::::: 해커즈뉴스 / 해커몰 :::::

해커즈뉴스 / 해커대학

Donation bitcoin(기부용 비트코인 주소)

1Pq3K39XM5xx4CifGKgppXeavtWNNHH7K4

기부하신 비트코인은 "보안 취약 계층"을 위해 사용되고 있습니다.

Donation bitcoin(기부용 비트코인 주소)

1Pq3K39XM5xx4CifGKgppXeavtWNNHH7K4

기부하신 비트코인은 "보안 취약 계층"을 위해 사용되고 있습니다.

공지

1. MS 엣지 브라우저에서의 경고창은 '윈도우 디펜더'를 끄시면 됩니다.

'윈도우 디펜더 끄기'

2. 크롬 브라우저로 접속시 나오는 악성코드 경고창은 구글 크롬의 에러, 즉 오탐(탐지 오류)이므로 무시하시면 됩니다.

3. 이 사이트는 안전하며 깨끗하다는 것을 알려 드립니다.

4. 무고한 사이트들에 대한 공룡 기업 브라우저들의 무차별적인 '탐지 오류 횡포'가 사용자들의 정보 공유의 자유를 침해하고 있습니다. 이에 대응하여 이 기업들을 상대로 소송을 준비하고 있습니다.

해커즈뉴스 제공 바이러스 경보

2004/7/14(수)

Lovgate.AC 웜경보

바이러스/웜 명칭 : Lovgate.AC 웜경보
발령일시 : 7월14일
바이러스 유형 : 웜
위험도 : 상
해당시스템 : 윈도
W32.Lovgate.AC@mm is mass-mailing worm that spreads using the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026) and through open network shares.

The worm infects executable files and allows unauthorized remote access to the infected computer.

Type: Worm
Infection Length: 131,072 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2, UNIX

=====

When W32.Lovgate.AC@mm is executed, it performs the following actions:

Creates the following files:

%Windir%\CDPlay.exe
%System%\iexplore.exe
%System%\RAVMOND.exe
%System%\WinHelp.exe
%System%\Update_OB.exe
%System%\TkBellExe.exe
%System%\hxdef.exe
%System%\Kernel66.dll, which is a hidden file.

Notes:
%Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
%System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Creates a file named CDROM.COM in the root folder of all drives, except CD-ROM drives. The file attributes are set to system, hidden, and read_only.

Creates an autorun.inf file on each drive with the lines:

[Autorun]
open="C:\cdrom.com" /StartExplorer

Creates an archive containing a copy of the worm with the following format in the root folder of all drives, unless the drive letter is A or B:

<filename>.<ext>

Where <filename> may be one of the following:
Bakeup
Tools
email

and <ext> is one of the following:
RAR
ZIP

Adds the values:

"Winhelp" = "%system%\TkBellExe.exe..."
"Hardware Profile" = "%system%\hxdef.exe..."
"Program in Windows"="%system%\IEXPLORE.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Adds the values:

"COM++ System" = "exploier.exe..."
"SystemTra" = "%windows%\CDPlay.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\runServices

which starts the worm when Windows starts.

Adds the value:

"run"="RAVMOND.exe"

to the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

which starts the worm when Windows starts.

Modifies the value:

(Default) = "Update_OB.exe %1..."

in the registry keys:

HKEY_CLASSES_ROOT\txtfile\shell\open\command

so that the worm will run each time a .txt file is opened.

Stops the following services:

Rising Realtime Monitor Service
Symantec AntiVirus Server
Symantec AntiVirus Client

Terminates any processes with the following strings in their names:

rising
SkyNet
Symantec
McAfee
Gate
Rfw.exe
RavMon.exe
kill
NAV
Duba
KAV

Scans all the drives on the infected computer. If the drive type is removable, mapped, or the drive type is fixed with a drive letter greater than E, it does the following:

Attempts to rename the extensions of all .exe files to .zmx.
Sets the attributes on these files to hidden and system.
Copies itself as the original file name.

Injects a process-watching procedure, as a thread, into either Explorer.exe or Taskmgr.exe. If this thread detects that the worm process has stopped, it will attempt to launch %System%\Iexplore.exe.

Listens on TCP port 6000.

Steals information from an infected computer and stores it in the file, C:\Netlog.txt. The worm then emails the stolen information to the hacker.

Determines the location of the Kazaa shared folder from the registry.

