NoFi Virus!
Prikazujem rezultate 1 do 7 od 7

Tema: NoFi Virus!

  1. #1
    Poznat Jandrla (avatar)
    Učlanjen
    17.10.2003.
    Pol
    muški
    Lokacija
    na poslu...
    Poruke
    7.255
    Reputaciona moć
    124

    Podrazumevano NoFi Virus!

    ChuFaj se!
    "Mydoom"(Worm.SCO.A ili neka od varjanti) je najnoviji virus koji blabla...Ne otvaraj attachment-e tipa...chak iako dolaze sa 'poznate' adrese: document.zip," "message.zip," ili "readme.zip," jer sledi...zaraza...i backdoor na Fashj mashini... :wink:



  2. #2
    Domaćin
    Učlanjen
    02.09.2003.
    Poruke
    4.342
    Reputaciona moć
    0

    Podrazumevano

    ne mora zip.... moze i .exe .pif itd

  3. #3
    Poznat Jandrla (avatar)
    Učlanjen
    17.10.2003.
    Pol
    muški
    Lokacija
    na poslu...
    Poruke
    7.255
    Reputaciona moć
    124

    Podrazumevano

    Citat Original postavio d1
    ne mora zip.... moze i .exe .pif itd
    OK! ...itd je (za sada) .cmd .scr .bat :wink:

  4. #4
    Domaćin
    Učlanjen
    02.09.2003.
    Poruke
    4.342
    Reputaciona moć
    0

    Podrazumevano

    ma
    Kod:
    Novarg: New Worm - New Epidemic   [01/27/2004]
     
    
     
    Kaspersky Labs, a leading information security software developer has detected that a dangerous new Internet worm, Novarg (also known as Mydoom). In just a few hours this malicious program caused a global epidemic, infecting approximately 300 thousand computers throughout the world. This incident is the most serious outbreak so far this year, and shows every sign of breaking replication records set in 2003. 
    
    An explosion in malicious program activity undoubtedly points to serious preparations made by virus writers. This included the creation of a network of infected computers; when the number of computers in the network reached critical mass a command was sent to mail out Novarg. This is the same approach used previously by the email worm Sobig.F 
    
    Detailed analysis of the geographic spread of the worm leads to the assumption that Novarg was created in Russia. 
    
    Prevention, diagnosis and protection 
    
    Novarg spreads via the Internet in two ways: via email and via the KaZaA file-sharing network. 
    
    Infected messages have a random, falsified sender's address, 8 possible message headers, 18 possible attachment names and 5 possible extensions to attached files. Additionally, the worm spreads in messages where the message header, message body and attachment name contain a nonsensical collection of random characters. Such variability makes it far more difficult for users to independently identify infected messages. 
    
     
    
    Novarg appears in the KaZaA network under various names, including winamp5, icq2004-final and with various extensions, such as bat, exe, scr, pif and others. 
    
    If a user is thoughtless enough to launch the infected file, either from an email or downloaded from the KaZaA network Novarg initiates installation procedures and propagation routines. 
    
    Immediately after being launched Novarg opens a Notepad window which shows a series of random characters. 
    
     
    
    At the same time Novarg creates two files in the Windows folder: taskmon.exe (the worm carrier) and shimgapi.dll (a Trojan program to remotely control the infected machine). The worm registers these files in the system registry auto run key to ensure that the malicious program is activated every time the computer is restarted. 
    
    Novarg then initiates its propagation routine. The worm scans the disk for email addresses (files with extensions such as htm, wab, txt and others) and, unbeknownst to the user, sends infected emails to these addresses. In addition, Novarg checks whether or not the infected machine is connected to the KaZaA network: if a connection is open, the worm copies itself into the public folder for file exchange. 
    
    Novarg carries a very dangerous payload. Firstly, the worm installs a proxy server on the infected computer. Malefactors can then use this module in spamming or in mass-mailing new versions of the malicious program. 
    
    Secondly, Novarg installs a backdoor (a utility for unauthorized remote control) thus allowing the virus writer to control the infected machine. The backdoor makes it possible to steal, change or delete data, install third-party programs and so forth. 
    
    Thirdly, Novarg contains an inbuilt module for organizing a DoS attack on www.sco.com. This module will be activated between 1st February and 12th February 2004. During this period all infected machines will query this site, which may cause it to crash. 
    
    "The danger of the integration of virus and spam technologies to create united, dedicated networks for cyber-criminals is becoming a reality. We have detected two malicious programs within the first two days of this week that illustrate this trend", comments Eugene Kaspersky, Head of Anti-virus Research at Kaspersky Labs, "This problem may well signal a new era in computer virology in the near future, an era marked by even more frequent and serious outbreaks". 
    
    Kaspersky® anti-virus databases have already been updated with protection against Novarg.

