Canh bao Virus W32 Beagle Y

W32.Beagle.Y la sau co kha nang lay nhiem vao he thong thong qua he thong file co phan mo rong la .wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx... Vius nay con co kha nang ngan can su hoat dong cua cac chuong trinh diet viurs cung nhu nhieu phan mem bao mat khac.

Mo ta ky thuat virus W32.Beagle.Y

Khi duoc kich hoat, W32.Beagle.Y lam cac cong viec sau:

1. Neu ngay hien tai lon hon 25/1/2005 thi no se khong hoat dong nua.

2. Tao key "drvsys.exe"="%System%drvsys.exe" trong

HKEY_CURRENT_USER.DEFAULT
SoftwareMicrosoftWindowsCurrentVersionRun de khoi dong cung voi Windows

3. Copy chinh no vao thu muc %system% cua he dieu hanh voi ten la

4. Ket thuc cac tien trinh sau nham ngan can su hoat dong cua cac chuong trinh diet virus cung nhu cac phan mem bao mat khac.

NMAIN.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

NSCHED32.EXE

NTVDM.EXE

NVARCH16.EXE

KERIO-WRP-421-EN-WIN.EXE

KILLPROCESSSETUP161.EXE

LDPRO.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LSETUP.EXE

CLEANPC.EXE

AVprotect9x.exe

CMGRDIAN.EXE

CMON016.EXE

CPF9X206.EXE

CPFNT206.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

ICSSUPPNT.EXE

DEFWATCH.EXE

DEPUTY.EXE

DPF.EXE

DPFSETUP.EXE

DRWATSON.EXE

ENT.EXE

ESCANH95.EXE

AVXQUAR.EXE

ESCANHNT.EXE

ESCANV95.EXE

AVPUPD.EXE

EXANTIVIRUS-CNET.EXE

FAST.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FP-WIN_TRIAL.EXE

FRW.EXE

FSAV.EXE

AUTODOWN.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

GBMENU.EXE

GBPOLL.EXE

GUARD.EXE

GUARDDOG.EXE

HACKTRACERSETUP.EXE

HTLOG.EXE

HWPE.EXE

IAMAPP.EXE

IAMAPP.EXE

IAMSERV.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IFW2000.EXE

IPARMOR.EXE

IRIS.EXE

JAMMER.EXE

ATUPDATER.EXE

AUPDATE.EXE

KAVLIT::16E16::NG.EXE

KAVPERS40ENG.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

BORG2.EXE

BS120.EXE

CDP.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

AUTOUPDATE.EXE

CFINET.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVSTUB.EXE

NAVW32.EXE

NC2000.EXE

NCINST4.EXE

AUTOTRACE.EXE

NDD32.EXE

NEOMONITOR.EXE

NETARMOR.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETSTAT.EXE

NISSERV.EXE

NISUM.EXE

CFIAUDIT.EXE

LUCOMSERVER.EXE

AGENTSVR.EXE

ANTI-TROJAN.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

APVXDWIN.EXE

ATCON.EXE

ATGUARD.EXE

ATR055EN.EXE

ATWATCH.EXE

AVCONSOL.EXE

AVGSERV9.EXE

AVSYNMGR.EXE

BD_PROFESSIONAL.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

BLACKD.EXE

BLACKICE.EXE

BOOTWARN.EXE

NWINST4.EXE

NWTOOL16.EXE

OSTRONET.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PAVPROXY.EXE

DRWEBUPW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PDSETUP.EXE

PERISCOPE.EXE

PERSFW.EXE

PF2.EXE

AVLTMAIN.EXE

PFWADMIN.EXE

PINGSCAN.EXE

PLATIN.EXE

POPROXY.EXE

POPSCAN.EXE

EXE

TDS2-NT.EXE

TDS-3.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

UNDOBOOT.EXE

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VFSETUP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCENU6.02D30.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBSCANX.EXE

