W32/Yaha.k
Adatlap
- Megjelenés dátuma: 2002. 12. 21
- Eredete: Ismeretlen
- Hossza: 34304 bájt (UPX-tömörített)
- Típusa: Vírus
- Altípusa: E-mail programféreg
- Szükséges adatbázis: 4239
- Szükséges keresőmotor: 4.1.60
- DAT kibocsátás dátuma: 2002. 12. 23.
Előfordulás valószínűsége
- Vállalati környezet: Közepes
- Otthoni felhasználók: Közepes
Tulajdonságok
A programféreg e-mailben terjed, beépített SMTP-levélküldő rutinja segítségével. Vírusirtó, és egyéb biztonsági szoftverek folyamatainak leállítására képes, valamint DoS támadást indíthat a programféregbe programozva meghatározott távoli cél ellen.
A vírus e-mail mellékletként érkezik a következő formában:
Feladó
A feladó mezőt a vírus hamisíthatja, vagy üresen hagyhatja - az eredeti feladó kilétét ezzel általában elfedve. A vírus a következő e-mail címeket használja feladóként:
- admin@codeproject.com
- free@sql.library.com
- me@me2K.com
- stone@esterplaza.com
- marketing@suppersoccer.com
- free@sexyscreensavers.com
- sales@real.com
- plus@real.com
- sales@playboy.com
- free@hardcorescreensavers.com
- free@xxxscreensavers.com
- kkn@k2k.com
- screensavers@nomadic.com
- nics@nomadic.com
- paul@kqscore.com
- btq@263.com
- services@tcsonline.com
- admin@clubjenna.com
- jenna@jennajameson.com
- zdenka@zpornstars.com
- ravs@go2pussy.com
- love@lovescreensavers.com
- DNA_seraph@163.com
- super@21cn.com
- cathy@21cn.com
- admin@kofonline.com
- zhouyuye@citiz.net
- lubing@7135.com
- hamada@seikosangyo.com
- luoairong@21cn.com
- valentinescreensavers@t2k.com
- screensavers@lovers.com
- admin@zpornstars.com
- newsletters@britneyspears.org
- therock@wwe.com
- ericpan@online.com.pk
- samsun@online.sh.cn
- yjworks@online.sh.cn
- cupid@freescreensavers.com
- av_patch@mcafee.com
- av_patch@norton.com
- av_patch@trendmicro.com
- romanticscreensavers@love.com
- caijob@online.sh.cn
- loverscreensavers@love.com
- Tárgy
(a következő listából választva)- Are you a Soccer Fan ?
- Are you beautiful
- Are you the BEST
- Check it out
- Demo KOF 2002
- Feel the fragrance of Love
- Freak Out
- Free Demo Game
- Free rAVs Screensavers
- Free Screenavers of Love
- Free Screensavers
- Free Screensavers 4 U
- Free Win32 API source
- Free XXX
- Hardcore Screensavers 4 U
- I Love You..
- Jenna 4 U
- Learn SQL 4 Free
- Lovers Corner
- Need money ??
- One Hacker's Love
- One Virus Writer's Story
- Patch for Elkern.gen
- Patch for Klez.H
- Play KOF 2002 4 Free
- Project Sample Screensavers
- Sample KOF 2002
- Sample Playboy
- Screensavers from Club Jenna
- Sexy Screensavers 4 U
- The King of KOF Wanna Brawl ??
- Things to note
- Visit us
- Wanna be a HE-MAN
- Wanna be friends ?
- Wanna be friends ?
- Wanna be like a stone ?
- Wanna be my sweetheart ??
- Wanna Hack ??
- Wanna Rumble ??
