Nouveau virus : Bagle.AF Worm

[Invité Invité]

 Worm.Win32.Bagle.AF

Symptoms:

   * Files:
     %SYSDIR%\loader_name.exe
     %SYSDIR%\loader_name.exeopen
     %SYSDIR%\loader_name.exeopenopen
     where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
   * Registry key:
     HKCU\Software\Microsoft\Windows\CurrentVersion\Run
     with the value:
     "reg_key"="%SYSDIR%\loader_name.exe
   * Port 1234 opened (see it using "netstat -a" at the command prompt)


Technical description:
The worm comes by mail in the following form:

From: [spoofed]

Subject: one of the following:

   * Re: Msg reply
   * Re: Hello
   * Re: Yahoo!
   * Re: Thank you!
   * Re: Thanks [img=https://preprod.metagames.fr/forums/images/smilies/sourire.gif]
   * RE: Text message
   * Re: Document
   * Incoming message
   * Re: Incoming Message
   * RE: Incoming Msg
   * RE: Message Notify
   * Notification
   * Changes..
   * Update
   * Fax Message
   * Protected message
   * RE: Protected message
   * Forum notify
   * Site changes
   * Re: Hi
   * Encrypted document


Attachment: has a .exe, .scr, .com, .zip, .vbs, .hta or .cpl extension and one of the following names:

   * Information
   * Details
   * text_document
   * Updates
   * Readme
   * Document
   * Info
   * Details
   * MoreInfo
   * Message
   * Sources


Body text: may contain one or more of the following:

   * Read the attach.
   * Your file is attached.
   * More info is in attach
   * See attach.
   * Please, have a look at the attached file.
   * Your document is attached.
   * Please, read the document.
   * Attach tells everything.
   * Attached file tells everything.
   * Check attached file for details.
   * Check attached file.
   * Pay attention at the attach.
   * See the attached file for details.
   * Message is in attach
   * Here is the file.
   * For security reasons attached file is password protected. The password is [password]
   * For security purposes the attached file is password protected. Password -- [password]
   * Note: Use password [password] to open archive.
   * Attached file is protected with the password for security reasons. Password is [password]
   * In order to read the attach you have to use the following password: [password]
   * Archive password: [password]
   * Password - [password]
   * Password: [password]



When ran, the worm displays a fake error message:

Can't find a viewer associated with the file

and creates one of the following mutexes:

   * |MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
   * 'D'r'o'p'p'e'd'S'k'y'N'e't'
   * _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
   * [skyNet.cz]SystemsMutex
   * AdmSkynetJklS003
   * _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_


then creates the following files:

   * %SYSDIR%\loader_name.exe -- worm executable file
     where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
   *
   * %SYSDIR%\loader_name.exeopen -- worm copy with some garbage appended
   * %SYSDIR%\loader_name.exeopenopen -- worm zipped (may be password protected)


and creates the registry key:

   * HKCU\Software\Microsoft\Windows\CurrentVersion\Run
     with the value:
     "reg_key"="%SYSDIR%\loader_name.exe


The key above is created ten times per second, so deleting it will not help unless the process (loader_name.exe) is killed.

The worm tries to remove the following registry keys:

   * HKCU\Software\Microsoft\Windows\My AV
   * HKCU\Software\Microsoft\Windows\Zone Labs Client Ex
   * HKCU\Software\Microsoft\Windows\9XHtProtect
   * HKCU\Software\Microsoft\Windows\Antivirus
   * HKCU\Software\Microsoft\Windows\Special Firewall Service
   * HKCU\Software\Microsoft\Windows\service
   * HKCU\Software\Microsoft\Windows\Tiny AV
   * HKCU\Software\Microsoft\Windows\ICQNet
   * HKCU\Software\Microsoft\Windows\HtProtect
   * HKCU\Software\Microsoft\Windows\NetDy
   * HKCU\Software\Microsoft\Windows\Jammer2nd
   * HKCU\Software\Microsoft\Windows\FirewallSvr
   * HKCU\Software\Microsoft\Windows\MsInfo
   * HKCU\Software\Microsoft\Windows\SysMonXP
   * HKCU\Software\Microsoft\Windows\EasyAV
   * HKCU\Software\Microsoft\Windows\PandaAVEngine
   * HKCU\Software\Microsoft\Windows\Norton Antivirus AV
   * HKCU\Software\Microsoft\Windows\KasperskyAVEng
   * HKCU\Software\Microsoft\Windows\SkynetsRevenge
   * HKCU\Software\Microsoft\Windows\ICQ Net


