[virusinfo] W32/Randon-AN
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Tue, 14 Jun 2005 08:31:02 -0700
From; Sophos Alert System:
Name: W32/Randon-AN
Aliases: Trojan.Dropper, IRC.Trojan, IRC/Flood.gen.b,
Net-Worm.Win32.Randon.o
Type: Win32 worm
Date: 14 June 2005
Sophos has issued protection for W32/Randon-AN.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Customers using EM Library, Enterprise Console, PureMessage or
any of our Sophos small business solutions will be automatically
protected at their next scheduled update.
Note: The IDE issued for W32/Randon-AN at 21:25 GMT on 10 June
also contained detection for Troj/Bancos-CY, W32/Rbot-AFC,
Troj/LegMir-AG, Troj/ScomDrop-A, W32/Rbot-AFH, W32/Rbot-AFE,
Troj/Istbar-BD, Troj/SmutSrch-A, W32/Mytob-AS and W32/Agobot-SX.
This IDE has now been updated to enhance detection of
W32/Mytob-AS and W32/Randon-AN.
Information about W32/Randon-AN can be found at:
http://www.sophos.com/virusinfo/analyses/w32randonan.html
W32/Randon-AN is a network worm with IRC backdoor functionality.
W32/Randon-AN can spread through IRC channels and network shares.
The worm is distributed as a self-extracting archive which installs the worm's
components. The following files are created:
app.exe - a clean utility to manage processes
netservup.exe - a hacked mIRC application, detected as W32/Randon-AN
nsrust.exe - a legitimate tool to hide windows
nsup1.sys - an empty file
nsup2.sys - a harmless configuration file
nsup3.sys - a configuration file, detected as W32/Randon-AN
nsuser.bat - a BAT file to add a user to the local computer
tool.sys - a configuration file, detected as W32/Randon-AN
The worm creates the following registry entry in order to run itself
automatically on computer logon:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ansjava
<path to mIRC application>
The W32/Randon-AN virus identity file (IDE) includes detection for:
Troj/Bancos-CY
http://www.sophos.com/virusinfo/analyses/trojbancoscy.html
W32/Rbot-AFC
http://www.sophos.com/virusinfo/analyses/w32rbotafc.html
Troj/LegMir-AG
http://www.sophos.com/virusinfo/analyses/trojlegmirag.html
Troj/ScomDrop-A
http://www.sophos.com/virusinfo/analyses/trojscomdropa.html
W32/Rbot-AFH
http://www.sophos.com/virusinfo/analyses/w32rbotafh.html
W32/Rbot-AFE
http://www.sophos.com/virusinfo/analyses/w32rbotafe.html
Troj/Istbar-BD
http://www.sophos.com/virusinfo/analyses/trojistbarbd.html
Troj/SmutSrch-A
http://www.sophos.com/virusinfo/analyses/trojsmutsrcha.html
W32/Mytob-AS
http://www.sophos.com/virusinfo/analyses/w32mytobas.html
W32/Agobot-SX
http://www.sophos.com/virusinfo/analyses/w32agobotsx.html
Customers with 3.xx or lower versions of Sophos Anti-Virus,
who are not running EM Library, can manually download the IDE
for W32/Randon-AN from:
http://www.sophos.com/downloads/ide/rando-an.ide
Read about how to use IDE files at
http://www.sophos.com/support/knowledgebase/article/363.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
