from Sophos Alert System: Name: Troj/Webber-H Aliases: TrojanDownloader.Win32.Small.hg, Trojan.Download.Berbew, Downloader-DI trojan Type: Trojan Date: 8 April 2004 A virus identity (IDE) file which provides protection is available now from the Sophos website, and will be incorporated into the May 2004 (3.81) release of Sophos Anti-Virus. Enterprise Manager and PureMessage customers will be automatically protected at their next scheduled update. Sophos has received several reports of this Trojan from the wild. Information about Troj/Webber-H can be found at: http://www.sophos.com/virusinfo/analyses/trojwebberh.html Description Troj/Webber-H is a two component backdoor Trojan. The downloader component of the Trojan appears to have been mass mailed out. When run the Trojan downloads a remote file to C:\windows\usermade.exe and executes it. The downloaded component is a password stealing Trojan that attempts to extract sensitive information from several locations on the system and sends it to a remote computer. The downloaded component copies itself as a file with a random name into the Windows system folder and drops and executes a DLL file, also with a random name, that runs the copy of the Trojan. In order to be started automatically the Trojan creates the following registry entries: HKLM\Software\CLASSES\CLSID\{79FB9088-19CE-715D-D900-216290C5B738} \InProcServer32 HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad \Web Event Logger Troj/Webber-H also sets the following Microsoft Internet Explorer related registry entries to prompt the user into entering passwords: HCU\Software\Microsoft\Internet Explorer\Main\FormSuggest Passwords HCU\Software\Microsoft\Internet Explorer\Main\FormSuggest PW Ask HCU\Software\Microsoft\Internet Explorer\Main\Use FormSuggest Download the IDE file from: http://www.sophos.com/downloads/ide/webber-h.ide Download all the IDE files available for the current version of Sophos Anti-Virus in a single compressed file. The file is available in two formats: Zip file: http://www.sophos.com/downloads/ide/ides.zip Self-extracting file: http://www.sophos.com/downloads/ide/ides.exe Read about how to use IDE files at http://www.sophos.com/downloads/ide/using.html --------------------------------------------------------------------- Mike ~ It is a good day if I learned something new. Editor MikesWhatsNews see a sample on my web page http://www3.telus.net/mikebike <mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe> http://www3.telus.net/mikebike/worm_removal.htm See my Anti-Virus pages http://virusinfo.hackfix.org/index <virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe> A Technical Support Alliance and OWTA Charter Member