  5. #5
    Poznat Jandrla (avatar)
    Učlanjen
    17.10.2003.
    Pol
    muški
    Lokacija
    na poslu...
    Poruke
    7.255
    Reputaciona moć
    124

    Podrazumevano

    blabla=... :wink:


    Aliases
    Name
    Novarg (F-Secure)
    W32.Novarg.A@mm (Symantec)
    Win32.Mydoom.A (CA)
    Win32/Shimg (CA)
    WORM_MIMAIL.R (Trend)


    This is a mass-mailing and peer-to-peer file-sharing worm that bears the following characteristics:

    contains its own SMTP engine to construct outgoing messages
    contains a backdoor component (see below)
    contains a Denial of Service payload
    If you think that you may be infected with Mydoom, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present. This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information).
    Note: Receiving an email alert stating that the virus came from your email address is not an indication that you are infected as the virus often forges the from address.



    The virus arrives in an email message as follows:

    From: (Spoofed email sender)
    Do not assume that the sender address is an indication that the sender is infected. Additionally you may receive alert messages from a mail server that you are infected, which may not be the case.

    Subject: (Varies, such as)

    Error
    Status
    Server Report
    Mail Transaction Failed
    Mail Delivery System
    hello
    hi
    Body: (Varies, such as)

    The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
    The message contains Unicode characters and has been sent as a binary attachment.
    Mail transaction failed. Partial message is available.
    Attachment: (varies [.bat, .exe, .pif, .cmd, .scr] - often arrives in a ZIP archive) (22,528 bytes)

    examples (common names, but can be random)
    doc.bat
    document.zip
    message.zip
    readme.zip
    text.pif
    hello.cmd
    body.scr
    test.htm.pif
    data.txt.exe
    file.scr
    In the case of two file extensions, multiple spaces may be inserted as well, for example:

    document.htm (many spaces) .pif
    The icon used by the file tries to make it appear as if the attachment is a text file:




    When this file is run (manually), it copies itself to the WINDOWS SYSTEM directory as taskmon.exe

    %SysDir%\taskmon.exe
    (Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)


    It creates the following registry entry to hook Windows startup:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
    The virus uses a DLL that it creates in the Windows System directory:

    %SysDir%\shimgapi.dll (4,096 bytes)
    This DLL is injected into the EXPLORER.EXE upon reboot via this registry key:

    HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 "(Default)" = %SysDir%\shimgapi.dll
    The virus will not replicate on the 12th February or later (although the DLL will still be installed).

    Peer To Peer Propagation
    The worm copies itself to the KaZaa Shared Directory with the following filenames:

    nuke2004
    office_crack
    rootkitXP
    strip-girl-2.0bdcom_patches
    activation_crack
    icq2004-final
    winamp
    Remote Access Component
    The worm (this functionality is in the dropped DLL) opens a connection on TCP port 3127 (if that fails it opens next available port up to port 3198). The worm can accept specially crafted TCP transmissions.

    On receipt of one kind of such a transmission it will save the embedded binary into a temporary file and execute it. Then the temporary file is deleted.
    On receipt of another kind it can relay TCP packets thus providing IP spoofing capabilities (possibly to facilitate SPAM distribution)
    Denial of Service Payload
    On the first system startup on February 1st or later, the worm changes its behavior from mass mailing to initiating a denial of service attack against the sco.com domain. This denial of service attack will stop on the first system startup of February 12th or later, and thereafter the worm's only behavior is to continue listening on TCP port 3127.

    Top of Page

    Symptoms
    Upon executing the virus, Notepad is opened, filled with nonsense characters.


    Existence of the files and registry entry listed above

    Top of Page

    Method Of Infection
    This worm tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.

    The mailing component harvests address from the local system. Files with the following extensions are targeted:

    wab
    adb
    tbb
    dbx
    asp
    php
    sht
    htm
    txt
    pl
    The worm avoids certain address, those using the following strings:

    .gov
    .mil
    abuse
    acketst
    arin.
    avp
    berkeley
    borlan
    bsd
    example
    fido
    foo.
    fsf.
    gnu
    google
    gov.
    hotmail
    iana
    ibm.com
    icrosof
    ietf
    inpris
    isc.o
    isi.e
    kernel
    linux
    math
    mit.e
    mozilla
    msn.
    mydomai
    nodomai
    panda
    pgp
    rfc-ed
    ripe.
    ruslis
    secur
    sendmail
    sopho
    syma
    tanford.e
    unix
    usenet
    utgers.ed
    Additionally, the worm contains strings, which it uses to randomly generate, or guess, email addresses. These are prepended as user names to harvested domain names:

    sandra
    linda
    julie
    jimmy
    jerry
    helen
    debby
    claudia
    brenda
    anna
    alice
    brent
    adam
    ted
    fred
    jack
    bill
    stan
    smith
    steve
    matt
    dave
    dan
    joe
    jane
    bob
    robert
    peter
    tom
    ray
    mary
    serg
    brian
    jim
    maria
    leo
    jose
    andrew
    sam
    george
    david
    kevin
    mike
    james
    michael
    john
    alex
    Finally the virus sends itself via SMTP - constructing messages using its own SMTP engine. The worm guesses the recipient email server, prepending the target domain name with the following strings:

    mx.
    mail.
    smtp.
    mx1.
    mxs.
    mail1.
    relay.
    ns.

