|
|
|
Virus Alerts 2005
|
|
|
|
|
Here you will find
recent virus & malware alerts...
|
|
|
|
Descriptions
for Newly Discovered Threats (Includes Viruses, Trojans and
Hoaxes) |
Top 10 malware reported to Sophos in 2005
W32/Sober-Z is a worm for the Windows platform.
W32/Sober-Z sends itself as an email attachment to addresses found in files
on the hard disk.
Emails messages sent by the worm take one of the following forms. Subject
lines may vary by having spaces replaced by underscore ('_') characters.
From: <Harvested address>
Subject: hi, ive a new mail address
Message text:
hey its me, my old address dont work at time. i dont know why?!
in the last days ive got some mails. i' think thaz your mails but im not
sure!
plz read and check ...
cyaaaaaaa
Attachment: mailtext.zip
From: <random name>@Ebay.com
Subject: Sehr geehrter Ebay-Kunde
Message text:
Bei uns wurde ein neues Benutzerkonto mit dem Namen "<random username>"
beantragt.
Um das Konto einzurichten, benoetigen wir eine Bestaetigung, dass die bei
der Anmeldung angegebene e-Mail-Adresse stimmt.
Bitte senden Sie zur Bestaetigung den ausgefuellten Anhang an uns zurueck.
Wir richten Ihr Benutzerkonto gleich nach Einlangen der Bestaetigung ein und
verstaendigen Sie dann per e-Mail, sobald Sie Ihr Konto benutzen koennen.
Vielen Dank,
Ihr Ebay-Team
Attachment: Ebay-User<random number>_RegC.zip
From: <random name>@BKA.de OR <random name>@bka.bund.de
Subject chosen from the following:
Ermittlungsverfahren wurde eingeleitet
Sie besitzen Raubkopien
Message text:
Sehr geehrte Dame, sehr geehrter Herr,
das Herunterladen von Filmen, Software und MP3s ist illegal und somit
strafbar.
Wir moechten Ihnen hiermit vorab mitteilen, dass Ihr Rechner unter der IP
<IP address> erfasst wurde. Der Inhalt Ihres Rechner wurde als Beweismittel
sichergestellt und es wird ein Ermittlungsverfahren gegen Sie eingleitet.
Die Strafanzeige und die Moeglichkeit zur Stellungnahme wird Ihnen in den
naechsten Tagen schriftlich zugestellt.
Aktenzeichen NR.:#<random number> (siehe Anhang)
Hochachtungsvoll
i.A. Juergen Stock
--- Bundeskriminalamt BKA
--- Referat LS 2
--- 65173 Wiesbaden
--- Tel.: +49 (0)611 - 55 - 12331 oder
--- Tel.: +49 (0)611 - 55 - 0
Attachment: Akte<random number>.zip
From: <harvested address>
Subject chosen from the following:
Account Information
Ihr Passwort
Message text:
Ihre Nutzungsdaten wurden erfolgreich geaendert. Details entnehmen Sie bitte
dem Anhang.
*** http://www.<harvested domain>
*** E-Mail: PassAdmin@<harvested domain>
Attachment: <harvested domain>-TextInfo.zip
From: <harvested address>
Subject chosen from the following:
Mail delivery failed
Mailzustellung wurde unterbrochen
smtp mail failed
SMTP Mail gescheitert
Message text:
This is an automatically generated Delivery Status Notification.
SMTP_Error []
I'm afraid I wasn't able to deliver your message.
This is a permanent error. I've given up. Sorry it didn't work out.
The full mail-text and header is attached!
Attachment name chosen from the following:
mail.zip
mail_body.zip
Email.zip
Email_body.zip
From: <harvested address>
Subject: Your Password
Message text:
Protected message is attached!
Attachment name chosen from the following:
reg_pass.zip
reg_pass-data.zip
From: <Random name>@cia.gov OR <Random name>@fbi.gov
Subject chosen from the following:
You visit illegal websites
Your IP was logged
Message text:
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
Message signature is either:
++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505
++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time
OR:
*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
Attachment name chosen from the following:
question_list.zip
list.zip
From: <Harvested address>
Subject: Paris_Hilton_&_Nicole_Richie
Message text:
The Simple Life:
View Paris Hilton & Nicole Richie video clips , pictures & more ;)
Download is free until Jan, 2006!
Please use our Download manager.
