<?xml version="1.0" encoding="utf-8"?>

<rss version="2.0" xmlns:rev="http://www.purl.org/stuff/rev/" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Virus warnings</title>
    <link>http://www.norman.com</link>
    <description>Overview of current virus threats</description>
    <language>en</language>
    <pubDate>Thu, 02 Sep 2010 16:58:08 +0200</pubDate>
    <generator>Lime CMS 3.6</generator>
    <webMaster>web@norman.no</webMaster>
    <item>
      <title><![CDATA[Fake Antivirus]]></title>
      <description><![CDATA[Fake antivirus or more precise - fake antimalware, or rogue security programs - is a generic description for all types of malware that pretend to be protection software against virus, spyware, trojans and other types of malware. In reality however, fake antimalware is malicious software.Although this type of malicious software has been around a long time, its growth has been particularly huge recent years.The most used spreading mechanism is drive-by infections from visiting web sites. One popular technique is to manipulate search engines.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/80133</link>
      <rev:rating>High</rev:rating>
      <dc:date>2010-04-25T11:02:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Stuxnet.A]]></title>
      <description><![CDATA[W32/Stuxnet.A belongs to a worm family that spreads through removable drives. It does this malicious activity by taking advantage of the recently discovered vulnerability in Microsoft Windows Shell (Dropping shortcut files (.LNK) that automatically run when the removable drive is accessed).
Microsoft has released a security&nbsp;update 2 August 2010 that fixes the vulnerability.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/85143</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2010-07-09T12:06:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Bredolab]]></title>
      <description><![CDATA[W32/Bredolab is a trojan downloader that connects to the server hard-coded in to the executable and downloads the malware in order to compromise the system security, depending on the instruction available in the server.&nbsp;]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/78550</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2010-03-15T13:39:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[TDSS]]></title>
      <description><![CDATA[TDSS is a trojan that has a rootkit component and a bot component. The rootkit is responsible for hiding the trojan's files on disk, and for providing hidden and encrypted storage for the bot component. The bot component connects to remote computers and makes the infected computer part of a botnet. It may download and install additional malware.TDSS requires special software for removal.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/77200</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2010-01-13T09:33:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Virut]]></title>
      <description><![CDATA[W32/Virut is a polymorphic virus that infects executables and screensaver files, and attempts to downloads additional malware. There are many variants.The Virut.CM variant also injects an iframe object into HTML based files, disables Windows file protection in order to infect essential protected Windows system files. A viral thread, running under winlogon.exe or services.exe, attempts to connect to an IRC backdoor through port 80 or 65520, in order to download additional malware components.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/69284</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2009-06-04T11:17:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Koobface]]></title>
      <description><![CDATA[W32/Koobface is a worm propagating through social networking sites such as Facebook. The worm spreads by sending messages with malicious links to contacts on various social networking sites. These links leads to websites that tries to trick the users into downloading the worm and other malicious software.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/69263</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2009-06-03T23:49:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Conficker]]></title>
      <description><![CDATA[W32/Conficker is a network-propagating worm family. There are several variants. This description mainly describes the B variant. Additional details of the C and D variants are appended.The worm's most interesting feature is that it spreads to other machines via a security vulnerability in the Windows Server Service. This vulnerability allows it to trigger a download of itself to the remote computer without the user's knowledge.When executed, the worm will copy itself as a randomly named DLL to the Windows System folder. It also copies itself to network shares and attempt to execute itself on the remote machines.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/67723</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2009-01-08T12:42:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Tibs]]></title>
      <description><![CDATA[This is a large malware family (10000+ discrete detections) with a variety of components and functionality. The first variants of this series were seen as early as 2005. These trojans are designed to download and install a number of other trojans. How they are installed on a machine varies - some can be installed via malicious web sites, while others can be sent via mail or be found on the peer2peer networks. In a handful of documented cases this trojan has also been associated with child pornography. Below is a list of different Tibs-related malware and its functionality.
Downloaders
These variants usually install themselves as %SYSTEM%\kernels64.exe on the local machine; but some variants use names like kernels8.exe or kernels88.exe. They create registry keys to run from startup and every time Explorer is started. In addition, the Task Manager is disabled.
Registry changes:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run &ldquo;System&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices &ldquo;SystemTools&quot;=%SYSTEM%\kernels64.exe 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon &quot;Shell&quot;=&quot;Explorer.exe %SYSTEM%\kernels64.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System &quot;DisableTaskMgr&quot;= 1
Payload:
They download a set of malware components from a distribution site. These additional components are installed using random file names in the %SYSTEM% folder:
%SITE%\proxy.exe : Downloader for more components 
%SITE%\search.exe : Downloader trojan 
%SITE%\tibs.exe : Downloader for a porn dialer 
%SITE%\tool.exe : Downloader for more components 
%SITE%\winlogon.exe : Installer for a rogue spyware application
Some variants do not download directly, but instead access a PHP script which determines which file is to be downloaded. Usually information about the local machine processor and Windows version will be uploaded to the attacker at the same time.
Email address harvesters:
This type of component searches through local files and address books looking for email addresses and posts the findings to a malicious web site. These email addresses are certainly used for spam purposes.
Mail proxies:
By installing a mail proxy, the attacker can send mail through another person&rsquo;s mailserver. This is very useful for a spammer. Machines infected with this type of trojan will have an open port 25 (SMTP).
Peer-to-peer bot:
Some variants are able to connect to other machines also infected and thus create networks of infected machines. A large amount of these files were spammed out on email shortly after the large storm that hit Europe in January 2007 and the malware was given the name Stormy by some. This is a remote-controllable trojan (bot). It carries with it a list of controlling IP addresses, which it can contact to fetch information about other infected machines, and also register itself as a new peer in the network. Many variants of this also install a rootkit to hide themselves. 

