-17T10:50:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Mytob]]></title>
      <description><![CDATA[The Mytob family is a big family of worms that can spread via email and via security vulnerabilities in the operating system. This is a general description of the family.
Mytob is loosely based on two other worm series: The Mydoom email worms and the SDBot/Spybot network worms. The SDBot series of worms is very common, but does not have email spreading. In addition, SDBots are rather plugin-based and&nbsp;easy to&nbsp;adjust to&nbsp;new technologies, so that they finally got equipped with email-spreading came as no surprise.
They appear to at least initially be spammed out from the author(s). New variants have occurred at a high frequency, with a regularity which looks almost scheduled.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55870</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-06-08T14:52:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AQ]]></title>
      <description><![CDATA[Another worm in the MyDoom series; file size usually 25771 bytes. This appears to be more or less a repackaging of an earlier variant, although small differences exist.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55853</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-02-17T08:24:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.L]]></title>
      <description><![CDATA[W32/MyDoom.L@mm is a mass mailing worm compressed using UPX. Filesizes may vary as the worm appends random data to itself, but samples seem to be at least 28kbytes.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55856</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-07-26T17:19:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Netsky.P]]></title>
      <description><![CDATA[This is an email and network worm. File size is 29568 bytes, but size may vary when the worm comes in a zip file.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55883</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-03-25T16:16:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[TDSS]]></title>
      <description><![CDATA[TDSS is a trojan that has a rootkit component and a bot component. The rootkit is responsible for hiding the trojan's files on disk, and for providing hidden and encrypted storage for the bot component. The bot component connects to remote computers and makes the infected computer part of a botnet. It may download and&nbsp;install additional malware.
TDSS requires special software for removal.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/77200</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2010-01-13T09:33:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Viking.GT]]></title>
      <description><![CDATA[This is a worm with file infecting capabilities.
Standalone file size : 68303 bytes.
When it first executes on a machine it installs itself and creates registry entries to make sure it is run from bootup. It also installs a number of files:
File system changes:
%WINDIR%\uninstall\rundl132.exe
%WINDIR%\Logo_1.exe
%WINDIR%\RichDll.dll
%root%\_desktop.ini
Infects executable files.
May leave temporary BAT files in various locations and&nbsp;with semi-random names.
The files rundl132.exe and Logo_1.exe are identical and contain the main worm, while the DLL file RichDll.dll is a backdoor/downloader trojan. _desktop.ini is a text file that contains the date of infection.
File infection procedure:
The virus looks for files to infect in two possible ways;&nbsp;first by enumerating mapped drives from C: to Z and searching for executable files in these, and also by connecting to network shares it gets access to and searching these. If an eligible file is found, the virus makes a temporary copy of this using the original file name but with an extra &quot;.exe&quot; extension, and proceeds to infect this by prepending its own code. It then deletes the original file and renames the temporary copy (now infected) back to the original name. Sometimes, if&nbsp;for some reason it cannot remove the original file, the virus circumvents this problem by making a temporary looping batch file that&nbsp;will delete&nbsp;the original file and install the infected file once the file becomes deletable - f.ex. if the application in question&nbsp;is closed.&nbsp;
The virus will&nbsp;not infect files that are over 16MB in size or&nbsp;files residing&nbsp;under the following folders:
system
system32
windows
Documents and Settings
System Volume Information
Recycled
winnt
Program Files
Windows NT
WindowsUpdate
Windows Media Player
Outlook Express
Internet Explorer
ComPlus Applications
NetMeeting
Common Files
Messenger
InstallShield Installation Information
Microsoft Frontpage
Movie Maker
MSN Gaming Zone

Registry changes:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run load=%WINDIR%\uninstall\rundl132.exe
HKLM\Software\Soft\DownloadWWW auto = 1
Network activity:&nbsp;
The worm pings the local subnet to establish whether machines are available, using the string &quot;Hello,World!&quot; as request data.&nbsp; It then attempts to log&nbsp;on to&nbsp;found machines using the WNetAddConnection API, with the following&nbsp;combinations for username/passwords:
administrator/no password
administrator/default password
default user/default password
no user/no password
If it finds machines that it can connect to, it will attempt to copy itself over as a standalone file to the remote ADMIN$ share, using the file name it is currently running under (be it rundl132.exe or logo_1.exe). If it has been granted administrator rights on the remote machine it then proceeds to set the remote file up as a sceduled task on the remote machine using NetScheduleJobAdd.
If it is unable to connect to the ADMIN$ share, or if it is running under Win9x/ME, it finds visible shares on the machine using Windows Networking and attempts to connect to these using the following credentials:
default user/default password
default user/no password
If connection is successful, it attempts to infect files remotely using the file infection procedure described above. This procedure also happens&nbsp;once&nbsp;the worm&nbsp;is done pinging the 255 lowest IP's on the local network, it then starts enumerating network resources looking for shares and files to infect in the same manner.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55949</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2007-03-05T09:54:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AH]]></title>
      <description><![CDATA[W32/MyDoom.AH is a mass-mailing peer-to-peer worm, compressed using UPX to a file size of 31,744 bytes.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55852</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2005-01-16T20:09:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[SDBot]]></title>
      <description><![CDATA[SDBots are worms that propagate via network shares. They also contain backdoor functionality, which connects to an IRC channel and waits for commands.
&nbsp;
Because of the similarities between many of the SDBot variants this is a generic desciption.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55678</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2004-04-22T14:22:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Netsky.Q]]></title>
      <description><![CDATA[Netsky.Q is a mass mailing worm compressed with Petite to a filesize of 28,008 bytes.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55884</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2004-03-30T09:26:00+02:00</dc:date>
    </item>

  </channel>
</rss>