Attachment: downloadm.zip
From: <Random name>@RTLWorld.de OR <Random name>@RTL.de
Subject: RTL: Wer wird Millionaer
Message text:
Glueckwunsch: Bei unserer EMail Auslosung hatten Sie und weitere neun
Kandidaten Glueck.
Sie sitzen demnaechst bei Guenther Jauch im Studio!
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
+++ RTL interactive GmbH
+++ Geschaeftsfuehrung: Dr. Constantin Lange
+++ Am Coloneum 1
+++ 50829 Koeln
+++ Fon: +49(0) 221-780 0 oder
+++ Fon: +49 (0) 180 5 44 66 99
Attachment name is chosen from the following:
Kandidat.zip
WWM.zip
Auslosung.zip
Casting.zip
Gewinn.zip
Info.zip
RTL-Admin.zip
RTl.zip
Webmaster.zip
RTL-TV.zip
OR any of the above filenames with "_Text" inserted before ".zip".
In each case the zip file contains a copy of the worm with the filename
"File-packed_dataInfo.exe".
The worm searches for email addresses in files whose names contain the
following strings:
pmr stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp
ppt
msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade
sln
dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf
doc
ods nch xls nsf txt wab eml hlp mht nfo php asp shtml dbx
When first run, a message box may be displayed with the title "WinZip
Self-Extractor" and containing the text "Error in packed Header".
At 00:00 on 6 January 2006, the worm attempts to download further code from
the internet. If no code is downloaded the Sober worm is programmed to stop
replicating via email.
Sophos's anti-virus products include Genotype™ detection technology, which
can proactively protect against new threats without requiring an update.
Sophos customers have been protected against W32/Sober-Z (detected as
W32/Sober-Gen) since version 3.99
Recovery
Summary Description Recovery Advanced
This section tells you how to remove the threat.
If you are running Sophos Anti-Virus for Windows, version 6.0, you should
follow our instructions for removing worms.
If you use any of our other products please read the instructions for
removing W32/Sober-Z.
Advanced
Summary Description Recovery Advanced
This section is for technical experts who want to know more.
W32/Sober-Z is a worm for the Windows platform.
W32/Sober-Z sends itself as an email attachment to addresses found in files
on the hard disk.
Emails messages sent by the worm take one of the following forms. Subject
lines may vary by having spaces replaced by underscore ('_') characters.
From: <Harvested address>
Subject: hi, ive a new mail address
Message text:
hey its me, my old address dont work at time. i dont know why?!
in the last days ive got some mails. i' think thaz your mails but im not
sure!
plz read and check ...
cyaaaaaaa
Attachment: mailtext.zip
From: <random name>@Ebay.com
Subject: Sehr geehrter Ebay-Kunde
Message text:
Bei uns wurde ein neues Benutzerkonto mit dem Namen "<random username>"
beantragt.
Um das Konto einzurichten, benoetigen wir eine Bestaetigung, dass die bei
der Anmeldung angegebene e-Mail-Adresse stimmt.
Bitte senden Sie zur Bestaetigung den ausgefuellten Anhang an uns zurueck.
Wir richten Ihr Benutzerkonto gleich nach Einlangen der Bestaetigung ein und
verstaendigen Sie dann per e-Mail, sobald Sie Ihr Konto benutzen koennen.
Vielen Dank,
Ihr Ebay-Team
Attachment: Ebay-User<random number>_RegC.zip
From: <random name>@BKA.de OR <random name>@bka.bund.de
Subject chosen from the following:
Ermittlungsverfahren wurde eingeleitet
Sie besitzen Raubkopien
Message text:
Sehr geehrte Dame, sehr geehrter Herr,
das Herunterladen von Filmen, Software und MP3s ist illegal und somit
strafbar.
Wir moechten Ihnen hiermit vorab mitteilen, dass Ihr Rechner unter der IP
<IP address> erfasst wurde. Der Inhalt Ihres Rechner wurde als Beweismittel
sichergestellt und es wird ein Ermittlungsverfahren gegen Sie eingleitet.
Die Strafanzeige und die Moeglichkeit zur Stellungnahme wird Ihnen in den
naechsten Tagen schriftlich zugestellt.
Aktenzeichen NR.:#<random number> (siehe Anhang)
Hochachtungsvoll
i.A. Juergen Stock
--- Bundeskriminalamt BKA
--- Referat LS 2
--- 65173 Wiesbaden
--- Tel.: +49 (0)611 - 55 - 12331 oder
--- Tel.: +49 (0)611 - 55 - 0
Attachment: Akte<random number>.zip
From: <harvested address>
Subject chosen from the following:
Account Information
Ihr Passwort
Message text:
Ihre Nutzungsdaten wurden erfolgreich geaendert. Details entnehmen Sie bitte
dem Anhang.
