w32.beagle.w@mm , w32/bagle.z@mm, w32/bagle-w, win32.bagle.w, worm_bagle.x, i-worm.bagle.y, bagle.y, i-worm/bagle.aa
tipo: virus
tama?o: variable
origen: internet
destructivo: si en la calle (in the wild): si detección y eliminación: the hacker 5.6 al 26/04/2004
w32/bagle.w es un virus que se difunde a trav?s de envio masivos de e-mails. busca direcciones de e-mail en todos los archivos que tengan las siguientes extensiones .wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx, .mbx, .mdx, .eml, .nch, .mmf, .ods, .cfg, .asp, .php, .pl, .wsh, .adb, .tbb, .sht, .xls, .oft, .uin, .cgi, .mht, .dhtm, .jsp
caracter?sticas del mensaje de e-mail:
asunto: [puede ser alguno de los siguientes]
hello! hey! lets socialize, my friend! lets talk, my friend! im bored with this life notify from a known person ;-) i like you i just need a friend im a sad girl... re: msg reply re: hello re: yahoo! re: thank you! re: thanks :) re: text message re: document incoming message re: incoming message re: incoming fax hidden message fax message received protected message re: protected message forum notify request response site changes re: hi encrypted document hello [nombre aleatorio], dear [nombre aleatorio], dear [nombre aleatorio], its me ;-) hi [nombre aleatorio], hey [nombre aleatorio], its me -> hi<!--[nombre aleatorio]-->, its me [nombre aleatorio], hey [nombre aleatorio], hey<!--[nombre aleatorio]-->, hello<!--[nombre aleatorio]-->, hi<!--[nombre aleatorio]-->, i like you! dont you remember me? kewl :-) i need a friend... i just want to talk with someone... i like reading the books and socializing, let me talk with you... its time to find a friend! ready to accept a new friend? :-) like me, odore me! ;-) cuerpo: [esta conformado por las siguientes partes]
parte 1: cualquiera de los siguientes:
i study at school, i like to spend time cheerfully even if not all so well, i hompe and trust, that all bad when nibud will pass and necessarily nastanet there would be a desire. i like to feel protected, to understand, that near to me the man, which both in sex, and in life knows what to do. it is possible to fall in love with such the man for ever. cometime i write a poem, play the gitar. i love a traveling, i like a romantice and i want to meet, comeday, my big love! i am kind, fair, careful, gentle also want to create family. i love animal (cats, dogs), the literature, theatre, cinema, music, walks in park i very much love productive leisure, to prepare for new exotic dishes, at leisure to leave with friends on the nature, to float, i like to go for a drive on mountain skiing, to visit excursions, travel. very easy going. i have recently got demobilize from army and also i am going to act in a higher educational institution searching for the right person,for real man, who will really cares and love me. i am a honest, kind,loving,with good sense of humor...etc.,looking for true love... or maybe for pen friend.i like cats i am looking for a serious relationship. i am not interested in flirt and short-term love adventure. i love, as the good company, and i dream about romantic appointment at candles with loved. i still believe in love. i like an active life... and interesting people.. i am honest, responsible, romantic person. iwould like to find my only love,to find my destiny. im a young lady of 20 years old id like to find my second part!!! i am simple girl who are looking for serious relation with responsible and confident man. i am ready to give all my love and carering for a right person who is going to love and respect me i am a beautiful, sexual girl with very big ambitions and dreams. i can make happy anyone man... i am a student. im studying international relationships. i would like to find an interesting and active man for serious relations. sitting at home it is not for me. i like to go out to the theater, cinema, and nightclubs. i love productive leisure, to travel, communicate with friends. i very much love new acquaintances, i love music, meetings with friends. i go on night clubs, except for parties i sometimes visit theatres and i love cinema. in general i only shall be glad to new acquaintance and class dialogue... im so bored, let me talk with you... you are my prince :-) you are cool :-) parte 2:
read the attach. your file is attached. more info is in attach see attach. please, have a look at the attached file. see the attached file for details. message is in attach here is the file. for more information see the attached file. attached file will tell you everything. for details see the attach. attached file tells everything. further details are in attach. parte 3:
sincerely, [nombre aleatorio] best wishes, [nombre aleatorio] yours, [nombre aleatorio] have a good day, [nombre aleatorio] cheers, [nombre aleatorio] kind regards, [nombre aleatorio] parte 4:
for security reasons attached file is password protected. the password is <enlace a un archivo de imagen>.. for security purposes the attached file is password protected. password -- <enlace a un archivo de imagen>. note: use password <referencia a un archivo de imagen> to open archive. attached file is protected with the password for security reasons. password is <referencia a un archivo de imagen>. in order to read the attach you have to use the following password: <referencia a un archivo de imagen>. archive password: <referencia a un archivo de imagen>. password - <referencia a un archivo de imagen>. password: <referencia a un archivo de imagen>. archivo adjunto: [cualquiera de los siguientes con la extensi?n .exe, .com, .scr, .cpl]
information details readme document info details moreinfo message -----------------------
cuando el gusano se ejecuta muestra el siguiente falso mensaje de error:
error!
