Win32.Netsky.P@mm - Virensignatur

Symptome :

Präsenz folgender Registry Keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Run
mit dem Wert:
Norton Antivirus AV = %WINDIR%\FVPROTECT.EXE

Technische Beschreibung:

From: (fake e-mail address)

Subject: eines der folgenden:

* Re: Encrypted Mail
* Re: Extended Mail
* Re: Status
* Re: Notify
* Re: SMTP Server
* Re: Mail Server
* Re: Delivery Server
* Re: Bad Request
* Re: Failure
* Re: Thank you for delivery
* Re: Test
* Re: Administration
* Re: Message Error
* Re: Error
* Re: Extended Mail System
* Re: Secure SMTP Message
* Re: Protected Mail Request
* Re: Protected Mail System
* Re: Protected Mail Delivery
* Re: Secure delivery
* Re: Delivery Protection
* Re: Mail Authentification

Der Message Body kann so aussehen:

* Please confirm my request.
* ESMTP [Secure Mail System #334]: Secure message is attached.
* Partial message is available.
* Waiting for a Response. Please read the attachment.
* First part of the secure mail is available.
* For more details see the attachment.
* For further details see the attachment.
* Your requested mail has been attached.
* Protected Mail System Test.
* Secure Mail System Beta Test.
* Forwarded message is available.
* Delivered message is attached.
* Encrypted message is available.
* Please read the attachment to get the message.
* Follow the instructions to read the message.
* Please authenticate the secure message.
* Protected message is attached.
* Waiting for authentification.
* Protected message is available.
* Bad Gateway: The message has been attached.
* SMTP: Please confirm the attached message.
* You got a new message.
* Now a new message is available.
* New message is available.
* You have received an extended message. Please read the instructions.
* Your details.
* Your document.
* I have received your document. The corrected document is attached.
* I have attached your document.
* Your document is attached to this mail.
* Authentication required.
* Requested file.
* See the file.
* Please read the important document.
* Please confirm the document.
* Your file is attached.
* Please read the document.
* Your document is attached.
* Please read the attached file!
* Please see the attached file for details.

Der Message Body enthält eventuell eine Anmerkung, dass er von einem Antiviren Programm gescannt wurde und keine Viren gefunden wurden.

Attachment: eine der folgenden Dateien:

* file
* your_document
* about_you
* document04
* msg
* all_doc01
* document
* approved
* improved
* corrected

Das Attachment hat eventuell eine doppelte Endung: eine Dokument Extension (.doc, .txt) gefolgt von verschiedenen Leerstellen und dann von einer ausführenden Extension (.pif, .exe, .scr).
Das Attachment kann auch eine Zip Datei sein, die eine gepackte Datei mit einer Doppelten Endung enthält.

Der Wurm kann sich auch über P2P Clients mit einem der folgenden Namen verbreiten:

* The Sims 4 beta.exe
* Lightwave 9 Update.exe
* Ulead Keygen 2004.exe
* Smashing the stack full.rtf.exe
* Internet Explorer 9 setup.exe
* Opera 11.exe
* DivX 8.0 final.exe
* WinAmp 13 full.exe
* Cracks & Warez Archiv.exe
* Visual Studio Net Crack all.exe
* ACDSee 10.exe
* MS Service Pack 6.exe
* Clone DVD 6.exe
* Magix Video Deluxe 5 beta.exe
* Star Office 9.exe
* Partitionsmagic 10 beta.exe
* Gimp 1.8 Full with Key.exe
* Norton Antivirus 2005 beta.exe
* Windows 2000 Sourcecode.doc.exe
* Keygen 4 all new.exe
* 3D Studio Max 6 3dsmax.exe
* 1001 Sex and more.rtf.exe
* RFC compilation.doc.exe
* Dictionary English 2004 - France.doc.exe
* Win Longhorn re.exe
* WinXP eBook newest.doc.exe
* Learn Programming 2004.doc.exe
* How to hack new.doc.exe
* Doom 3 release 2.exe
* E-Book Archive2.rtf.exe
* netsky source code.scr
* Ahead Nero 8.exe
* Full album all.mp3.pif
* Screensaver2.scr
* Serials edition.txt.exe
* Microsoft Office 2003 Crack best.exe
* XXX hardcore pics.jpg.exe
* Dark Angels new.pif
* Porno Screensaver britney.scr
* Best Matrix Screensaver new.scr
* Adobe Photoshop 10 full.exe
* Adobe Premiere 10.exe
* Teen Porn 15.jpg.pif
* Microsoft WinXP Crack full.exe
* Adobe Photoshop 10 crack.exe
* Windows XP crack.exe
* Windows 2003 crack.exe
* Arnold Schwarzenegger.jpg.exe
* Saddam Hussein.jpg.exe
* Cloning.doc.exe
* American Idol.doc.exe
* Eminem Poster.jpg.exe
* Altkins Diet.doc.exe
* Eminem blowjob.jpg.exe
* Ringtones.doc.exe
* Eminem sex xxx.jpg.exe
* Ringtones.mp3.exe
* Eminem Spears porn.jpg.exe
* Eminem full album.mp3.exe
* Eminem Sexy archive.doc.exe
* Eminem Song text archive.doc.exe
* Britney Spears.mp3.exe
* Eminem.mp3.exe
* Britney Spears full album.mp3.exe
* Britney Spears Song text archive.doc.exe
* Matrix.mpg.exe
* Britney Spears and Eminem porn.jpg.exe
* Harry Potter 5.mpg.exe
* Britney Spears.jpg.exe
* Harry Potter game.exe
* Britney Spears fuck.jpg.exe
* Harry Potter.doc.exe
* Britney Spears cumshot.jpg.exe
* Harry Potter e book.doc.exe
* Britney Spears blowjob.jpg.exe
* Harry Potter 1-6 book.txt.exe
* Britney sex xxx.jpg.exe
* Harry Potter all e.book.doc.exe
* Britney Spears porn.jpg.exe
* Kazaa new.exe
* Britney Spears Sexy archive.doc.exe
* Kazaa Lite 4.0 new.exe

Bei seiner Ausführung schafft der Wurm einige Dateien im System Directory:

FVPROTECT.EXE – Kopie des Wurms selbst
USERCONFIG9X.DLL – Wurm dll
BASE64.TMP – base64 kodierte Wurm Exe
ZIPPED.TMP – gezippte Wurm Exe
ZIP1,2,3.TMP – gezippte base64 kodierte Wurm Exe

Der Wurm versucht Registry Keys, die von Bagle, Welchia and Mydoom Viren genutzt werden, zu löschen.

Entfernung:

[ Zurück zum Anfang ]