Trend Micro Again

[martymas]

hi team these alerts are comming thick and fast this is the third one this week.

it is circulating the south pacific at the moment if you come from down there becareful

marty

To read an HTML version of this newsletter, go to:

http://www.trendmicro.com/en/security/report/overview.htm

Issue Preview:

1. Trend Micro Updates - Pattern File & Scan Engine Updates

2. Bad Bot – WORM_SDBOT.VQ (Low Risk)

3. Top 10 Most Prevalent Global Malware

4. Join Trend Micro's Anti-Spam 1.0 Pilot

NOTE: Long URLs may break into two lines in some mail readers.

Should this occur, please copy and paste the URL into your browser window.

************************************************************************

1. Trend Micro Updates - Pattern File & Scan Engine Updates

------------------------------------------------------------------------

PATTERN FILE: 2.174.00 http://www.trendmicro.com/download/pattern.asp

SCAN ENGINE: 7.100

http://www.trendmicro.com/download/engine.asp

2. Bad Bot – WORM_SDBOT.VQ (Low Risk)

------------------------------------------------------------------------

WORM_SDBOT.VQ is a memory-resident worm that spreads via network shares,

and exploits specific vulnerabilities to propogate across networks. It

also gathers available lists of names and passwords, and uses this gathered

information to locate and list shared folders where it drops a copy of

itself. This worm has backdoor capabilities and attempts to connect to an

Internet Relay Chat (IRC) server to allow a remote user to access the infected

system and perform malicious commands. WORM_SDBOT.VQ runs on Windows

NT, 2000, and XP.

Upon execution, this memory-resident worm drops a copy of itself in the

Windows System directory as EXPLORER32.EXE. It adds registry entries to

enable this dropped copy to run at every Windows startup. It then creates

several threads to be used for sniffing, keylogging, and other backdoor

capabilities. It also attempts to send copies of itself to other systems as

BLING.EXE.

This worm spreads via network shares. It gathers available lists of

names and passwords, and uses this gathered information to locate and list

shared folders where it drops a copy of itself. It then attempts to access

systems with weak passwords to drop a copy of itself. You may view the list

of usernames and passwords in the Technical Details section of this virus

description at http://www.trendmicro.com/vinfo/virusencyc...DBOT.VQ&VSect=T

This worm takes advantage of the following Windows vulnerabilities:

IIS5/WEBDAV Buffer Overflow vulnerability

Remote Procedure Call (RPC) Distributed Component Object Model (DCOM)

vulnerability

Buffer Overflow in SQL Server 2000

Windows LSASS Vulnerability

This worm attempts to connect to the Internet Relay Chat (IRC) server,

irc.t3musso.net, which allows a remote user to access the infected system

and perform the following commands:

Update malware from HTTP and FTP URL

Steal CD keys of game applications

Execute a file

Download from HTTP and FTP URL

Open a command shell

Open files

Display the driver list

Get screen capture

Capture pictures and video clips

Display netinfo

Make a bot join a channel

Stop and start a thread

List all running process

Rename a file

Generate a random nickname

Perform different kinds of ddos attacks

Retrieve and clear log files

Terminate the bot

Disconnect the bot from IRC

Send a message to the IRC server

Let the bot perform mode change

Change BOT ID

Display connection type, local IP address and other net information

Log in and log out the user

Issue ping attack on to a target computer

Display the following system information:

-CPU speed

-Amount of Memory

-Windows platform, build version, and product ID

-Malware uptime

-User name

It also checks for the following strings, and then attempts to steal

Windows product ID and CD keys for several game applications:

:.login

:,login

:!login

:@login

:$login

:%login

login

:&login

:*login

:-login

:+login

:/login

:\login

:=login

:?login

:'login

login

:~login

: login

:.auth

:,auth

:!auth

:@auth

:$auth

:%auth

:&auth

:*auth

:-auth

:+auth

:/auth

:\auth

:=auth

:?auth

:'auth

:~auth

: auth

:.hashin

:!hashin

:$hashin

:%hashin

:.secure

:!secure

:.syn

:!syn

:$syn

:%syn

paypal

PAYPAL

paypal.com

PAYPAL.COM

The remote malicious user can also issue commands to allow the bot to log

user keystrokes.

If you would like to scan your computer for WORM_SDBOT.VQ or thousands

of other

worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's

free,

online virus scanner at: http://housecall.trendmicro.com/

WORM_SDBOT.VQ is detected and cleaned by Trend Micro pattern file

2.175.13 and

above.

For additional information about WORM_SDBOT.VQ please visit: http://www.trendmicro.com/vinfo/virusencyc...e=WORM_SDBOT.VQ

3. Top 10 Most Prevalent Global Malware

(from September 10, 2004 to September 16, 2004)

------------------------------------------------------------------------

1. WORM_SASSER.B

2. PE_ZAFI.B

3. WORM_NETSKY.P

4. HTML_NETSKY.P

5. WORM_KORGO.R

6. HTML_BAGLE.AI

7. PE_FUNLOVE.4099

8. WORM_NETSKY.D

9. JAVA_BYTEVER.A

10. WORM_KORGO.V

4. Join Trend Micro's Anti-Spam 1.0 Pilot Test

------------------------------------------------------------------------

The Trend Microâ„¢ Anti-Spam 1.0 Pilot delivers a free-of-charge tool

for Microsoft Outlook users that provides sophisticated, effective, and

easy-to-use spam filtering capabilities to combat the spam problem prevalent

today.

It offers:

Advanced heuristic-rule based spam-filtering technology

A spam quarantine folder that holds suspicious messages for review

Personal approved and blocked senders lists

Integration with Microsoft Outlook (adds anti-spam functions to Outlook

toolbar and creates spam quarantine folder in Outlook)

On-demand or automatic updates via Trend Micro’s ActiveUpdate service

System Requirements

Pentium III 500MHz or faster processor

128MB of memory

20MB disk space for program installation

Windows 2000 Professional, plus service packs

Windows XP Home or Professional Edition, plus service packs

Microsoft Outlook 2000 or higher

Complete the application form and download Trend Micro's Anti-Spam 1.0

Pilot:

http://www.trendmicro.com/form/anti-spam/download.asp

Note: Trend Micro Anti-Spam does not support MS Outlook 97, 98 or Outlook

Express. The Trend Micro Anti-Spam 1.0 Pilot is for personal,

non-commercial use only and Trend Micro will not provide technical support, however

if you have any comments or suggestions about the software, please email

them to [email protected].

********************************************************************************

***

______________________________________________________________________

This message was sent by Trend Micro's Newsletters Editor using Responsys

Interact .

To unsubscribe from Trend Micro's Newsletters Editor:

http://trendnewsletter.rsc03.net/servlet/o...RFpgLmDgLmDgSE0

To update your subscription preference, or to change your email address:

http://trendnewsletter.rsc03.net/servlet/w...pkNlyLihkm_C_UA

To view our permission marketing policy:

http://www.rsvp0.net

Copyright 1989-2004 Trend Micro, Inc. All rights reserved

Trend Micro, Inc., 10101 N. De Anza Blvd., Suite 200, Cupertino, CA

95014

[tg1911]

Thanks for the heads-up, marty.