[virusinfo] W32/Myfip-H
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Thu, 03 Mar 2005 13:24:16 -0800
From; Sophos Alert System:
Name: W32/Myfip-H
Aliases: Worm.Win32.Myfip.i, WORM_MYFIP.G, W32/Myfip.worm.q
Type: Win32 worm
Date: 3 March 2005
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the April 2005 (3.92) release of Sophos Anti-Virus.
Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Information about W32/Myfip-H can be found at:
http://www.sophos.com/virusinfo/analyses/w32myfiph.html
W32/Myfip-H is a worm that spreads using network shares that are either
unprotected or protected only by weak passwords.
The worm copies itself to the file kernel32dll.exe in the Windows system
folder.
The worm attempts to register itself as a service process with the ServiceName
and DisplayName "Distributed Link Tracking Extensions".
W32/Myfip-H creates the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Distributed File System
kernel32dll.exe
W32/Myfip-H builds a list of all filenames whose extension is one of PDF, DOC,
DWG, SCH, PCB, DWT, DWF and MAX and whose path does not contain any of the
following strings:
Winnt
Windows
I386
Program Files
All Users
Recycler
System Volume Information
Inetpub
Documents and Settings
Wutemp
My Music
The worm then sends the contents of each file to a preconfigured IP address.
This IDE file also includes detection for:
Troj/Bancos-BI
http://www.sophos.com/virusinfo/analyses/trojbancosbi.html
Troj/Bancban-BQ
http://www.sophos.com/virusinfo/analyses/trojbancbanbq.html
Troj/WpaSteal-C
http://www.sophos.com/virusinfo/analyses/trojwpastealc.html
W32/Sdbot-VV
http://www.sophos.com/virusinfo/analyses/w32sdbotvv.html
Troj/Beyond-A
http://www.sophos.com/virusinfo/analyses/trojbeyonda.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/myfip-h.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Myfip-H
