Virus Alert !!!

• zzzzland

  29 Jul 02, 20:43

  W32.Klez.H@mm
  Discovered on: April 17, 2002
  
  W32.Klez.H@mm is a modified variant of the worm W32.Klez.E@mm. This variant is capable of spreading by email and network shares. It is also capable of infecting files.
  
  Download W32.Klez and W32.ElKern Removal tool from Symantec.
  
  Note on W32.Klez.gen@mm detections:
  W32.Klez.gen@mm is a generic detection that detects variants of W32.Klez. Computers that are infected with W32.Klez.gen@mm have most likely been exposed to either W32.Klez.E@mm or W32.Klez.H@mm. If your computer is detected as infected with W32.Klez.gen@mm, download and run the tool. In most cases, the tool will be able to remove the infection.
  
  Also Known As: W32/Klez.h@MM, WORM_KLEZ.H, W32/Klez-G, I-Worm.Klez.h, Klez.H, W32/Klez.H, Win32.Klez.H, WORM_KLEZ.I
  Type: Worm
  Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
  
  
• zzzzland

  29 Jul 02, 20:47

  More Info on W32.Klez.H@mm
  
  Damage :
  
  Payload: This worm infects executables by creating a hidden copy of the original host file and then overwriting the original file with itself. The hidden copy is encrypted, but contains no viral data. The name of the hidden file is the same as the original file, but with a random extension.
  
  Large scale e-mailing: This worm searches the Windows address book, the ICQ database, and local files for email addresses. The worm sends an email message to these addresses with itself as an attachment.
  Releases confidential info: Worm randomly chooses a file from the machine to send along with the worm to recipients. So files with the extensions: ".mp8" or ".txt" or ".htm" or ".html" or ".wab" or ".asp" or ".doc" or ".rtf" or ".xls" or ".jpg" or ".cpp" or ".pas" or ".mpg" or ".mpeg" or ".bak" or ".mp3" or ".pdf" would be attached to e-mail messages along with the viral attachment.
  Distribution
  
  Subject of email: Random
  Name of attachment: Random
  
  For more information:
  http://www.sarc.com/avcenter/venc/data/[email protected]
• zzzzland

  3 Aug 02, 11:44

  W32.Yaha.F@mm
  
  W32.Yaha.F@mm is a mass-mailing worm that sends itself to all email addresses that exist in the Microsoft Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list, and files that have extensions that contain the letters ht. The worm randomly chooses the subject and body of the email message. The attachment will have a .bat, .pif or .scr file extension. Depending upon the name of the Recycled folder, the worm either copies itself to that folder or to the %Windows% folder.
  The name of the file that the worm creates consists of four randomly generated characters between c and y.
  
  It also attempts to terminate antivirus and firewall processes!!
  
  In addition to the mass-mailing routine, the worm does the following:
  
  It attempts to terminate antivirus and firewall processes. It searches for active processes and if the process name is one of the following, it attempts to terminate the process:
  
  SCAM32
  SIRC32
  WINK
  ZONEALARM
  AVP32
  LOCKDOWN2000
  AVP.EXE
  CFINET32
  CFINET
  ICMON
  SAFEWEB
  WEBSCANX
  ANTIVIR
  MCAFEE
  NORTON
  NVC95
  FP-WIN
  IOMON98
  PCCWIN98
  F-PROT95
  F-STOPW
  PVIEW95
  NAVWNT
  NAVRUNR
  NAVLU32
  NAVAPSVC
  NISUM
  SYMPROXYSVC
  RESCUE32
  NISSERV
  ATRACK
  IAMAPP
  LUCOMSERVER
  LUALL
  NMAIN
  NAVW32
  NAVAPW32
  VSSTAT
  VSHWIN32
  AVSYNMGR
  AVCONSOL
  WEBTRAP
  POP3TRAP
  PCCMAIN
  PCCIOMON
  
  It randomly uses the "Incorrect MIME header" exploit, which allows automatic execution of the worm on unpatched systems.
  
  Depending upon the name of the Recycled folder, the worm copies itself to either that folder or to the \%Windows% folder. The file name consists of six random numbers.
  
  The worm configures itself to execute each time that an .exe file is executed by changing the default value of the registry key
  
  
• zzzzland

  3 Oct 02, 10:06

  W32.Bugbear@mm
  Discovered on: September 30, 2002
  
  NOTE: Due to an increased rate of submissions, Symantec Security Response has upgraded this threat from a Category 3 to a Category 4 as of October 2, 2002.
  W32.Bugbear@mm is a mass-mailing worm. It can also spread through network shares. It has keystroke-logging and backdoor capabilities. The worm also attempts to terminate the processes of various antivirus and firewall programs.
  
  Security Response has seen that because the worm does not properly handle the network resource types, it may flood shared printer resources, which causes them to print garbage or disrupt their normal functionality.
  
  It is written in the Microsoft Visual C++ 6 programming language and is compressed with UPX v0.76.1-1.22.
  
  Also Known As: W32/Bugbear-A [Sophos], WORM_BUGBEAR.A [Trend], Win32.Bugbear [CA], W32/Bugbear@MM [McAfee], I-Worm.Tanatos [AVP], W32/Bugbear [Panda], Tanatos [F-Secure]
  Type: Worm
  Infection Length: 50,688 bytes
  Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
  Systems Not Affected: Macintosh, Unix, Linux