cant find a viewer associated with the file
[ ok ]
seguidamente se copia a si mismo como:
system \drvsys.exe
system \drvsys.exeopen
system \drvsys.exeopenopen
nota:
- system representa la carpeta system dentro de windows (ej. c:\windows\system, c:\winnt\system32 ).
adem?s crea la siguiente entrada en el registro para poder ejecutarse en cada reinicio del sistema:
hkey_current_user\.default\software\microsoft\windows\currentversion\run
drvsys.exe= system \drvsys.exe
adem?s el gusano abre el puerto tcp 2535 en el computador atacado y queda a la espera de ordenes remotas del atacante.
tambi?n intenta copiarse a si mismo dentro de las carpetas que esten compuestas por la palabra shar, con los siguientes nombres:
microsoft office 2003 crack, working!.exe microsoft windows xp, winxp crack, working keygen.exe microsoft office xp working crack, keygen.exe porno, sex, oral, anal cool, awesome!!.exe porno screensaver.scr serials.txt.exe kav 5.0 kaspersky antivirus 5.0 porno pics arhive, xxx.exe windows sourcecode update.doc.exe ahead nero 7.exe windown longhorn beta leak.exe opera 8 new!.exe xxx hardcore images.exe winamp 6 new!.exe winamp 5 pro keygen crack update.exe adobe photoshop 9 full.exe matrix 3 revolution english subtitles.exe intenta establecer contacto con un script php en los siguientes dominios:
http:/ /www.spiegel.de http:/ /www.leipziger-messe.de http:/ /www.mobile.de http:/ /www.neformal.de http:/ /www.avh.de http:/ /www.goethe.de http:/ /www.degruyter.de http:/ /www.heise.de http:/ /www.autoscout24.de http:/ /www.russische-botschaft.de http:/ /www.bmbf.de http:/ /www.berlinale.de http:/ /www.hamann-motorsport.de http:/ /spaceclub.de http:/ /www.fracht-24.de http:/ /www.loveparade.de http:/ /www.dalnoboyshik.de http:/ /www.deutschland.de http:/ /www.ac-schnitzer.de http:/ /abakan.strana.de http:/ /www.emis.de http:/ /www.dwd.de http:/ /www.ifdesign.de http:/ /www.beckers-systems.de http:/ /www.pri-wo-hamburg.de http:/ /virtualzone.de http:/ /www.mitsumi.de http:/ /www.fu-berlin.de http:/ /www.nabu.de http:/ /www.tekeli.de http:/ /www.welt.de http:/ /www.gospel-nations.de http:/ /www.neznakomez.de http:/ /www.tecchannel.de http:/ /www.php-resource.de http:/ /www.windac.de http:/ /www.gsi.de http:/ /www.turism.de http:/ /jakimov.golos.de http:/ /www.www.mirko-becker.gmxhome.de http:/ /vg.xtonne.de http:/ /www.go-amman.de http:/ /3treepoint.com http:/ /www.restarted-alliance.de http:/ /2udar.ligakvn.de http:/ /www.sprach-zertifikat.de http:/ /www.dfg.de http:/ /www.kliniken.de http:/ /www.winfuture.de http:/ /www.hamburg.de http:/ /www.auma.de http:/ /www.teac.de http:/ /www.eumetsat.de http:/ /www.documenta.de http:/ /hardvision.ru http:/ /www.bruecke-osteuropa.de http:/ /www.mk-motorsport.de http:/ /www.bundesregierung.de http:/ /ditec.um.es http:/ /www.insel-ruegen-hotel.de http:/ /www.tib.uni-hannover.de http:/ /www.chugai.de http:/ /www.blauer-engel.de http:/ /www.partner-inform.de http:/ /250x.com http:/ /villakinderbunt.de http:/ /s318.evanzo-server.de http:/ /andimeisslein.de http:/ /tobimayer.de http:/ /markusgimenez.de http:/ /www.fiz-karlsruhe.de http:/ /www.gdch.de http:/ /www.intermatgmbh.de http:/ /www.hotel-pension-spree.de http:/ /vg.xtonne.de http:/ /www.low-spirit.de http:/ /www.red-dot.de http:/ /www.fernuni-hagen.de