    Top of Page

    Removal Instructions
    All Users :
    Use specified engine and DAT files for detection and removal.

    The shimgapi.dll file is injected into the EXPLORER.EXE process if the system has been rebooted after the infection has occured. In this situation, a reboot and rescan is required to remove this DLL from the system.

    Alternatively, following EXTRA.DAT packages are available.

    EXTRA.DAT
    SUPER EXTRA.DAT
    Modifications made to the system Registry and/or INI files for the purposes of hooking system startup will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

    Additional Windows ME/XP removal considerations

    Stinger
    Stinger 1.9.8 has been made available to assist in detecting and repairing this threat. A reboot is not required after running Stinger v 1.9.8.

    Manual Removal Instructions
    To remove this virus "by hand", follow these steps (WinNT/2K/XP):

    Terminate the process TASKMON.EXE
    Delete the file TASKMON.EXE from your WINDOWS SYSTEM directory (typically c:\windows\system32 or c:\winnt\system32)
    Edit the registry
    Delete the "TaskMon" value from
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    Change the (Default) value to webcheck.dll here
    HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
    Terminate the process EXPLORER.EXE
    From the WINDOWS TASK MANAGER, click FILE - RUN, type EXPLORER.EXE and hit ENTER.
    Delete the file SHIMGAPI.DLL your WINDOWS SYSTEM directory (typically c:\windows\system32 or c:\winnt\system32)
    Reboot the system
    McAfee Security Desktop Firewall
    To prevent possible remote access McAfee Desktop Firewall users can block incoming TCP port 3127.

    Sniffer Customers: Filters have been developed that will look for MyDoom traffic [Sniffer Distributed 4.1/4.2/4.3, Sniffer Portable 4.7/4.7.5, and Netasyst].

    W32_MyDoom@MM Sniffer Filters.zip
    ThreatScan users
    The latest ThreatScan signature (2004-01-27) includes detection of the Mydoom virus. This signature is available for ThreatScan v2.0, v2.1, and v2.5.

    ThreatScan users can also detect the backdoor portion of the virus by running a "Resource Discovery" task utilizing the port scanning options.

    To update your ThreatScan installations with the latest signatures perform the following tasks:

    From within ePO open the "Policies" tab.
    Select "McAfee ThreatScan" and then select "Scan Options"
    In the pane below click the "Launch AutoUpdater" button.
    Using the default settings proceed through the dialogs that appear. Upon successful completion of the update a message will appear stating that; update 2004-01-27 has completed successfully.
    From within ePO create a new "AutoUpdate on Agent(s)" task.
    Go into the settings for this task and ensure that the host field is set to ftp.nai.com , the path is set to /pub/security/tsc20/updates/winnt/ and that the user and password fields are both set to ftp. Note that "tsc20" in the above path is used for ThreatScan 2.0 and 2.1. The correct path for ThreatScan 2.5 is "tsc25".
    Launch this task against all agent machines.
    When the task(s) complete information will be available in the "Task Status Details" report.
    To create and execute a new task containing the new update functionality, do the following:

    - Create a new ThreatScan task.
    - Edit the settings of this task.
    - Edit the "Task option", "Host IP Range" to include all desired machines to scan.
    To scan for the virus:

    Select the "Remote Infection Detection" category and "Windows Virus Checks" template. -or-
    Select the "Other" category and "Scan All Vulnerabilities" template.
    To create and execute a new task to perform a port scan, do the following:

    Create a new Resource Discovery task.
    Edit the settings of this task.
    Edit the "Task option", "Host IP Range" to include all desired machines to scan.
    To scan for the virus:

    Select the "Port Scan" option.
    Select the "TCP Port Scan" option.
    Enter 3127 in the "TCP Port Ranges" field.
    Launch the scan.
    For additional information:

    Run the "ThreatScan Template Report"
    Look for module number #4061

  6. #6
    Domaćin
    Učlanjen
    02.09.2003.
    Poruke
    4.342
    Reputaciona moć
    0

    Podrazumevano

    i sad neka neko pita sta da radi sa virusom mydoom...

  7. #7
    Primećen član
    Učlanjen
    08.12.2003.
    Poruke
    815
    Reputaciona moć
    60

    Podrazumevano

    Vi niste normalni

Slične teme

  1. Gde je VIRUS?
    Autor k0604 u forumu Sigurnost i zaštita
    Odgovora: 17
    Poslednja poruka: 16.08.2007., 22:59
  2. Virus
    Autor haker u forumu Mobilna telefonija
    Odgovora: 6
    Poslednja poruka: 22.10.2006., 13:59
  3. virus
    Autor u forumu Sigurnost i zaštita
    Odgovora: 2
    Poslednja poruka: 17.10.2004., 12:08
  4. Da li je ovo virus ili....
    Autor absonic u forumu Sigurnost i zaštita
    Odgovora: 0
    Poslednja poruka: 29.02.2004., 13:00

Pravila za slanje poruka

  • Ne možete kreirati novu temu
  • Ne možete poslati odgovor
  • Ne možete dodati priloge
  • Ne možete prepraviti svoju poruku
  •