CFIAUDIT.EXE

CFINET.EXE

ICSUPP95.EXE

MCUPDATE.EXE

CFINET32.EXE

CLEAN.EXE

CLEANER.EXE

LUINIT.EXE

MCAGENT.EXE

MCUPDATE.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGUI.EXE

MINILOG.EXE

MOOLIVE.EXE

MRFLUX.EXE

MSCONFIG.EXE

MSINFO32.EXE

MSSMMC32.EXE

MU0311AD.EXE

NAV80TRY.EXE

ZAUINST.EXE

ZONALM2601.EXE

ZONEALARM.EXE

5. Neu qua ngay 25/1/2005, virus se xoa cac key:

HKEY_CURRENT_USERSOFTWARETime

HKEY_CURRENT_USER.DEFAULTSoftwareMicrosoft
WindowsCurrentVersionRundrvsys.exe

6. Copy ban than no vao cac thu muc co chu shar
thanh nhung file sau:

Microsoft Office 2003 Crack, Working!.exe

Microsoft Windows XP, WinXP Crack, working Keygen.exe

Microsoft Office XP working Crack, Keygen.exe

Porno, sex, oral, anal cool, awesome!!.exe

Porno Screensaver.scr

Serials.txt.exe

KAV 5.0

Kaspersky Antivirus 5.0

Porno pics arhive, xxx.exe

Windows Sourcecode update.doc.exe

Ahead Nero 7.exe

Windown Longhorn Beta Leak.exe

Opera 8 New!.exe

XXX hardcore images.exe

WinAmp 6 New!.exe

WinAmp 5 Pro Keygen Crack Update.exe

Adobe Photoshop 9 full.exe

Matrix 3 Revolution English Subtitles.exe

7. Quet toan bo o dia va tim cac dia chi email trong cac file co phan mo rong la:

.wab

.txt

.msg

.htm

.shtm

.stm

.xml

.dbx

.mbx

.mdx

.eml

.nch

.mmf

.ods

.cfg

.asp

.php

.pl

.wsh

.adb

.tbb

.sht

.xls

.oft

.uin

.cgi

.mht

.dhtm

.jsp

8. Mo cong 2535 cho va nhan lenh cua harker.

9. Gui email co chua virus toi cac dia chi tim duoc, cac mail nay co dau hieu nhan dang nhu sau:

• Tieu de (Subject): la mot trong cac xau sau:

Hello!

Hey!

Let"s socialize, my friend!

Let"s talk, my friend!

I"m bored with this life

Notify from a known person ;-)

I like you

I just need a friend

I"m a sad girl...

Re: Msg reply

Re: Hello

Re: Yahoo!

Re: Thank you!

Re: Thanks :)

RE: Text message

Re: Document

Incoming message

Re: Incoming Message

Re: Incoming Fax

Hidden message

Fax Message Received

Protected message

RE: Protected message

Forum notify

Request response

Site changes

Re: Hi

Encrypted document

Hello %s,

Dear %s,

Dear %s, It"s me ;-)

Hi %s,

Hey %s, It"s me ->

Hi, It"s me

%s,

Hey %s,

Hey,

Hello,

Hi,

I Like You!

Don"t you remember me?

Kewl :-)

I need a friend...

I just want to talk with someone...

I like reading the books and socializing, let me talk with you...

It"s time to find a friend!

Ready to accept a new friend? :-)

Like me, odore me! ;-)

• Nguoi gui (From): thuong co ten sau:

lizie@

annie@

ann@

christina@

secretGurl@

jessie@

christy@

• Noi dung (body): duoc tao ra bang cach ket hop 3 xau tu 3 nhom sau:

Nhom 1:

I study at school, I like to spend time cheerfully even if not all so well, I hompe and trust, that all bad when nibud will pass and necessarily nastanet there would be a desire.

I like to feel protected, to understand, that near to me the man, which both in sex, and in life knows what to do. It is possible to fall in love with such the man for ever.

Cometime I write a poem, play the gitar. I love a traveling, I like a romantice and I want to meet, comeday, my big love!

I am kind, fair, careful, gentle also want to create family. I love animal (cats, dogs), the literature, theatre, cinema, music, walks in park

I very much love productive leisure, to prepare for new exotic dishes, at leisure to leave with friends on the nature, to float, I like to go for a drive on mountain skiing, to visit excursions, travel. Very easy going.

I have recently got demobilize from army and also I am going to act in a higher educational institution

Searching for the right person,for real man, who will really cares and love me.

I am a honest, kind, loving, with good sense of humor...etc., looking for true love... or maybe for pen friend. I like cats

I am looking for a serious relationship. I am NOT interested in flirt and short-term love adventure.

I love, as the good company, and I dream about romantic appointment at candles with loved. I still believe in love.

I like an active life... and interesting people..

i am honest, responsible, romantic person. iwould like to find my only love,to find my destiny.

I"m a young lady of 20 years old i"d like to find my second part!!!

I am simple girl who are looking for serious relation with responsible and confident man. I am ready to give all my love and carering for a right person who is going to love and respect me

I am a beautiful, sexual girl with very big ambitions and dreams. I can make happy anyone man...

I am a student. I"m studying international relationships. I would like to find an interesting and active man for serious relations. Sitting at home it is not for me. I like to go out to the theater, cinema, and nightclubs.

I love productive leisure, to travel, communicate with friends.

I very much love new acquaintances, I love music, meetings with friends. I go on night clubs, except for parties I sometimes visit theatres and I love cinema. In general I only shall be glad to new acquaintance and class dialogue...

I"m so bored, let me talk with you...

You are my prince :-)

You are cool :-)

Nhom 2

Read the attach.

Your file is attached.

More info is in attach

See attach.

Please, have a look at the attached file.

See the attached file for details.

Message is in attach

Here is the file.