- We want peace
- Whats up
- Who is your Valentine
- World Tour
- WWE Screensavers
- XXX Screensavers 4 U
- Melléklet (néhány valószínű előfordulás)
- Beautifull.scr
- Body_Building.scr
- Britney_Sample.scr
- Codeproject.scr
- Cupid.scr
- FixElkern.com
- FixKlez.com
- FreakOut.exe
- Free_Love_Screensavers.scr
- Hacker.scr
- Hacker_The_LoveStory.scr
- Hardcore4Free.scr
- I_Love_You.scr
- Jenna_Jemson.scr
- King_of_Figthers.exe
- KOF.exe
- KOF_Demo.exe
- KOF_Fighting.exe
- KOF_Sample.exe
- KOF_The_Game.exe
- KOF2002.exe
- Love.scr
- My_Sexy_Pic.scr
- MyPic.scr
- MyProfile.scr
- Notes.exe
- Peace.scr
- Playboy.scr
- Plus2.scr
- Plus6.scr
- Project.exe
- Ravs.scr
- Real.scr
- Romantic.scr
- Romeo_Juliet.scr
- Screensavers.scr
- Services.scr
- Sex.scrSoccer.scr
- Sexy_Jenna.scr
- SQL_4_Free.scr
- Stone.scr
- Sweetheart.scr
- The_Best.scr
- THEROCK.scr
- up_life.scr
- Valentines_Day.scr
- VXer_The_LoveStory.scr
- Ways_To_Earn_Money.exe
- World_Tour.scr
- xxx4Free.scr
- zDenka.scr
- zXXX_BROWSER.exe
Üzenettörzs
A vírusban található katraktersorozatok többféle üzenetvariációt tesznek lehetővé (az üzenet tartalma logikailag illeszkedik a melléklet nevéhez):
- hey,
- did u always dreamnt of hacking ur friends hotmail account..
- finally i got a hotmail hack from the internet that really works..
- ur my best friend thats why sending to u..
- check it..just run it..enter victim's address and u will get the pass.
- hi,
- check the attached love screensaver
- and feel the fragrance of true love..
- Hi,
- check the attached screensaver..
- its really wonderfool..
- i got it from freescreensavers.com
- Hi,
- check ur friends circle using the attached friendship screensaver..
- check the attached screensaver
- and if u like it send it to all those you consider
- to be true friends... if it comes back to you then
- you will know that you have a circle of friends..
- Hi,
- check the attached screensaver
- and enjoy the world of friendship..
- Hi,
- are u in a rocking mood...
- check the attached scrennsaver and start shaking..
- Hi,
- Check the attached screensaver..
- Hi,
- Are you lonely ??..
- check the attached screensaver and
- forget the pain of loneliness
- Hi,
- Looking for online pals..
- check the attached friend finder software..
- Hi,
- sending you a screensaver..
- checkit and let me know how it is...
- Hi,
- Check the attached screensaver
- and feel the fragrance of true love...
- Hey,
- I just got this wonderfull screensaver from freescreensaver.com..
- Just check it out and let me know how it is..
- Hi,? I just came across it.. check out..??
- =====================================================================
- Are you one of those unfortunate human beings who are desperately
- looking for friends.. but still not getting true friends with whom
- you can share your everything..
- anyway you wont feel down any more cause GC Chat Network has brought
- up a global chat and online match making system using its own GC
- Messenger. Attached is the fully functional free version of GC
- Instant Messenger and Match Making client..
- Just install, register an account with us and find thousands of online
- pals all over the world..
- You can also search for friends by specific country,city,region etc.
- Regards Admin,
- GC Global Chat Network System..
- Hi,
- So you think you are in love..
- is it true love ? you may think right now that you are in
- true love but it is certainly possible that it is nothing
- but a mere infatuation to you..
- anyway to know yourself better than you have ever known check
- the attached screensaver and feel the fragrance of true love..
- Hey pal,
- you know friendship is like a business...
- to get something you need to give something..
- though its not that harsh as business but to
- get love and care from your friends you need to give
- love,care and respect to your friends.. right{BR>
- check the attached screensaver and you will learn how to
- make your friends happy..
