::::: 해커즈뉴스 / 해커몰 :::::

해커즈뉴스 / 해커대학

Donation bitcoin(기부용 비트코인 주소)

1Pq3K39XM5xx4CifGKgppXeavtWNNHH7K4

기부하신 비트코인은 "보안 취약 계층"을 위해 사용되고 있습니다.

Donation bitcoin(기부용 비트코인 주소)

1Pq3K39XM5xx4CifGKgppXeavtWNNHH7K4

기부하신 비트코인은 "보안 취약 계층"을 위해 사용되고 있습니다.

공지

1. MS 엣지 브라우저에서의 경고창은 '윈도우 디펜더'를 끄시면 됩니다.

'윈도우 디펜더 끄기'

2. 크롬 브라우저로 접속시 나오는 악성코드 경고창은 구글 크롬의 에러, 즉 오탐(탐지 오류)이므로 무시하시면 됩니다.

3. 이 사이트는 안전하며 깨끗하다는 것을 알려 드립니다.

4. 무고한 사이트들에 대한 공룡 기업 브라우저들의 무차별적인 '탐지 오류 횡포'가 사용자들의 정보 공유의 자유를 침해하고 있습니다. 이에 대응하여 이 기업들을 상대로 소송을 준비하고 있습니다.

해커즈뉴스 제공 바이러스 경보

2004/6/29(화)

Bugbear.K 웜

바이러스/웜 명칭 : Bugbear.K 웜
발령일시 : 6월29일
바이러스 유형 : 웜
위험도 : 상
해당시스템 : 윈도
W32.Bugbear.K@mm worm is:

A variant of W32.Bugbear.B@mm and W32.Bugbear.E@mm.
A mass-mailing worm that also spreads through network shares.
Polymorphic and also infects .exe files.
Possesses keylogging capabilities.

Type: Virus, Worm
Infection Length: 43,520 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, EPOC, Linux, Macintosh, Macintosh OS X, Novell Netware, OS/2, UNIX, Windows 3.x

=====

When W32.Bugbear.K@mm is executed, it performs the following actions:

Copies itself as %System%\<random filename>.exe.

Note: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Drops three files as %System%\<random filename>.dll.

Note: One of the .dll files is detected as PWS.Hooker.Trojan and should be deleted. The other two files are not malicious.

Creates a randomly named file with a .tmp extension in the %System% folder. This is a .zip file containing a copy of the worm.

Creates a randomly named .nls file in the %System% folder. This file is not malicious.

Creates several randomly named .dat files, and a .bak file in the %Windir% folder. These files are not malicious.

Note: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.

Adds the value:

"<random value>" = "%System%\<random filename>.exe"

in the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when Windows starts.

The worm is also a polymorphic file infector that attempts to append its code to the following files in the %Windir% folder and %ProgramFiles% folder:

scandskw.exe
regedit.exe
mplayer.exe
hh.exe
notepad.exe
winhelp.exe
Internet Explorer\iexplore.exe
adobe\acrobat 7.0\reader\acrord32.exe
WinRAR\WinRAR.exe
Windows Media Player\mplayer2.exe
Real\RealPlayer\realplay.exe
Outlook Express\msimn.exe
Far\Far.exe
CuteFTP\cutftp32.exe
Adobe\Acrobat 6.0\Reader\AcroRd32.exe
Adobe\Acrobat 5.0\Reader\AcroRd32.exe
Adobe\Acrobat 4.0\Reader\AcroRd32.exe
ACDSee32\ACDSee32.exe
MSN Messenger\msnmsgr.exe
WS_FTP\WS_FTP95.exe
QuickTime\QuickTimePlayer.exe
StreamCast\Morpheus\Morpheus.exe
Zone Labs\ZoneAlarm\ZoneAlarm.exe
Trillian\Trillian.exe
Lavasoft\Ad-aware 6\Ad-aware.exe
AIM95\aim.exe
Winamp\winamp.exe
DAP\DAP.exe
ICQ\Icq.exe
kazaa\kazaa.exe
winzip\winzip32.exe

Note: %ProgramFiles% is a variable that refers to the path to the program files folder. By default, this is C:\Program Files.

Scans all hard disks, looking for folders that contain any of the following strings:

BEAR
DONKEY
DOWNLOAD
FTP
HTDOCS
HTTP
MORPHEUS
ICQ
KAZAA
LIME
MULE
SHAR
UPLOAD

If a file within these folders contain files with a .exe extension, the worm will attempt to infect that file.

Otherwise, it will copy itself as <original filename.ext>.exe (where .ext is the original file's extension).

Collects the email address from the default email program's Inbox and from the files with the following extensions:

.dbx
.tbb
.eml
.mbx
.nch
.mmf
Inbox
.ods
.htm
.asp
.txt
.sht

Uses its own SMTP engine to email itself to the email addresses that it collects.

The email will have the following characteristics:

Subject: (One of the following)
Hello!
update
hmm..
Payment notices
Just a reminder
look
history screen
Announcement
various
Introduction
Interesting...
I need photo!!!
Stats
Please Help...
Report
Greetings!
[Fwd: look] ;-)
Today Only
New Contests
Lost & Found
bad news
wow!
fantastic
Me nude
Old photos
empty account
photos
Is that your password?
I love you!
new reading
Friendly
photo
Warning!
Love
You are fat!
News
Fwd:
I cannot forget you!
Sex pictures
Your Gift
Re:
good news!
sexy
Hi!
!!! WARNING !!!
Greets!

Attachment: (One of the following)

a000032.jpg .scr
song.wav .scr
music.mp3 .scr
video.avi .scr
photo.jpg .scr
girls.jpg .scr
pic.jpg .scr
message.txt .scr
image.jpg .scr
news.doc .scr
myphoto.jpg .scr
you.jpg .scr
love.jpg .scr
readme.txt .scr

Locates the following information from the infected computer and sends it to the attacker:

Cookies
Clipboard contents
Logged keystrokes
Text from open windows

No	I▒N▒D▒E▒X	Date
222	Korgo.W 웜 경보	2004/07/04
221	Refest 트로이 경보	2004/07/02
220	Bugbear.K 웜	2004/06/29
219	트로이-하이재커	2004/06/27
218	Korgo.Q 변종 웜	2004/06/25
217	Korgo.O 변종 웜	2004/06/23
216	Anisc 바이러스 경보	2004/06/21
215	Korgo.L 변종 웜	2004/06/19