Creates a copy of itself in the Kazaa shared folder as one of the following (with a .bat, .exe, .pif, or .scr file extension):

wrar320sc
REALONE
BlackIcePCPSetup_creak
Passware5.3
word_pass_creak
HEROSOFT
orcard_original_creak
rainbowcrack-1.1-win
W32Dasm
setup
<random file name>

Scans computers attached to the same local network as the infected computer, attempting to authenticate to the administrative shares. The worm uses "Administrator" for a username, combined with the following passwords:

!@#$
!@#$%
!@#$%^
!@#$%^&
!@#$%^&*
000000
00000000
007
110
111
111111
11111111
121212
123
123123
1234
12345
123456
1234567
12345678
123456789
123abc
123asd
2003
2004
2600
321
54321
654321
666666
888888
88888888
aaa
abc
abc123
abcd
abcdef
abcdefg
Admin
admin
admin123
Administrator
administrator
alpha
asdf
asdfgh
computer
database
enable
god
godblessyou
Guest
guest
home
Internet
login
Login
love
mypass
mypass123
mypc
mypc123
oracle
owner
pass
passwd
Password
password
pw123
pwd
root
secret
server
sex
sql
super
sybase
temp
temp123
test
test123
win
xxx
yxcv
zxcv

If the worm successfully authenticates to a remote computer, it will attempt to create the following copy of itself as \\<remote computer name>\admin$\system32\NetManager.exe.

It will then start the file as the service, "Windows Management NetWork Service Extensions" which is mapped to "NetManager.exe -exe_start."

Creates a network share named "Media", which is mapped to %Windir%\Media.

Copies itself to all network shared folders using one or more of the following names:

WinRAR.exe
Internet Explorer.bat
Documents and Settings.txt.exe
Microsoft Office.exe
Windows Media Player.zip.exe
Support Tools.exe
WindowsUpdate.pif
Cain.pif
MSDN.ZIP.pif
autoexec.bat
findpass.exe
client.exe
i386.exe
winhlp32.exe
xcopy.exe
mmc.exe

Replies to any email messages that arrive in the inbox of certain MAPI-compliant email clients, such as Microsoft Outlook.

For example, if the incoming email has the following properties:

Subject: <subject>
Message: <original message body>

The worm will attempt to reply with the following:

Subject: Re: <subject>
Message:
'<sender>' wrote:
====
> <original message body>
====

<domain.com> account auto-reply:

If you can keep your head when all about you
Are losing theirs and blaming it on you;
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or, being lied about,don't deal in lies,
Or, being hated, don't give way to hating,
And yet don't look too good, nor talk too wise;
... ... more look to the attachment.

> Get your FREE <domain.com> account now! <

Attachment: (One of the following)
the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
How to Crack all gamez.exe
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
dreamweaver MX (crack).exe
StarWars2 - CloneAttack.rm.scr
Industry Giant II.exe
DSL Modem Uncapper.rar.exe
joke.pif
Britney spears nude.exe.txt.exe
I am For u.doc.exe

Retrieves email addresses from the Windows address book and from files with the following extensions:

.txt
.pl
.wab
.adb
.tbb
.dbx
.asp
.php
.sht
.htm

under the following folders:

%Windir%\Local Settings
\documents and settings\<current user>\local settings
\Temporary Internet Files

The worm also uses its own SMTP engine to send itself to the email addresses found.

The email has the following characteristics:

Subject: (One of the following)
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error

Message: (One of the following)
pass
Mail failed. For further assistance, please contact!
The message contains Unicode characters and has been sent as a binary attachment.
It's the long-awaited film version of the Broadway hit. The message sent as a binary attachment.

Attachment: (One of the following)
document
readme
doc
text
file
data
test
message
body

with one of the following extensions:
.bat
.cmd
.exe
.pif
.scr

Attempts to find .exe files. If successful, the worm creates a viral file in %System%\win~.uuu and prepends this file to the .exe file.

No	I▒N▒D▒E▒X	Date
229	Beagle.AB 변종 웜	2004/07/18
228	Atak 웜 경보	2004/07/16
227	Lovgate.AC 웜경보	2004/07/14
226	Gaggle.E 웜 경보	2004/07/12
225	Korgo.X 변종 웜	2004/07/10
224	Lovgate.Z 변종 웜	2004/07/08
223	Beagle.Y 변종 웜	2004/07/06
222	Korgo.W 웜 경보	2004/07/04