Поддержка
Круглосуточная поддержка

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

Win32.HLLM.Bagz

(Email-Worm.Win32.Bagz.o, Generic Dropper, Trojan-Dropper.Win32.Agent.ka, WORM_BAGZ.C, TR/Drop.Agent.KA, Cryp_Upack, Dropper.Agent.LB, Email-Worm.Win32.Bagz.c, MemScan:Win32.Bagz.O@mm, TROJ_SMALL.AJG, I-Worm/Bagz.B, Worm:Win32/Gaobot, I-Worm/Bagz.C, TR/Vundo.Gen, TR/Drop.Agent.LG.3, Worm/Bagz.i.7, Worm:Win32/Bagz.A@mm, Worm:Win32/Bagz.E@mm, I-Worm/Bagz.CM, Email-Worm.Win32.Bagz.n, W32/Bagz.a@MM, Worm32/Bagz.J, I-Worm/Bagz.I, W32/Bagz.y@MM, Dropper.Agent.UP, Worm/Bagz.H.10)

Описание добавлено:

Тип вируса: Семейство почтовых червей массовой рассылки

Уязвимые ОС: Win95/98/Me/NT/2000/XP

Размер файла: 80 321 байт, 38 401 байт, 112 132 байта, 32 839 байт, 117 252 байта, 157 197 байт, 121 860 байт, 70 146 байт, 37 377 байт, 111 616 байт, 163 844 байта, 139 264 байта, 38 402 байта, 38 913 байт, 38 913 байт, 166 913 байт, 38 912 байт, 36 865 байт, 123 904 байта

Упакован: UPX

Техническая информация

  • При своём запуске регистрируют себя как системную службу (Win NТ Logon Application). Имя службы ALEXORA, выводимое имя службы - Windows Secure SSL.
  • Различные модификации этого семейства копируют в %System% файлы trace32.exe, tracd32.exe, sysinfo32.exe, combo.exe.
  • Обеспечивает свой запуск при каждой загрузке Windows, модифицируя ключ в системном реестре
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

  • Производит записи в Windows Hosts File:

    ad.doubleclick.net
    ad.fastclick.net
    ads.fastclick.net
    ar.atwola.com
    atdmt.com
    avp.ch
    avp.com
    avp.ru
    awaps.net
    banner.fastclick.net
    banners.fastclick.net
    ca.com
    click.atdmt.com
    clicks.atdmt.com
    dispatch.mcafee.com
    download.mcafee.com
    download.microsoft.com
    downloads.microsoft.com
    engine.awaps.net
    fastclick.net
    f-secure.com
    ftp.f-secure.com
    ftp.sophos.com
    go.microsoft.com
    liveupdate.symantec.com
    mast.mcafee.com
    mcafee.com
    media.fastclick.net
    msdn.microsoft.com
    my-etrust.com
    nai.com
    networkassociates.com
    office.microsoft.com
    phx.corporate-ir.net
    secure.nai.com
    securityresponse.symantec.com
    service1.symantec.com
    sophos.com
    spd.atdmt.com
    support.microsoft.com
    symantec.com
    update.symantec.com
    updates.symantec.com
    us.mcafee.com
    vil.nai.com
    viruslist.ru
    windowsupdate.microsoft.com
    www.avp.ch
    www.avp.com
    www.avp.ru
    www.awaps.net
    www.ca.com
    www.fastclick.net
    www.f-secure.com
    www.kaspersky.ru
    www.mcafee.com
    www.my-etrust.com
    www.nai.com
    www.networkassociates.com
    www.sophos.com
    www.symantec.com
    www.trendmicro.com
    www.viruslist.ru
    www3.ca.com
    localhost
  • Червь блокирует доступ к указанным URL. Host-файл, содержащий такие строки детектируется как Trojan.Qhost.1836.

  • В зависимости от своей модификации, может устанавливать в систему прокси-сервер, детектируемый как Trojan.BagzProxy.

  • Ищет адреса для своей дальнейшей рассылки, просматривая файлы с следующими расширениями:

    .txt
    .htm
    .wab
    .tbb
    .dbx

  • Тело сообщения содержит следующий текст:
  • Hi
    Did you get the previous document I attached for you?
    I resent it in this email just in case, because I
    really need you to check it out asap.
    Best Regards

    Hi
    I made a mistake and forgot to click attach
    on the previous email I sent you. Please give me
    your opinion on this opportunity when you get a chance.
    Best Regards

    Hi
    Sorry, I forgot to send an important
    document to you in that last email. I had an important phone call.
    Please checkout attached doc file when you have a moment.
    Best Regards

    I was in a rush and I forgot to attach an important
    document. Please see attached doc file.

    Sorry to bother you, but I am having a problem receiving your emails.
    I am responding to your last email in the attached file.
    Please get back to me if there is any problem reading the attachment.

