oms
05-05-2005, 08:51 PM
Name:
Win32.Sober.O@mmAliases:
Email-Worm.Win32.Sober.P (KAV), W32/Sober.O@mm (FProt)Type:
Executable Mass Mailer Size:
53554Discovered
:
02.05.2005Detected:
02.05.2005Spreading:
MediumDamage:
Very lowIn The Wild:
Yes
Symptoms:
Presence of the following files in the folder %WINDIR%\Connection Wizard\Status:
services.exe, csrss.exe, smss.exe, packed1.sbr, packed2.sbr, packed3.sbr, sacri1.ggg, sacri2.ggg, sacri3.ggg, voner1.von, voner2.von, voner3.von, fastso.ber.
And following registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run : ["Winstart" = "%WINDIR%\Connection Wizard\Status\services.exe"]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run : ["Winstart" = "%WINDIR%\Connection Wizard\Status\services.exe"]
Technical description:
The virus is written in Visual Basic, and comes packed with a modified varianta of the UPX packer. At runtime, the virus displays a fake error message "Error: CRC not complete". The virus appears to be written by a native german speaker, and sends mails in both German and English languages.
Mail format:
FROM:
SUBJECT:
- Your Password
- Registration Confirmation
- Your email was blocked
- mailing error
- Ihr Passwort
- Mail-Fehler!
- Ihre E-Mail wurde verweigert
- Ich bin's, was zum lachen
- Glueckwunsch: Ihr WM Ticket
- WM Ticket Verlosung
- WM-Ticket-Auslosung
The subject may be preceeded by "Re:" or "FwD".
BODY:
Account and Password Information are attached!
Visit: http://www (http://www/).
This is an automatically generated E-Mail Delivery Status Notification.
Mail-Header, Mail-Body and Error Description are attached
Attachment-Scanner: Status OK,AntiVirus: No Virus found,Server-AntiVirus: No Virus (Clean)
Passwort und Benutzer-Informationen befinden sich in der beigefuegten Anlage.
*-* http://www (http://www/).
*-* MailTo: PasswordHelp
Diese E-Mail wurde automatisch erzeugt
Mehr Information finden Sie unter http://www (http://www/).
Folgende Fehler sind aufgetreten:
Fehler konnte nicht Explicit ermittelt werden
End Transmission
Aus Datenschutzrechtlichen Gruenden, muss die vollstaendige E-Mail incl. Daten gezippt & angehaengt werden.
Wir bitten Sie, dieses zu beruecksichtigen.
Auto ReMailer# [
Nun sieh dir das mal an!
Was ein Ferkel ....
Herzlichen Glueckwunsch,
--- FIFA-Pressekontakt:
ok ok ok,,,,, here is it
beim Run auf die begehrten Tickets fur
die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
Ihr
ok2006 Team
St. Rainer Gellhaus
--- Pressesprecher Jens Grittner und Gerd Graus
--- FIFA Fussball-Weltmeisterschaft 2006
--- Organisationskomitee Deutschland
--- Tel. 069 / 2006 - 2600
--- Jens.Grittner@ok2006.de
--- Gerd.Graus@ok2006.de
Mail-Scanner: Es wurde kein Virus festgestellt,AntiVirus: Kein Virus gefunden,AntiVirus-System: Kein Virus erkannt
AntiVirus Service
**** WebSite: http://www (http://www/).
The website name will be chosen from the followin name pool:
- microsoft.com, bigfoot.com, yahoo.com, t-online.de, google.com, hotmail.com
ATTACH:
_PassWort-Info.zip
autoemail-text.zip
LOL.zip
mail_info.zip
okTicket-info.zip
Fifa_Info-Text.zip
our_secret.zip
free_PassWort-Info.zip
Winzipped-Text_Data.txt.exe
Winzipped-Text_Data.txt.pif
The virus will search for mail addresses to send itself in files with the following extensions:
pmr phtm stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp ppt msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade sln dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf doc ods nch xls txt wab eml hlp mht nfo php asp shtml dbx
It will not send to mail addresses containing one of the following strings:
ntp- ntp@ ntp. info@ test@ @www @from. support smtp- @smtp. gold-certs ftp. .dial. .ppp. anyone subscribe announce @gmetref sql. someone nothing you@ user@ reciver@ somebody secure whatever@ whoever@ anywhere yourname mustermann@ .kundenserver. mailer-daemon variabel noreply -dav law2 .sul.t- .qmail@ t-ipconnect t-dialin ipt.aol time freeav @ca. abuse winrar domain. host. viren bitdefender spybot detection ewido. emsisoft linux google @foo. winzip @example. bellcore. @arin mozilla iana@ iana- @iana @avp icrosoft @sophos @panda @kaspers free-av antivir virus verizon. @ikarus. @nai. @messagelab nlpmail01. clock sender youremail home.com hostmaster postmaster
Removal instructions:
Let BitDefender delete the files it finds infected.
