|
|
|
VIRUS
NAME : W32/Spear.c.worm
Virus
Characteristics
This is a simple
peer-to-peer network worm. It's designed to target the Gnutella, eDonkey and
KaZaa file-sharing networks, using the following servent programs:
- Bearshare
- Morpheus
- eDonkey2000
- KaZaa
When run, the worm checks its
filename. If the name matches one of the internally recognized names, the worm
proceeds in copying itself to the default shared directories of the aforementioned
applications using the following filenames (note: expletives have been altered
with the "-" character):
- AdvZip Recovery.exe
- AIM Pass stealer.exe
- aimcracker.exe
- aimhacker.exe
- AMI BIOS Cracker.exe
- anastasia_anal.exe
- anastasia_naked.exe
- anastasia_nude.exe
- Autocad 2002 Crack.exe
- buttman.exe
- catherine_zeta_jones_anal.exe
- catherine_zeta_jones_naked.exe
- catherine_zeta_jones_nude.exe
- Counter Strike_CD_Keygen.exe
- Delphi 5 Keygen.exe
- Delphi 6 Keygen.exe
- Digimon.exe
- divx_fix.exe
- divx_repair.exe
- edonkey_serverlist.exe
- ftp_cracker.exe
- ftp_hacker.exe
- Half_life Cd keygen.exe
- host_faker.exe
- host_spoofer.exe
- Hotmail Hacker.exe
- hotmail_account_sniffer.exe
- hotmailcracker.exe
- hotmailhacker.exe
- ICQ_Hackingtools.exe
- icqcracker.exe
- icqhacker.exe
- ident_faker.exe
- ident_spoofer.exe
- IIS_shellbind_exploit.exe
- invisible_IP.exe
- ip_faker.exe
- ip_spoofer.exe
- kazaa.exe
- kmd151_en.exe
- linux_root.exe
- Linux_rootaccess.exe
- msn_IP_finder.exe
- msncracker.exe
- msnhacker.exe
- Office key Gen.exe
- Office XP Crack.exe
- OfficeXP_Keygen.exe
- pamela_anderson_anal.exe
- pamela_anderson_naked.exe
- pamela_anderson_nude.exe
- Pokemon.exe
- porn_account_cracker.exe
- porn_account_hacker.exe
- PS1 BootCD.exe
- PS2 BootCD.exe
- PS2_emulator_bleem.exe
- sandra_bullock_naked.exe
- sandra_bullock_nude.exe
- sarah_michelle_gellar_naked.exe
- sarah_michelle_gellar_nude.exe
- shakira_anal.exe
- shakira_a-sf--ked.exe
- shakira_naked.exe
- shakira_nude.exe
- shakira_paparazzi_collection.exe
- Sub7_masterpwd.exe
- tripod_cracker.exe
- tripod_hacker.exe
- win2k_pass_decryptor.exe
- Win2k_reboot_exploit.exe
- win2k_serial.exe
- Windows_Keygen_allver.exe
- winxp_crack.exe
- winxp_cracker.exe
- winxp_hacker.exe
- WinXP_Keygen.exe
- winxphack.exe
- Winzip_Pass_Cracker.exe
- Word_Pass_Cracker.exe
- xbox_emulator_beta.exe
- XP DVD Plugin.exe
- XP ScreenSaver.exe
- XP_Box_emulator.exe
- XP_keygen.exe
- yahoo_cracker.exe
- yahoo_hacker.exe
- Yahoo_mail_cracker.exe
The worm does not configure
itself to load at system startup or carry any damaging payloads.
Symptoms
Presence of the aforementioned filenames in the following directories:
- \program files\bearshare\shared\
- \program files\morpheus\my shared folder\
- \program files\eDonkey2000\incoming\
- \program files\kazaa\my shared folder\
Method
Of Infection
This worms spreads by enticing peer-to-peer file sharing users to download and
run itself. Once run, the worm copies itself to expected shared folders for
others to download.
|
|
|