- Hi,
- Its quite obvious that in our life we have numerous friends
- but.. BUT Best Friend can only be ONE.. right {BR>so can you decide who is your best friend {BR>i guess not.. cause mostly you will find that your best friend
- wont care about u like somebody else..
- anyway i found one way to find who is my best friend..
- check it..
- just check the attached screensaver.. answer some questions
- in it and also ask your best friend to answer the questions..
- ..then you will know more about him..
- Hey pal,
- wanna have some fun in life... {BR>feel like life is too boring and monotonous..
- check the attached screensaver and bring colours
- to your black & white life.. :)
- Hi,
- I just came across this funny screensaver..
- sending it to u.. hope u like it..
- check out and die laughing.. :)
- <<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>>
- This E-Mail is never sent unsolicited. If you receive this
- E-Mail then it is because you have subscribed to the official
- newsletter at the KOF ONLINE website.
- King Of Fighters is oneof the greatest action game ever made.
- Now after the mind boggling sucess of KOF 2001 SNK proudly
- presents to you KOF 2002 with 4 new charecters.
- Even though we need no publicity for our product but this
- time we have decided to give away a fully functional trial
- version of KOF 2002. So check out the attached trial version
- of KOF 2002 and register at our official website toget a free
- copy of KOF2002 original version
- Best Regards,
- Admin,KOF ONLINE..
- <<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>>
- Hello,
- I just came across your email ID while searching in the Yahoo profiles.
- Actually I want a true friend 4 life with whom I can share my everything.
- So if you areinterested in being my friend 4 life then mail me.
- If you wanna know about me, attached is my profile along with some of my
- pics. You can check and if you like it then do mail me.
- I will be waiting for your mail.
- Best Wishes,
- Your Friend..
- Hello,
- Looking for some Hardcore mind boggling action ?
- Install the attached browser software and browse
- across millions of paid hardcore sex sites for free.
- Using the software you can safely and easily browse
- across most of the hardcore XXX paid sites across the
- internet for free. Using it you can also clean all
- traces of your web browsing from your computer.
- Note:The attached browser software is made exclusivley
- for demo only. You can use the software for a limited
- time of 35 days after which you have to register it
- at our official website for its furthur use.
- Regards,
- Admin.
- Klez.H is the most common world-wide spreading worm.It's very dangerous by corrupting your files.
- Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.
- We developed this free immunity tool to defeat the malicious virus.
- You only need to run this tool once,and then Klez will never come into your PC
- Hello,
- The attached product is send as a part of our official campaign
- for the popularity of our product.
- You have been chosen to try a free fully functional sample of our
- product.If you are satifiedthen you can send it to your friends.
- All you have to do is to install the software and register an account
- with us using the links provided in the software. Then send this software
- to your friends using your account ID and for each person who registers
- with us through your account, we will pay you $1.5.Once your account reaches
- the limit of $50, your payment will be send to your registration address by
- check or draft.
- Please note that the registration process is completely free which means
- by participating in this program you will only gain without loosing anything.
- Best Regards,
- Admin,
- The virus contains the following strings (similar to previous Yaha variants):
- W32.@YerH$.B,Made in India,
- wE aRe thE greAt iNdIaNs..
- ----------------------------
- aBouT mE :
- jUst a c0mputEr gEEk..
- i tHinK i aM sTill a sCripT kiddiE..
- eDucAtiOn : sCh00l sTudEnt..
- aBouT @YerH$.B:
- n0 dEstrucTivE paYload$ f0r inFecTeD c0mpUteRs.
- teRminAtioN oF aV + FireWaLL f0r sUrvIvaL.
- tImE dEfiNed tRigErRinG.. jUst f0r fUn.. n0 paYloaD.
- c0ntAinS bUg iN rEpliCation c0de.. no tIme t0 fiX.
- g0nNa fiX iT iN nExt rElEase..
