Ik had beloofd jullie wat te laten weten als ik mail zou krijgen, heb nog een mail van hen gekregen, hierbij de attachment:
.topic IWorm_Fizzer
I-Worm.Fizzer
-------------
This is an Internet worm that spreads via e-mail messages and KaZaa shared
directories. It also contains "backdoor" remote access features.
Installation
------------
When the worm is launched, it creates the following files in the Windows
directory:
iservc.exe (copy of the worm)
initbak.dat (copy of the worm)
ProgOp.exe (worm's component)
iservc.dll (keylogger library used by the worm)
iservc.klg (contains logged keystroke data)
The worm also writes a registry key to start automatically when Windows
starts:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
SystemInit=(Windows directory path)\iservc.exe
Under Windows NT/2000/XP the worm is able to create a system service, but
this ability is disabled by its author.
It also registers as a default handler for files with ".TXT" extension, so
it gets executed when such a file is opened.
Replication: KaZaa
------------------
The worm copies itself to the KaZaa download directory with random
filenames.
Replication: E-mail
-------------------
The worm uses its own SMTP engine to send its copies. The destination
e-mail addresses are randomly generated or extracted from the Outlook and
Windows address books.
Infected messages have various selected subjects, bodies, and attachment
names. They are generated from several large string lists. For example:
Subject: Re:
Attachment: desktop.exe
Body: you must not show this to anyone...
Subject: Re: I think you might find this amusing...
Attachment: Logan6.exe
Body: Let me know what you think of this...
Subject: Fwd: why?
Attachment: Taylor83.com
Body: Today is a good day to die...
Backdoor routine: IRC
---------------------
The worm contains a list of IRC channels it tries to connect to and to
receive remote access commands from an attacker.
Backdoor routine: Other
-----------------------
The worm starts HTTP and telnet-like servers and binds them to
pre-configured ports to provide remote access to the computer.
Other
-----
The worm captures all keystrokes and writes them to the file named
"iservc.klg" in the Windows directory.
It also tries to download and install its updated version from a geocities
user page.
The worm tries to terminate processes that contain the following strings
in their name:
ANTIV
AVP
F-PROT
NAV
NMAIN
SCAN
TASKM
VIRUS
VSHW
VSS
Most options, like registry key names, IRC and SMTP server names, port
numbers and action sequences are pre-configured in a special data file
that is encrypted and stored in the worm EXE file's resources.
imho erg netjes van ze dat ze zo'n gedetailleerde beschrijving geven, misschien is ie ook voor op viruslist maar daar staat (op dit moment) iig nog niks.
/u/64509/crop6811dfe7e51f8_cropped.png?f=community)
,
:strip_icc():strip_exif()/u/14/wildhagen60x60.jpg?f=community)
:strip_icc():strip_exif()/u/37834/leann.jpg?f=community)
:strip_exif()/u/2172/crop57acf4ac04e70.gif?f=community)
.
:strip_icc():strip_exif()/u/27315/GOT.jpg?f=community)
:strip_icc():strip_exif()/u/47471/crop5aa6cb9f97040_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/21865/shoe_60x60.jpg?f=community)
/u/11473/notAvailable.PNG?f=community)
:strip_exif()/u/53522/crop583d477015a24.gif?f=community)
:strip_exif()/u/47141/gotzeekoe.gif?f=community)
:strip_icc():strip_exif()/u/27034/worm.jpg?f=community)
:strip_icc():strip_exif()/u/29952/brammes-avatar.jpg?f=community){kind=avatar}
:strip_exif()/u/1684/koetje3.gif?f=community)