Posts Tagged by Worm

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium
• Payload: Opens a back door on the compromised computer.
• Modifies Files: Infects .exe files on removable storage devices.

Distribution

• Distribution Level: Low
• Target of Infection: Spreads through removable storage devices.

Note: Virus definitions dated prior to November 25, 2005 may detect this as W32.Xddtray.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High

The worm is written in the Delphi programming language.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium

NOTE: Virus definitions dated prior to November 8, 2002 may detect this threat as W32.Wun.Irc.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High

The email has the following characteristics:

Subject: MS?DOS???? (the ?’s represent Chinese characters.)
Attachment: MShelp.EXE
Message: <Chinese text>

The worm makes numerous copies of itself in random locations, and moves to a new location when Windows Explorer browses to the folder from which it runs. It can spread to floppy disks and shared network drives under some conditions.

W32.Wullik.B@mm is written in Visual Basic. Virus definitions dated prior to November 7, 2003 may detect it as Bloodhound.W32.VBWORM.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High

W32.Wozer.Worm is written in Borland Delphi and is packed with UPX.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium
• Large Scale E-mailing: Mass mails itself to addresses found in the Windows Address Book.
• Modifies Files: Modifies certain files with HTML code to link to a remote URL on the game4enjoy.net domain.
• Releases Confidential Info: Steals account information for the World Of Warcraft game.

Distribution

• Distribution Level: High
• Subject of Email: Varies
• Name of Attachment: SetupV9.zip

All worms that are created using the kit copy themselves to \%System%\Wininet.exe. The optional password-stealing component creates the \%System%\Sysd.dll and \%System%\Exelib.dll files.

NOTE: %System% is a variable. The worm locates the \Windows\System folder (by default this is C:\Windows\System or C:\Winnt\System32) and copies itself to that location.

If the computer was infected with this worm, you should reset all passwords because the worm’s creator could have configured the worm to send them to the creator of the worm.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High

W32.Woredbot.C is a worm with back door capabilities that exploits the Microsoft Windows Server Service Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS06-040).

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low

W32.Woredbot is a network-aware worm with back door capabilities. It spreads by exploiting the Microsoft Windows Server Service Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS06-040).

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium

Subject: Why are you so playful??
Subject: What's Happening???
Subject: Check this out!
Subject: How are you??
Subject: You need help?
Attachment: Interesting.com
Attachment: Funny Clip.txt
Attachment: Nice Tool.exe
Attachment: Nice Song.asp
Attachmnet: Cool_File.mp3

The worm also spreads by using the KaZaA file-sharing program. It attempts to trick users into downloading and executing the worm.

If you use mIRC, the worm sends itself to other mIRC users.

Wild

• Wild Level: Low
• Number of Infections: 0 – 49
• Number of Sites: 0 – 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High