From; Sophos Alert System: Name: W32/Randon-AN Aliases: Trojan.Dropper, IRC.Trojan, IRC/Flood.gen.b, Net-Worm.Win32.Randon.o Type: Win32 worm Date: 10 June 2005 Sophos has issued protection for W32/Randon-AN. At the time of writing, Sophos has received a small number of reports of this worm from the wild. Customers using EM Library, Enterprise Console, PureMessage or any of our Sophos small business solutions will be automatically protected at their next scheduled update. Information about W32/Randon-AN can be found at: http://www.sophos.com/virusinfo/analyses/w32randonan.html W32/Randon-AN is a network worm with IRC backdoor functionality. W32/Randon-AN can spread through IRC channels and network shares. The worm is distributed as a self-extracting archive which installs the worm's components. The following files are created: app.exe - a clean utility to manage processes netservup.exe - a hacked mIRC application, detected as W32/Randon-AN nsrust.exe - a legitimate tool to hide windows nsup1.sys - an empty file nsup2.sys - a harmless configuration file nsup3.sys - a configuration file, detected as W32/Randon-AN nsuser.bat - a BAT file to add a user to the local computer tool.sys - a configuration file, detected as W32/Randon-AN The worm creates the following registry entry in order to run itself automatically on computer logon: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ansjava <path to mIRC application> The W32/Randon-AN virus identity file (IDE) includes detection for: Troj/Bancos-CY http://www.sophos.com/virusinfo/analyses/trojbancoscy.html W32/Rbot-AFC http://www.sophos.com/virusinfo/analyses/w32rbotafc.html Troj/LegMir-AG http://www.sophos.com/virusinfo/analyses/trojlegmirag.html Troj/ScomDrop-A http://www.sophos.com/virusinfo/analyses/trojscomdropa.html W32/Rbot-AFH http://www.sophos.com/virusinfo/analyses/w32rbotafh.html W32/Rbot-AFE http://www.sophos.com/virusinfo/analyses/w32rbotafe.html Troj/Istbar-BD http://www.sophos.com/virusinfo/analyses/trojistbarbd.html Troj/SmutSrch-A http://www.sophos.com/virusinfo/analyses/trojsmutsrcha.html W32/Mytob-AS http://www.sophos.com/virusinfo/analyses/w32mytobas.html W32/Agobot-SX http://www.sophos.com/virusinfo/analyses/w32agobotsx.html Customers with 3.xx or lower versions of Sophos Anti-Virus, who are not running EM Library, can manually download the IDE for W32/Randon-AN from: http://www.sophos.com/downloads/ide/rando-an.ide Read about how to use IDE files at http://www.sophos.com/support/knowledgebase/article/363.html *********** MIKE"S REPLY SEPARATOR *********** Mike ~ It is a good day if I learned something new. Editor MikesWhatsNews see a sample on my web page http://www3.telus.net/mikebike <mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe> http://www3.telus.net/mikebike/worm_removal.htm See my Anti-Virus pages http://virusinfo.hackfix.org/index <virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe> A Technical Support Alliance and OWTA Charter Member