    I am responding to your last email in the attached file.
    I had a delivery problem with your inbox, so maybe you'll receive this now.

    Can you please check out the email I have attached?
    For some reason, I received only part of your last several emails.
    I want to make sure that there are no problems with either of our accounts.

    This email is being sent as attachment because
    it was previously blocked by your email filters.
    Please view the attachment and respond.
    Thanks

    I resent this email as attachment because
    it was previously blocked by your email filters.
    Please read the attachment and respond.
    Thanks

    I apologize, but I need you to verify
    that I have the correct contact info for you.
    My system crashed last weekend and
    I lost most of my friends and work contacts.
    Please check the attached (.pdf) and
    please let me know if your info is current.

    My last email to you was returned.
    The reason is that I am not currently
    added to your "allowed" contact list.
    Please add my updated contact info
    provided in the attached (.pdf) file
    so I can send you emails in the future.
    Sincerely

    I have updated my email address
    See the (.pdf) file attached and
    please respond if you have any questions.

    We have made recent updates to our database.
    Please verify your mailing address on file is correct.
    We have attached a (.pdf) sheet for you to use for your response.

    Hello
    Our contact information has changed.
    See the attached (.pdf) sheet for details.
    Sincerely,

    ***URGENT: SERVICE SHUTDOWN NOTICE***
    Due to your failure to comply with our email
    Rules and Regulations, your email account has been
    temporarily suspended for 24 hours unless we are contacted regarding
    this situation.
    You must read the attached document for further
    instructions. Failure to comply will result in termination of your account.
    Regards, Net Operator
    ***URGENT: SERVICE SHUTDOWN NOTICE***

    ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
    You are currently unable to send emails.
    This may be a billing issue.
    Please call the billing center.
    The # for the billing office is located in the attached
    contact list for your convenience.

    ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
    ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
    Hello,
    The previous email you sent has been recognized as spam.
    This means your email was not delivered to your friend or client.
    You must open the attached file to receive more information.

    ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
    Hello,
    What version of windows you are using?
    This last document I received from you came out weird.
    Please see the attached word file and resend the file to me.
    Many thanks, User

    Hello,
    My PC crashed while I was sending that last email.
    I have re-attached the document of yours that I discovered.
    Please read attached document and respond ASAP.
    Sincerely, User

    Hello,
    Your email was sent in an INVALID format.
    To verify this email was sent from you,
    simply open the attached email (.eml) file
    and click yes in the sender options box.
    Thank You, User

    Hello,
    Your email was received.
    YOUR REPLY IS URGENT!
    Please view the attached text file for instructions.
    Regards, User

    Hello,
    I was in a hurry and I forgot to attach an important
    document. Please see attached.
    Regards, User

    Hello,
    I resent this email as attachment because
    it was previously blocked by your email filters.
    Please read the attachment and respond.
    Thanks, User

    Hello,
    I resent this email as attachment because
    it was previously blocked by your email filters.
    Please read the attachment and respond.
    Sincerely, User

  • Тема вложения может быть следующей:

    ASAP
    please responce
    Read this
    urgent
    toxic
    contract
    Money
    office
    Have a nice day
    Hello
    Russian's
    Amirecans
    attachments
    attach
    waiting
    best regards
    Administrator
    Warning
    text
    Vasia
    re: Andrey
    re: please
    кe: order
    Allert!
    Att
    Hi

  • В системном реестре удаляет ключи, сожержащие следующие подстроки:

    \pfwadmin.exe
    \persfw.exe
    \sched.exe
    \aswupdsv.exe
    \aswregsvr.exe
    \aswboot.exe
    \ashskpck.exe
    \ashskpcc.exe
    \ashsimpl.exe
    \ashserv.exe
    \ashquick.exe
    \ashpopwz.exe
    \ashmaisv.exe
    \ashlogv.exe
    \ashdisp.exe
    \ashchest.exe
    \ashbug.exe
    \ashavast.exe
    \symnavo.dll
    \statushp.dll
    \sdstp32i.dll
    \sdsok32i.dll
    \sdsnd32i.dll
    \sdpck32i.dll
    \scriptui.dll
    \scanmgr.dll
    \scandres.dll
    \scandlvr.dll
    \savscan.exe
    \savrtpel.sys
    \savrt32.dll
    \savrt.sys
    \s32navo.dll
    \s32integ.dll
    \quaropts.dat
    \quarantine
    \quar32.dll
    \qspak32.dll
    \qconsole.exe
    \qconres.dll
    \ptchinst.dll
    \probegse.dll
    \patch25d.dll
    \opscan.exe
    \officeav.dll
    \oeheur.dll
    \netbrext.dll
    \navwnt.exe
    \navw32.exe
    \navuihtm.dll
    \navui.nsi
    \navui.dll
    \navtskwz.dll
    \navtasks.dll
    \navstub.exe
    \navstats.dll
    \navshext.dll
    \navprod.dll
    \navopts.dll
    \navoptrf.dll
    \navntutl.dll
    \navlucbk.dll
    \navlogv.dll
    \navlnch.dll
    \navlcom.dll
    \navevent.dll
    \naverror.dll
    \navcomui.dll
    \navcfgwz.dll
    \navapw32.exe
    \navapw32.dll
    \navapsvc.exe
    \navapscr.dll
    \navap32.dll
    \n32exclu.dll
    \n32call.dll
    \ltchkres.dll
    \djsalert.dll
    \defalert.dll
    \cfgwzres.dll
    \cfgwiz.exe
    \ccimscn.exe
    \ccimscan.dll
    \ccavmail.dll
    \bootwarn.exe
    \avres.dll
    \avcompbr.dll
    \apwutil.dll
    \apwcmdnt.dll
    \aboutplg.dll
    \zlparser.dll
    \vsvault.dll
    \vsruledb.dll
    \vsmon.exe
    \vsdb.dll
    \vsavpro.dll
    \ssleay32.dll
    \cerbprovider.pvx
    \camupd.dll
    \zonealarm.exe
    \zl_priv.htm
    \zlclient.exe
    \zav.zap
    \zauninst.exe
    \zatutor.exe
    \tutorwiz.dll
    \security.zap
    \programs.zap
    \idlock.zap
    \framewrk.dll
    \firewall.zap
    \filter.zap
    \email.zap
    \alert.zap
    \wormres.dll
    \vsowow.dll
    \vsoupd.dll
    \vsoui.dll
    \mcshield.dll
    \vsagntui.dll
    \shlres.dll
    \shextres.inf
    \shextbin.inf
    \scrstres.inf
    \scrpsbin.inf
    \scrpres.dll
    \scanserv.dll
    \scan.dat
    \patchw32.dll
    \outscres.dll
    \outscan.dll
    \ntclient.dll
    \naievent.dll
    \naiann.dll
    \mcvsworm.dll
    \mcvsskt.dll
    \mcvsshld.exe
    \mcvsshl.dll
    \mcvsscrp.dll
    \mcvsrte.exe
    \mcvsmap.exe
    \mcvsftsn.exe
    \mcvsescn.exe
    \mcvsctl.dll
    \mcurial.dll
    \mcshield.exe
    \mcscan32.dll
    \mcmnhdlr.exe
    \mcavtsub.dll
    \imscnres.inf
    \imscnbin.inf
    \ftscnres.dll
    \emscnres.dll
    \edisk.dll
    \ashldres.dll
    \appinit.ini
    \804mbd1.img
    \804mbd1.chk
    \mghtml.exe
    \mcinfo.exe
    \mcappins.exe
    \dunzip32.dll
    \mvtx.exe
    \mpfwizard.exe
    \mpfupdchk.dll
    \mpfui.dll
    \mpftray.exe
    \mpfservice.exe
    \mpfconsole.exe
    \mpfagent.exe
  • Не рассылает свои копии по адресам, содержащие следующие подстроки:

    webmaster@
    update
    unix
    support@
    support
    spam
    sopho
    samples
    root@
    rating@
    postmaster@
    pgp
    panda
    ntivi
    noreply
    noone@
    nobody@
    news
    netadmin@
    local
    listserv
    linux
    kasp
    info@
    icrosoft
    hostmaster@
    help@
    google
    gold-certs@
    gold-
    free-av
    feste
    f-secur
    contract@
    contact@
    certs@
    certific
    cafee
    bugs@
    bsd
    anyone@
    all@
    administrator@
    admin
    abuse
    @microsoft
    @messagelab
    @iana
    @foo
    @avp

  • Также, в папку %System% помещаются временные файлы с двойным расширением [filename].doc[spaces].exe и их одноимённые копии в ZIP-архивах.
  • Вложение представляет собой либо ZIP-архив, либо файл с двойным расширением:

    backup.zip
    admin.zip
    archivator.zip
    about.zip
    readme.zip
    help.zip
    photos.zip
    payment.zip
    archives.zip
    manual.zip
    inbox.zip
    outbox.zip
    save.zip
    rar.zip
    zip.zip
    ataches.zip
    documentation.zip
    docs.zip
    backup.doc .exe
    admin.doc .exe
    archivator.doc .exe
    about.doc .exe
    readme.doc .exe
    help.doc .exe
    photos.doc .exe
    payment.doc .exe
    archives.doc .exe
    manual.doc .exe
    inbox.doc .exe
    outbox.doc .exe
    save.doc .exe
    rar.doc .exe
    zip.doc .exe
    ataches.doc .exe
    documentation.doc .exe
    docs.doc .exe
    sysboot.doc .exe