*** http://www.<harvested domain>
*** E-Mail: PassAdmin@<harvested domain>
Attachment: <harvested domain>-TextInfo.zip
From: <harvested address>
Subject chosen from the following:
Mail delivery failed
Mailzustellung wurde unterbrochen
smtp mail failed
SMTP Mail gescheitert
Message text:
This is an automatically generated Delivery Status Notification.
SMTP_Error []
I'm afraid I wasn't able to deliver your message.
This is a permanent error. I've given up. Sorry it didn't work out.
The full mail-text and header is attached!
Attachment name chosen from the following:
mail.zip
mail_body.zip
Email.zip
Email_body.zip
From: <harvested address>
Subject: Your Password
Message text:
Protected message is attached!
Attachment name chosen from the following:
reg_pass.zip
reg_pass-data.zip
From: <Random name>@cia.gov OR <Random name>@fbi.gov
Subject chosen from the following:
You visit illegal websites
Your IP was logged
Message text:
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
Message signature is either:
++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505
++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time
OR:
*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000
Attachment name chosen from the following:
question_list.zip
list.zip
From: <Harvested address>
Subject: Paris_Hilton_&_Nicole_Richie
Message text:
The Simple Life:
View Paris Hilton & Nicole Richie video clips , pictures & more ;)
Download is free until Jan, 2006!
Please use our Download manager.
Attachment: downloadm.zip
From: <Random name>@RTLWorld.de OR <Random name>@RTL.de
Subject: RTL: Wer wird Millionaer
Message text:
Glueckwunsch: Bei unserer EMail Auslosung hatten Sie und weitere neun
Kandidaten Glueck.
Sie sitzen demnaechst bei Guenther Jauch im Studio!
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
+++ RTL interactive GmbH
+++ Geschaeftsfuehrung: Dr. Constantin Lange
+++ Am Coloneum 1
+++ 50829 Koeln
+++ Fon: +49(0) 221-780 0 oder
+++ Fon: +49 (0) 180 5 44 66 99
Attachment name is chosen from the following:
Kandidat.zip
WWM.zip
Auslosung.zip
Casting.zip
Gewinn.zip
Info.zip
RTL-Admin.zip
RTl.zip
Webmaster.zip
RTL-TV.zip
OR any of the above filenames with "_Text" inserted before ".zip".
From: <Harvested address>
Subject: Your Password
Message text:
Account and Password Information are attached!
***** Go to: http://www.<harvested domain>
***** Email: postman@<harvested domain>
Attachment name is chosen from the following:
reg_pass.zip
reg_pass-data.zip
In each case the zip file contains a copy of the worm with the filename
"File-packed_dataInfo.exe".
The worm searches for email addresses in files whose names contain the
following strings:
pmr stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp
ppt
msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade
sln
dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf
doc
ods nch xls nsf txt wab eml hlp mht nfo php asp shtml dbx
When first run, a message box may be displayed with the title "WinZip
Self-Extractor" and containing the text "Error in packed Header".
The worm creates the folder <Windows>\WinSecurity and creates the following
files:
<Windows>\WinSecurity\csrss.exe
<Windows>\WinSecurity\services.exe
<Windows>\WinSecurity\smss.exe
<Windows>\WinSecurity\socket1.ifo
<Windows>\WinSecurity\socket2.ifo
<Windows>\WinSecurity\socket3.ifo
The files with EXE file extensions are copies of the worm. The files with
IFO file extensions are MIME encoded copies of the worm for use when
generating email attachments.
W32/Sober-Z creates the following registry entry in order to run itself on
system startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows
<WINDOWS>\WinSecurity\services.exe
At 00:00 on 6 January 2006, the worm attempts to download further code from
the internet. If no code is downloaded the Sober worm is programmed to stop
replicating via email.
Sophos's anti-virus products include Genotype™ detection technology, which
can proactively protect against new threats without requiring an update.
Sophos customers have been protected against W32/Sober-Z (detected as
W32/Sober-Gen) since version 3.99
|
|
|
This web is optimized for 800 x 600 monitor resolution or above and
the latest web browser. Get the latest IE or Netscape web browser. (you
need to connect to the internet first) |
|
|
