Virus Alert !!!

zzzzland SG

[email protected]
Discovered on: April 17, 2002

[email protected] is a modified variant of the worm [email protected] This variant is capable of spreading by email and network shares. It is also capable of infecting files.

Download W32.Klez and W32.ElKern Removal tool from Symantec.

Note on [email protected] detections:
[email protected] is a generic detection that detects variants of W32.Klez. Computers that are infected with [email protected] have most likely been exposed to either [email protected] or [email protected] If your computer is detected as infected with [email protected], download and run the tool. In most cases, the tool will be able to remove the infection.

Also Known As: W32/[email protected], WORM_KLEZ.H, W32/Klez-G, I-Worm.Klez.h, Klez.H, W32/Klez.H, Win32.Klez.H, WORM_KLEZ.I
Type: Worm
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

zzzzland SG

More Info on [email protected]

Damage :

Payload: This worm infects executables by creating a hidden copy of the original host file and then overwriting the original file with itself. The hidden copy is encrypted, but contains no viral data. The name of the hidden file is the same as the original file, but with a random extension.

Large scale e-mailing: This worm searches the Windows address book, the ICQ database, and local files for email addresses. The worm sends an email message to these addresses with itself as an attachment.
Releases confidential info: Worm randomly chooses a file from the machine to send along with the worm to recipients. So files with the extensions: ".mp8" or ".txt" or ".htm" or ".html" or ".wab" or ".asp" or ".doc" or ".rtf" or ".xls" or ".jpg" or ".cpp" or ".pas" or ".mpg" or ".mpeg" or ".bak" or ".mp3" or ".pdf" would be attached to e-mail messages along with the viral attachment.
Distribution

Subject of email: Random
Name of attachment: Random

For more information:
http://www.sarc.com/avcenter/venc/data/[email protected]

zzzzland SG

[email protected]

[email protected] is a mass-mailing worm that sends itself to all email addresses that exist in the Microsoft Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list, and files that have extensions that contain the letters ht. The worm randomly chooses the subject and body of the email message. The attachment will have a .bat, .pif or .scr file extension. Depending upon the name of the Recycled folder, the worm either copies itself to that folder or to the %Windows% folder.
The name of the file that the worm creates consists of four randomly generated characters between c and y.

It also attempts to terminate antivirus and firewall processes!!

In addition to the mass-mailing routine, the worm does the following:

It attempts to terminate antivirus and firewall processes. It searches for active processes and if the process name is one of the following, it attempts to terminate the process:

SCAM32
SIRC32
WINK
ZONEALARM
AVP32
LOCKDOWN2000
AVP.EXE
CFINET32
CFINET
ICMON
SAFEWEB
WEBSCANX
ANTIVIR
MCAFEE
NORTON
NVC95
FP-WIN
IOMON98
PCCWIN98
F-PROT95
F-STOPW
PVIEW95
NAVWNT
NAVRUNR
NAVLU32
NAVAPSVC
NISUM
SYMPROXYSVC
RESCUE32
NISSERV
ATRACK
IAMAPP
LUCOMSERVER
LUALL
NMAIN
NAVW32
NAVAPW32
VSSTAT
VSHWIN32
AVSYNMGR
AVCONSOL
WEBTRAP
POP3TRAP
PCCMAIN
PCCIOMON

It randomly uses the "Incorrect MIME header" exploit, which allows automatic execution of the worm on unpatched systems.

Depending upon the name of the Recycled folder, the worm copies itself to either that folder or to the \%Windows% folder. The file name consists of six random numbers.

The worm configures itself to execute each time that an .exe file is executed by changing the default value of the registry key

zzzzland SG

[email protected]
Discovered on: September 30, 2002

NOTE: Due to an increased rate of submissions, Symantec Security Response has upgraded this threat from a Category 3 to a Category 4 as of October 2, 2002.
[email protected] is a mass-mailing worm. It can also spread through network shares. It has keystroke-logging and backdoor capabilities. The worm also attempts to terminate the processes of various antivirus and firewall programs.

Security Response has seen that because the worm does not properly handle the network resource types, it may flood shared printer resources, which causes them to print garbage or disrupt their normal functionality.

It is written in the Microsoft Visual C++ 6 programming language and is compressed with UPX v0.76.1-1.22.

Also Known As: W32/Bugbear-A [Sophos], WORM_BUGBEAR.A [Trend], Win32.Bugbear [CA], W32/[email protected] [McAfee], I-Worm.Tanatos [AVP], W32/Bugbear [Panda], Tanatos [F-Secure]
Type: Worm
Infection Length: 50,688 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, Unix, Linux