| |
M1CUK > INFO 28.10.02 01:05l 66 Lines 2261 Bytes #999 (0) @ WW
BID : 702380M1CUK
Read: DB0FHN GUEST
Subj: virus update
Path: DB0FHN<DB0ZWI<DB0CHZ<DB0ERF<DB0MRW<DB0RGB<OK0PPL<RZ6HXA<WA7V<WB7AWL<
W4JAX<GB7FCR
Sent: 021026/0420Z @:GB7FCR.#16.GBR.EU #:24476 [Blackpool] FBB-7.03a $:702380M1
From: M1CUK@GB7FCR.#16.GBR.EU
To : INFO@WW
Not Bugbear - WORM_HOBBIT.G (Low Risk)
------------------------------------------------------------------------
WORM_HOBBIT.G is a Win32 worm that propagates via Microsoft Outlook and
the KaZaa network. In Microsoft Outlook, it sends itself as an email
message with the following details:
Subject: Fwd: Scan your computer for this new virus threat...
Message Body: This is a fix and removal for the new internet worm known as
BugBear. 1 in ever 4 computers in infected with this virus. When run, it
will scan your computer and notify you if you're infected or not, then
clean if infected.
Attachment: Anti-Bug.exe
To make itself easily accessible over the Kazaa network, this worm copies
itself to the following folders:
C:\KaZaa\My Shared Folders
C:\Program Files\KaZaa\My Shared Folders
Upon execution, it displays a message box with the title "kn0x 0wnz" and
the message "System Not Infected with Bugbear".
This worm creates copies of itself in the Windows directory as shizzle.exe
and Anti-Bug.exe, and it adds a registry entry that allows it to execute
at every Windows startup.
It drops a number of files by certain names, which could have the
extensions .EXE, .PIF, .BAT, or .SCR. It also may choose filenames from a
lengthy list of specific possibilities.
This worm also attempts to perform a DoS (Denial of Service) attack on a
certain Web site by continuously sends PING requests to this site, each
containing 10,000 Bytes.
10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
(week of: October 14, 2002 to October 20, 2002)
------------------------------------------------------------------------
1. WORM_BUGBEAR.A
2. WORM_KLEZ.H
3. WORM_OPASOFT.A
4. JS_TRAFFICHBAR.A
5. WORM_YAHA.E
6. JS_EXCEPTION.GEN
7. JS_NOCLOSE.E
8. WORM_OPASOFT.D
9. PE_NIMDA.E
10. WORM_KLEZ.E
------------------------------------------------------------------------
73's
Trev, m1cuk@gb7fcr.#16.gbr.eu
SysOp gb7fcr
ax25 - tcp/ip - telnet - axip - RF & Internet Linked System's
Located in Blackpool, Lancashire, On the North West Coast of the UK
Message timed: 05:20 on 26 Oct 02
Message sent using WinPack-Telnet V6.80
WebSite http://gb7fcr.co.uk
E-Mail trev@gb7fcr.co.uk
Read previous mail | Read next mail
| |