Removal tool:
Download Removal Tool (http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=333#) Virus analyzed by:
Daniel Ionita,
Win32.Sober.O@mmAliases:
Email-Worm.Win32.Sober.P (KAV), W32/Sober.O@mm (FProt)Type:
Executable Mass Mailer Size:
53554Discovered
:
02.05.2005Detected:
02.05.2005Spreading:
MediumDamage:
Very lowIn The Wild:
Yes
Symptoms:
Presence of the following files in the folder %WINDIR%\Connection Wizard\Status:
services.exe, csrss.exe, smss.exe, packed1.sbr, packed2.sbr, packed3.sbr, sacri1.ggg, sacri2.ggg, sacri3.ggg, voner1.von, voner2.von, voner3.von, fastso.ber.
And following registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run : ["Winstart" = "%WINDIR%\Connection Wizard\Status\services.exe"]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run : ["Winstart" = "%WINDIR%\Connection Wizard\Status\services.exe"]
Technical description:
The virus is written in Visual Basic, and comes packed with a modified varianta of the UPX packer. At runtime, the virus displays a fake error message "Error: CRC not complete". The virus appears to be written by a native german speaker, and sends mails in both German and English languages.
Mail format:
FROM:
SUBJECT:
- Your Password
- Registration Confirmation
- Your email was blocked
- mailing error
- Ihr Passwort
- Mail-Fehler!
- Ihre E-Mail wurde verweigert
- Ich bin's, was zum lachen
- Glueckwunsch: Ihr WM Ticket
- WM Ticket Verlosung
- WM-Ticket-Auslosung
The subject may be preceeded by "Re:" or "FwD".
BODY:
Account and Password Information are attached!
Visit: http://www (http://www/).
This is an automatically generated E-Mail Delivery Status Notification.
Mail-Header, Mail-Body and Error Description are attached
Attachment-Scanner: Status OK,AntiVirus: No Virus found,Server-AntiVirus: No Virus (Clean)
Passwort und Benutzer-Informationen befinden sich in der beigefuegten Anlage.
*-* http://www (http://www/).
*-* MailTo: PasswordHelp
Diese E-Mail wurde automatisch erzeugt
Mehr Information finden Sie unter http://www (http://www/).
Folgende Fehler sind aufgetreten:
Fehler konnte nicht Explicit ermittelt werden
End Transmission
Aus Datenschutzrechtlichen Gruenden, muss die vollstaendige E-Mail incl. Daten gezippt & angehaengt werden.
Wir bitten Sie, dieses zu beruecksichtigen.
Auto ReMailer# [
Nun sieh dir das mal an!
Was ein Ferkel ....
Herzlichen Glueckwunsch,
--- FIFA-Pressekontakt:
ok ok ok,,,,, here is it
beim Run auf die begehrten Tickets fur
die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
Ihr
ok2006 Team
St. Rainer Gellhaus
--- Pressesprecher Jens Grittner und Gerd Graus
--- FIFA Fussball-Weltmeisterschaft 2006
--- Organisationskomitee Deutschland
--- Tel. 069 / 2006 - 2600
--- Jens.Grittner@ok2006.de
--- Gerd.Graus@ok2006.de
Mail-Scanner: Es wurde kein Virus festgestellt,AntiVirus: Kein Virus gefunden,AntiVirus-System: Kein Virus erkannt
AntiVirus Service
**** WebSite: http://www (http://www/).
The website name will be chosen from the followin name pool:
- microsoft.com, bigfoot.com, yahoo.com, t-online.de, google.com, hotmail.com
ATTACH:
_PassWort-Info.zip
autoemail-text.zip
LOL.zip
mail_info.zip
okTicket-info.zip
Fifa_Info-Text.zip
our_secret.zip
free_PassWort-Info.zip
Winzipped-Text_Data.txt.exe
Winzipped-Text_Data.txt.pif
The virus will search for mail addresses to send itself in files with the following extensions:
pmr phtm stm slk inbox imb csv bak imh xhtml imm imh cms nws vcf ctl dhtm cgi pp ppt msg jsp oft vbs uin ldb abc pst cfg mdw mbx mdx mda adp nab fdb vap dsp ade sln dsw mde frm bas adr cls ini ldif log mdb xml wsh tbb abx abd adb pl rtf mmf doc ods nch xls txt wab eml hlp mht nfo php asp shtml dbx
It will not send to mail addresses containing one of the following strings:
ntp- ntp@ ntp. info@ test@ @www @from. support smtp- @smtp. gold-certs ftp. .dial. .ppp. anyone subscribe announce @gmetref sql. someone nothing you@ user@ reciver@ somebody secure whatever@ whoever@ anywhere yourname mustermann@ .kundenserver. mailer-daemon variabel noreply -dav law2 .sul.t- .qmail@ t-ipconnect t-dialin ipt.aol time freeav @ca. abuse winrar domain. host. viren bitdefender spybot detection ewido. emsisoft linux google @foo. winzip @example. bellcore. @arin mozilla iana@ iana- @iana @avp icrosoft @sophos @panda @kaspers free-av antivir virus verizon. @ikarus. @nai. @messagelab nlpmail01. clock sender youremail home.com hostmaster postmaster
Removal instructions:
Let BitDefender delete the files it finds infected.
Removal tool:
Download Removal Tool (http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=333#) Virus analyzed by:
Daniel Ionita,