To mail itself, the worm searches the local hard-disk for e-mail addresses inside files with the following extensions:

.wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx, .mbx, .mdx, .eml, .nch, .mmf, .ods, .cfg, .asp, .php, .wsh, .adb, .tbb, .sht, .xls, .oft, .uin, .cgi, .mht, .dhtm, .jsp

and uses its own SMTP engine to resolve the target mail server and to send mail to it, skipping e-mail addresses that contain:

@hotmail, @msn, @microsoft, rating@, f-secur, news, update, anyone@, bugs@, contract@, feste, gold-certs@, help@, info@, nobody@, noone@, kasp, admin, icrosoft, support, ntivi, unix, linux, listserv, certific, sopho, @foo, @iana, free-av, @messagelab, winzip, google, winrar, samples, abuse, panda, cafee, spam, @avp., noreply, local, root@, postmaster@.

Also the worm copies itself to directories that have shar in their names (for instance the P2P shared folders) with one of the following names:

   * Microsoft Office 2003 Crack, Working!.exe
   * Microsoft Windows XP, WinXP Crack, working Keygen.exe
   * Microsoft Office XP working Crack, Keygen.exe
   * Porno, sex, oral, anal cool, awesome!!.exe
   * Porno Screensaver.scr
   * Serials.txt.exe
   * KAV 5.0
   * Kaspersky Antivirus 5.0
   * Porno pics arhive, xxx.exe
   * Windows Sourcecode update.doc.exe
   * Ahead Nero 7.exe
   * Windown Longhorn Beta Leak.exe
   * Opera 8 New!.exe
   * XXX hardcore images.exe
   * WinAmp 6 New!.exe
   * WinAmp 5 Pro Keygen Crack Update.exe
   * Adobe Photoshop 9 full.exe
   * Matrix 3 Revolution English Subtitles.exe
   * ACDSee 9.exe



The worm also runs as backdoor on port 1234.

 

[source] : BitDefender VirusInfo

 

 

En Espérant que ca vous tombe pas dessus

[Invité Invité]

merci....

 

mais ce ki fais chier avec outlook c'est ke kan tu veux l'effacer t'es obliger de le metre en gras et apres tu vois ce kil y a linterieur...

 

sa l'ouvre kan meme alors ou pas ?

 

c'est vraiment la emrde ce truc

 

windaube arg

[Invité Invité]

il s'attaque a quel faille cette fois si IE?

[Invité Invité]

 

c surtout cette merde de outlook kil faut eviter comme la peste lol , y a tros de faille de securite sur ce soft , moi je vais le detruire de ma becanne c une veritable passoire

 

[Invité Invité]

moi je les utiliser uen fois et plus jamais

[Invité Invité]

utilisez le mail de mozilla

[Invité Invité]

 

t'a bien raison lol , kel m........................ ce outlook

 

[Invité Invité]

bahhh outlook je l'ai jamais utilisé et l'utiliserai jamais !!!

 

d'ailleur si quelqu'un sais comment virer ce truc parce que moi jy arive point !

[Invité Invité]

ya surement un executer a faire comme pour virer msnmessenger

[Invité Invité]

oué outlook deja rien ke le racourci ke g sur le buro il menerve lollllllll je lé viré mdr

 

allé jespere ke personne nora ce p$$$ de virus