- n0 m0rE $hiT
- ===================================================
- >> qph@hackermail.com
Tünetek
A vírus bemásolja magát a Windows System könyvtárba (pl. C:\WINDOWS\SYSTEM) több példányban, a következő fájlneveken:
- NAV32_LOADER.EXE
- TCPSVS32.EXE
- WINSERVICES.EXE
A rendszerindításkor betölti magát, a következő registry kulcsok létrehozásával:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"WinServices"= C:\WINDOWS\SYSTEM\WinServices.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
"WinServices" = C:\WINDOWS\SYSTEM\WinServices.exe
EXE fájlok futtatásakor szintén lefut a vírus, a következő registry kulcs módosításával:
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
Ezt megváltoztatva "%1" %* -ról a következő értékre:
"C:\WINDOWS\SYSTEM\nav32_loader.exe""%1"%*
Windows NT és 2000 rendszereken történő futtatáskor a vírus a következő listában szereplő fájlnevekkel is előfordulhat a Windows System könyvtárban:
- hotmail_hack.exe
- friendship.scr
- world_of_friendship.scr
- shake.scr
- Sweet.scr
- Be_Happy.scr
- Friend_Finder.exe
- I_Like_You.scr
- love.scr
- dance.scr
- GC_Messenger.exe
- True_Love.scr
- Friend_Happy.scr
- Best_Friend.scr life.scr
- colour_of_life.scr
- friendship_funny.scr
- funny.scr
A vírus leállítja a következő neveken futó folyamatokat:
- _AVP32
- _AVPCC
- _AVPM
- ACKWIN32
- ALERTSVC
- AMON.EXE
- ANTIVIR
- ATRACK
- AVCONSOL
- AVP.EXE
- AVP32
- AVPCC.EXE
- AVPM.EXE
- AVSYNMGR
- CFINET
- CFINET32
- ESAFE.EXE
- F-AGNT95
- F-PROT95
- F-STOPW
- FP-WIN
- FRW.EXE
- IAMAPP
- IAMSERV.EXE
- ICMON
- IOMON98
- LOCKDOWN2000
- LOCKDOWNADVANCED
- LUALL
- LUCOMSERVER
- MCAFEE
- N32SCANW
- NAVAPSVC
- NAVAPW32
- NAVLU32
- NAVRUNR
- NAVW32
- NAVWNT
- NISSERV
- NISUM
- NMAIN
- NOD32
- NORTON
- NPSSVC
- NRESQ32
- NSCHED32
- NSCHEDNT
- NSPLUGIN
- NVC95
- PCCIOMON
- PCCMAIN
- PCCWIN98
- PCFWALLICON
- POP3TRAP
- PVIEW
- PVIEW95
- REGEDIT
- RESCUE32
- RMVTRJANSAFEWEB
- SCAN32
- SWEEP95
- SYMPROXYSVC
- TDS2-98
- TDS2-NT
- VET95
- VETTRAY
- VSECOMR
- VSHWIN32
- VSSTAT
- WEBSCANX
- WEBTRAP
- ZONEALARM
A fertőzés menete
A vírus futtatáskor telepíti magát a futtatást végző számítógépre, majd leállít bizonyos vírusirtó és egyéb biztonsági szoftverekre utaló folyamatokat.
A vírus e-mail címeket gyűjt MAILTO hivatkozásokból, *ht* és *HoTMaiL* fájlokból, a Windows Címjegyzékból, MSN Messenger és Yahoo Pager kapcsolatokból. Önmagát az összegyűjtött címekre saját SMTP-motorjával küldi el az alapértelmezett levelezőszerveren keresztül, amelynek címét a következő registry-kulcsból olvassa ki:
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
Eltávolítási utasítások
Az aktuális keresőmotor és adatbázisok használata javasolt.
Fertőzött számítógépen a vírus leállítja a víruskeresési feladatokat, mielőtt a VirusScan megtisztíthatná a aszámítógépet, ezért a vírus eltávolításához az AVERT kiadott egy segédprogramot. A program erről a hivatkozásról letölthető (Stinger.exe).
A vírus eltávolítható parancssori víruskereső használatával is.