For more information see the attached file.

Attached file will tell you everything.

For details see the attach.

Attached file tells everything.

Further details are in attach.

Nhom 3

Sincerely,

Best wishes,

Yours,

Have a good day,

Cheers,

Kind regards,

Voi la ten tim thay trong cac file tren dia cung

Neu file dinh kem la file zip, mot trong cac chuoi sau duoc them vao:

For security reasons attached file is password protected. The password is [anh hien password cua file zip]

For security purposes the attached file is password protected. Password -- [anh hien password cua file zip]

Attached file is protected with the password for security reasons. Password is[anh hien password cua file zip]

In order to read the attach you have to use the following password: [anh hien password cua file zip]

Archive password: [anh hien password cua file zip]

Password - [anh hien password cua file zip]

Password: [anh hien password cua file zip]

• File dinh kem (attachment): file co ten la mot trong cac chuoi sau:

Information

Details

Readme

Document

Info

Details

MoreInfo

Message

Voi phan mo rong la:

.exe

.com

.scr

.cpl

.hta

.vbs

Doi khi file dinh kem la file zip co mat khau bao ve.

10. Thuc thi vong lap vo han, gui thong tin den cac website php sau, moi lan cach nhau 60s:

http:/ /www.spiegel.de

http:/ /www.leipziger-messe.de

http:/ /www.mobile.de

http:/ /www.neformal.de

http:/ /www.avh.de

http:/ /www.goethe.de

http:/ /www.degruyter.de

http:/ /www.heise.de

http:/ /www.autoscout24.de

http:/ /www.russische-botschaft.de

http:/ /www.bmbf.de

http:/ /www.berlinale.de

http:/ /www.hamann-motorsport.de

http:/ /Spaceclub.de

http:/ /www.fracht-24.de

http:/ /www.loveparade.de

http:/ /www.dalnoboyshik.de

http:/ /www.deutschland.de

http:/ /www.ac-schnitzer.de

http:/ /abakan.strana.de

http:/ /www.emis.de

http:/ /www.dwd.de

http:/ /www.ifdesign.de

http:/ /www.beckers-systems.de

http:/ /www.pri-wo-hamburg.de

http:/ /virtualzone.de

http:/ /www.mitsumi.de

http:/ /www.fu-berlin.de

http:/ /www.nabu.de

http:/ /www.tekeli.de

http:/ /www.welt.de

http:/ /www.gospel-nations.de

http:/ /www.neznakomez.de

http:/ /www.tecchannel.de

http:/ /www.php-resource.de

http:/ /www.windac.de

http:/ /www.gsi.de

http:/ /www.turism.de

http:/ /jakimov.golos.de

http:/ /www.www.mirko-becker.gmxhome.de

http:/ /vg.xtonne.de

http:/ /www.go-amman.de

http:/ /3treepoint.com

http:/ /www.restarted-alliance.de

http:/ /2udar.ligakvn.de

http:/ /www.sprach-zertifikat.de

http:/ /www.dfg.de

http:/ /www.kliniken.de

http:/ /www.winfuture.de

http:/ /www.hamburg.de

http:/ /www.auma.de

http:/ /www.teac.de

http:/ /www.eumetsat.de

http:/ /www.documenta.de

http:/ /hardvision.ru

http:/ /www.bruecke-osteuropa.de

http:/ /www.mk-motorsport.de

http:/ /www.bundesregierung.de

http:/ /ditec.um.es

http:/ /www.insel-ruegen-hotel.de

http:/ /www.tib.uni-hannover.de

http:/ /www.chugai.de

http:/ /www.blauer-engel.de

http:/ /www.partner-inform.de

http:/ /250x.com

http:/ /villakinderbunt.de

http:/ /s318.evanzo-server.de

http:/ /andimeisslein.de

http:/ /tobimayer.de

http:/ /markusgimenez.de

http:/ /www.fiz-karlsruhe.de

http:/ /www.gdch.de

http:/ /www.intermatgmbh.de

http:/ /www.hotel-pension-spree.de

http:/ /vg.xtonne.de

http:/ /www.low-spirit.de

http:/ /www.red-dot.de

http:/ /www.fernuni-hagen.de

http:/ /www.ruletka.de

http:/ /www.deutsch-als-fremdsprache.de

http:/ /www.uni-oldenburg.de

http:/ /fotos.schneider.bards.de

http:/ /www.deutsches-museum.de

http:/ /www.de-bug.de

http:/ /www.uni-stuttgart.de

http:/ /www.embl-heidelberg.de

http:/ /www.mdz-moskau.de

http:/ /www.mitsubishi-evs.de

http:/ /www.siegenia-aubi.com

http:/ /www.cicv.fr

http:/ /www.paromi.de

http:/ /www.jura.uni-sb.de

http:/ /www.exactaudiocopy.de

Theo BKAV