Once run, it drops a file with the name wincom32.sys in the %SYSTEM% folder. It then registers this as a service. The trojan may also create a file called wincom32.ini, as well as download and install more malware.
Registry changes:
HKLM\System\CurrentControlSet\Services\wincom 
&quot;ImagePath&quot;=&quot;C:\WINDOWS\SYSTEM32\wincom32.sys&quot; 
&quot;DisplayName&quot;=&quot;wincom32&quot; 

The trojan communicates with peers on ports 4000, 7871 and 11271.
Email worm installation:
Tibs-related malware may also be downloaded and installed by the Luder email worm/virus combo. Luder drops many copies of itself in various locations, and then adds a small codepiece to innocent applications in such a way that when such infected files are run, the main virus is executed as well.
NOTE: The variables %SITE% and %SYSTEM% refers to specific web sites used, and the Windows System folder, respectively.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55943</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2007-01-24T14:33:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Mytob]]></title>
      <description><![CDATA[The Mytob family is a big family of worms that can spread via email and via security vulnerabilities in the operating system. This is a general description of the family.
Mytob is loosely based on two other worm series: The Mydoom email worms and the SDBot/Spybot network worms. The SDBot series of worms is very common, but does not have email spreading. In addition, SDBots are rather plugin-based and&nbsp;easy to&nbsp;adjust to&nbsp;new technologies, so that they finally got equipped with email-spreading came as no surprise.
They appear to at least initially be spammed out from the author(s). New variants have occurred at a high frequency, with a regularity which looks almost scheduled.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55870</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-06-08T14:52:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AQ]]></title>
      <description><![CDATA[Another worm in the MyDoom series; file size usually 25771 bytes. This appears to be more or less a repackaging of an earlier variant, although small differences exist.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55853</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2005-02-17T08:24:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.L]]></title>
      <description><![CDATA[W32/MyDoom.L@mm is a mass mailing worm compressed using UPX. Filesizes may vary as the worm appends random data to itself, but samples seem to be at least 28kbytes.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55856</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-07-26T17:19:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[Netsky.P]]></title>
      <description><![CDATA[This is an email and network worm. File size is 29568 bytes, but size may vary when the worm comes in a zip file.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55883</link>
      <rev:rating>Medium</rev:rating>
      <dc:date>2004-03-25T16:16:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[MyDoom.AH]]></title>
      <description><![CDATA[W32/MyDoom.AH is a mass-mailing peer-to-peer worm, compressed using UPX to a file size of 31,744 bytes.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55852</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2005-01-16T20:09:00+02:00</dc:date>
    </item>
    <item>
      <title><![CDATA[SDBot]]></title>
      <description><![CDATA[SDBots are worms that propagate via network shares. They also contain backdoor functionality, which connects to an IRC channel and waits for commands.
&nbsp;
Because of the similarities between many of the SDBot variants this is a generic desciption.]]></description>
      <link>http://www.norman.com/security_center/virus_description_archive/55678</link>
      <rev:rating>Low</rev:rating>
      <dc:date>2004-04-22T14:22:00+02:00</dc:date>
    </item>

  </channel>
</rss>