http:/ /www.ruletka.de http:/ /www.deutsch-als-fremdsprache.de http:/ /www.uni-oldenburg.de http:/ /fotos.schneider.bards.de http:/ /www.deutsches-museum.de http:/ /www.de-bug.de http:/ /www.uni-stuttgart.de http:/ /www.embl-heidelberg.de http:/ /www.mdz-moskau.de http:/ /www.mitsubishi-evs.de http:/ /www.siegenia-aubi.com http:/ /www.cicv.fr http:/ /www.paromi.de http:/ /www.jura.uni-sb.de http:/ /www.exactaudiocopy.de finalmente intentara terminar todos los procesos activos con los siguientes nombres:
nmain.exe norton_internet_secu_3.0_407.exe npf40_tw_98_nt_me_2k.exe npfmessenger.exe nprotect.exe nsched32.exe ntvdm.exe nvarch16.exe kerio-wrp-421-en-win.exe killprocesssetup161.exe ldpro.exe localnet.exe lockdown.exe lockdown2000.exe lsetup.exe cleanpc.exe avprotect9x.exe cmgrdian.exe cmon016.exe cpf9x206.exe cpfnt206.exe cv.exe cwnb181.exe cwntdwmo.exe icssuppnt.exe defwatch.exe deputy.exe dpf.exe dpfsetup.exe drwatson.exe ent.exe escanh95.exe avxquar.exe escanhnt.exe escanv95.exe avpupd.exe exantivirus-cnet.exe fast.exe firewall.exe flowprotector.exe fp-win_trial.exe frw.exe fsav.exe autodown.exe fsav530stbyb.exe fsav530wtbyb.exe fsav95.exe gbmenu.exe gbpoll.exe guard.exe guarddog.exe hacktracersetup.exe htlog.exe hwpe.exe iamapp.exe iamapp.exe iamserv.exe icload95.exe icloadnt.exe icmon.exe icsupp95.exe icsuppnt.exe ifw2000.exe iparmor.exe iris.exe jammer.exe atupdater.exe aupdate.exe kavlite40eng.exe kavpers40eng.exe kerio-pf-213-en-win.exe kerio-wrl-421-en-win.exe borg2.exe bs120.exe cdp.exe cfgwiz.exe cfiadmin.exe cfiaudit.exe autoupdate.exe cfinet.exe navapw32.exe navdx.exe navstub.exe navw32.exe nc2000.exe ncinst4.exe autotrace.exe ndd32.exe neomonitor.exe netarmor.exe netinfo.exe netmon.exe netscanpro.exe netspyhunter-1.2.exe netstat.exe nisserv.exe nisum.exe cfiaudit.exe lucomserver.exe agentsvr.exe anti-trojan.exe anti-trojan.exe antivirus.exe ants.exe apimonitor.exe aplica32.exe apvxdwin.exe atcon.exe atguard.exe atro55en.exe atwatch.exe avconsol.exe avgserv9.exe avsynmgr.exe bd_professional.exe bidef.exe bidserver.exe bipcp.exe bipcpevalsetup.exe bisp.exe blackd.exe blackice.exe bootwarn.exe nwinst4.exe nwtool16.exe ostronet.exe outpostinstall.exe outpostproinstall.exe padmin.exe panixk.exe pavproxy.exe drwebupw.exe pcc2002s902.exe pcc2k_76_1436.exe pcciomon.exe pcdsetup.exe pcfwallicon.exe pcfwallicon.exe pcip10117_0.exe pdsetup.exe periscope.exe persfw.exe pf2.exe avltmain.exe pfwadmin.exe pingscan.exe platin.exe poproxy.exe popscan.exe exe tds2-nt.exe tds-3.exe tfak5.exe tgbob.exe titanin.exe titaninxp.exe tracert.exe trjscan.exe trjsetup.exe trojantrap3.exe undoboot.exe vbcmserv.exe vbcons.exe vbust.exe vbwin9x.exe vbwinntw.exe vcsetup.exe vfsetup.exe virusmdpersonalfirewall.exe vnlan300.exe vnpc3000.exe vpc42.exe vpfw30s.exe vptray.exe vscenu6.02d30.exe vsecomr.exe vshwin32.exe vsisetup.exe vsmain.exe vsmon.exe vsstat.exe vswin9xe.exe vswinntse.exe vswinperse.exe w32dsm89.exe w9x.exe watchdog.exe webscanx.exe cfiaudit.exe cfinet.exe icsupp95.exe mcupdate.exe cfinet32.exe clean.exe cleaner.exe luinit.exe mcagent.exe mcupdate.exe mfw2en.exe mfweng3.02d30.exe mgui.exe minilog.exe moolive.exe mrflux.exe msconfig.exe msinfo32.exe mssmmc32.exe mu0311ad.exe nav80try.exe zauinst.exe zonalm2601.exe zonealarm.exe
|
