Nouveau virus : Bagle.AF Worm

 Worm.Win32.Bagle.AF

 Symptoms:

    * Files:
      %SYSDIR%\loader_name.exe
      %SYSDIR%\loader_name.exeopen
      %SYSDIR%\loader_name.exeopenopen
      where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
    * Registry key:
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      with the value:
      "reg_key"="%SYSDIR%\loader_name.exe
    * Port 1234 opened (see it using "netstat -a" at the command prompt)


Technical description:
The worm comes by mail in the following form:

From: [spoofed]

Subject: one of the following:

    * Re: Msg reply
    * Re: Hello
    * Re: Yahoo!
    * Re: Thank you!
    * Re: Thanks 
    * RE: Text message
    * Re: Document
    * Incoming message
    * Re: Incoming Message
    * RE: Incoming Msg
    * RE: Message Notify
    * Notification
    * Changes..
    * Update
    * Fax Message
    * Protected message
    * RE: Protected message
    * Forum notify
    * Site changes
    * Re: Hi
    * Encrypted document


Attachment: has a .exe, .scr, .com, .zip, .vbs, .hta or .cpl extension and one of the following names:

    * Information
    * Details
    * text_document
    * Updates
    * Readme
    * Document
    * Info
    * Details
    * MoreInfo
    * Message
    * Sources


Body text: may contain one or more of the following:

    * Read the attach.
    * Your file is attached.
    * More info is in attach
    * See attach.
    * Please, have a look at the attached file.
    * Your document is attached.
    * Please, read the document.
    * Attach tells everything.
    * Attached file tells everything.
    * Check attached file for details.
    * Check attached file.
    * Pay attention at the attach.
    * See the attached file for details.
    * Message is in attach
    * Here is the file.
    * For security reasons attached file is password protected. The password is [password]
    * For security purposes the attached file is password protected. Password -- [password]
    * Note: Use password [password] to open archive.
    * Attached file is protected with the password for security reasons. Password is [password]
    * In order to read the attach you have to use the following password: [password]
    * Archive password: [password]
    * Password - [password]
    * Password: [password]



When ran, the worm displays a fake error message:

Can't find a viewer associated with the file

and creates one of the following mutexes:

    * |MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
    * 'D'r'o'p'p'e'd'S'k'y'N'e't'
    * _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
    * [SkyNet.cz]SystemsMutex
    * AdmSkynetJklS003
    * _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_


then creates the following files:

    * %SYSDIR%\loader_name.exe -- worm executable file
      where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
    *
    * %SYSDIR%\loader_name.exeopen -- worm copy with some garbage appended
    * %SYSDIR%\loader_name.exeopenopen -- worm zipped (may be password protected)


and creates the registry key:

    * HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      with the value:
      "reg_key"="%SYSDIR%\loader_name.exe


The key above is created ten times per second, so deleting it will not help unless the process (loader_name.exe) is killed.

The worm tries to remove the following registry keys:

    * HKCU\Software\Microsoft\Windows\My AV
    * HKCU\Software\Microsoft\Windows\Zone Labs Client Ex
    * HKCU\Software\Microsoft\Windows\9XHtProtect
    * HKCU\Software\Microsoft\Windows\Antivirus
    * HKCU\Software\Microsoft\Windows\Special Firewall Service
    * HKCU\Software\Microsoft\Windows\service
    * HKCU\Software\Microsoft\Windows\Tiny AV
    * HKCU\Software\Microsoft\Windows\ICQNet
    * HKCU\Software\Microsoft\Windows\HtProtect
    * HKCU\Software\Microsoft\Windows\NetDy
    * HKCU\Software\Microsoft\Windows\Jammer2nd
    * HKCU\Software\Microsoft\Windows\FirewallSvr
    * HKCU\Software\Microsoft\Windows\MsInfo
    * HKCU\Software\Microsoft\Windows\SysMonXP
    * HKCU\Software\Microsoft\Windows\EasyAV
    * HKCU\Software\Microsoft\Windows\PandaAVEngine
    * HKCU\Software\Microsoft\Windows\Norton Antivirus AV
    * HKCU\Software\Microsoft\Windows\KasperskyAVEng
    * HKCU\Software\Microsoft\Windows\SkynetsRevenge
    * HKCU\Software\Microsoft\Windows\ICQ Net


To mail itself, the worm searches the local hard-disk for e-mail addresses inside files with the following extensions:

.wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx, .mbx, .mdx, .eml, .nch, .mmf, .ods, .cfg, .asp, .php, .wsh, .adb, .tbb, .sht, .xls, .oft, .uin, .cgi, .mht, .dhtm, .jsp

and uses its own SMTP engine to resolve the target mail server and to send mail to it, skipping e-mail addresses that contain:

@hotmail, @msn, @microsoft, rating@, f-secur, news, update, anyone@, bugs@, contract@, feste, gold-certs@, help@, info@, nobody@, noone@, kasp, admin, icrosoft, support, ntivi, unix, linux, listserv, certific, sopho, @foo, @iana, free-av, @messagelab, winzip, google, winrar, samples, abuse, panda, cafee, spam, @avp., noreply, local, root@, postmaster@.

Also the worm copies itself to directories that have shar in their names (for instance the P2P shared folders) with one of the following names:

    * Microsoft Office 2003 Crack, Working!.exe
    * Microsoft Windows XP, WinXP Crack, working Keygen.exe
    * Microsoft Office XP working Crack, Keygen.exe
    * Porno, sex, oral, anal cool, awesome!!.exe
    * Porno Screensaver.scr
    * Serials.txt.exe
    * KAV 5.0
    * Kaspersky Antivirus 5.0
    * Porno pics arhive, xxx.exe
    * Windows Sourcecode update.doc.exe
    * Ahead Nero 7.exe
    * Windown Longhorn Beta Leak.exe
    * Opera 8 New!.exe
    * XXX hardcore images.exe
    * WinAmp 6 New!.exe
    * WinAmp 5 Pro Keygen Crack Update.exe
    * Adobe Photoshop 9 full.exe
    * Matrix 3 Revolution English Subtitles.exe
    * ACDSee 9.exe



The worm also runs as backdoor on port 1234.

[Source] : BitDefender VirusInfo


En Espérant que ca vous tombe pas dessus

merci....

mais ce ki fais chier avec outlook c'est ke kan tu veux l'effacer t'es obliger de le metre en gras et apres tu vois ce kil y a linterieur...

sa l'ouvre kan meme alors ou pas ?

c'est vraiment la emrde ce truc

windaube arg

il s'attaque a quel faille cette fois si IE?

c surtout cette merde de outlook kil faut eviter comme la peste lol , y a tros de faille de securite sur ce soft , moi je vais le detruire de ma becanne c une veritable passoire

moi je les utiliser uen fois et plus jamais

utilisez le mail de mozilla

t'a bien raison lol , kel m........................ ce outlook

bahhh outlook je l'ai jamais utilisé et l'utiliserai jamais !!!

d'ailleur si quelqu'un sais comment virer ce truc parce que moi jy arive point !

ya surement un executer a faire comme pour virer msnmessenger

oué outlook deja rien ke le racourci ke g sur le buro il menerve lollllllll je lé viré mdr

allé jespere ke personne nora ce p$$$ de virus