[virusinfo] W32/Tibick-C
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Tue, 08 Mar 2005 09:55:53 -0800
From; Sophos Alert System:
Name: W32/Tibick-C
Aliases: WORM_TIBICK.A, W32/Tibick!p2p, P2P-Worm.Win32.Tibick.d
Type: Win32 worm
Date: 8 March 2005
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the April 2005 (3.92) release of Sophos Anti-Virus.
Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Information about W32/Tibick-C can be found at:
http://www.sophos.com/virusinfo/analyses/w32tibickc.html
W32/Tibick-C is a peer to peer worm.
W32/Tibick-C copies itself to the Windows system folder as SVCNET.EXE and
creates the following registry entries so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Shellapi32
svcnet.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Shellapi32
svcnet.exe
W32/Tibick-C may attempt to copy itself to the subfolder MSVIEW of the Windows
folder with some of the following filenames, appending different numbers of
zero bytes to the end of each to give them different filesizes:
321 Studios GamesXCopy 1.0.8 crack.exe
3D Studio Max 6 crack.exe
ABBYY FineReader Pro 7.0 crack.exe
acdsee 7.0.61 crack.exe
Adobe Photoshop all.exe
Adobe Photoshop CS 8 crack.exe
Adobe Photoshop CS crack.exe
Adobe Serial Generator v2.0.exe
Adult Tetris 2 crack.exe
Age of Empires II The Age of Kings NO CD crack.exe
Backyard Baseball 2003 no cd crack.exe
Backyard Wrestling 2 - There Goes the Neighborhood Eidos Int
Battlefield 1942 no cd crack.exe
Battlefield Vietnam EA Games crack.exe
Battlefield Vietnam Multiplayer Online Crack.exe
Besieger DreamCatcher Interactive crack.exe
BitComet.exe
CloneDVD2 v2.5.3.3 crack.exe
Command & Conquer - Generals no cd crack.exe
Command & Conquer - Generals Zero Hour EA Games crack.exe
Command & Conquer - Generals Zero Hour no cd crack.exe
CopyToDVD 3.0.3 crack.exe
Corel Draw Graphics Suite 12.0 crack.exe
Counter-Strike Condition Zero Keygen.exe
Crusader Kings Paradox Entertainment crack.exe
Cubase Audio XT 3.X crack.exe
CyberLink PowerDVD v6.0 Deluxe7 crack.exe
Dark Age Of Camelot - Trials Of Atlantis no cd crack.exe
Dark Matter - The Baryon Proj crack.exe
dBpowerAmp Music Converter.exe
Deus Ex Invisible War NO CD Crack.exe
DFX Audio Enhancement 2.0.1 crack.exe
Diablo 2 NO CD crack.exe
Easy CD-DA Extractor 7.1.3.1 crack.exe
Easy CD-DA Extractor 7.13.2 keygen.exe
eMule.exe
Enter the Matrix Atari crack.exe
eractive crack.exe
ESPN NFL 2K5 Sega crack.exe
ethesda Softworks crack.exe
F.E.A.R. VU Games crack.exe
Fable Microsoft crack.exe
Far Cry Ubisoft crack.exe
Fifa 2005 crack.exe
Final Fantasy VII - Advent Children PSP Square Enix crack.exe
Final Fantasy XI - Square Enix USA no cd crack.exe
Final Fantasy XII Square Enix crack.exe
Fire Emblem - Seima no Kouseki GBA Nintendo crack.exe
FlashFXP 2 RC2 Crack.exe
FlashFXP All Version KeyGen.exe
FlashFXP v1.4.1 Crack.exe
FlashFXP v1.4.3 Crack.exe
FlashFXP v2.0 Crack.exe
FlashFXP v2.1 crack.exe
FlashFXP v2.2 crack.exe
FlashGet.exe
Forgotten Realms - Demon Stone Atari crack.exe
Forgotten Realms - Demon Stone crack.exe
Free Internet TV 3.2 crack.exe
Freedom Force no cd crack.exe
Front Mission 4 Square Enix crack.exe
FrontPage XP 2002 Crack.exe
FTP Server Serv-U 5.1 Coporate Edition crack.exe
Full Spectrum Warrior THQ crack.exe
Geist GC Nintendo crack.exe
GetRight 5.2 crack.exe
Goblin Commander - Unleash the Horde Jaleco Entertainment crack.exe
Gran Turismo 4 SCEA crack.exe
Grand Theft Auto - San Andreas Rockstar Games crack.exe
Grand Theft Auto 3 no cd crack.exe
Grand Theft Auto III no cd crack.exe
Grand Theft Auto San Andreas NO CD crack.exe
Grand Theft Auto Vice City NO CD crack.exe
Grand Theft Auto: San Andreas crack.exe
Grokster.exe
GTA crack.exe
Gunbound Trainer.exe
GX Transcoder 2.10.2350 keygen.exe
Half-Life 2 crack.exe
Half-Life 2 Keygen.exe
Half-Life 2 NO CD Crack.exe
Half-Life 2 VU Games crack.exe
Halo - Combat Evolved - Microsoft no cd crack.exe
Halo 2 crack.exe
Harry Potter and the Prisoner of Azkaban Adventure EA Games crack.exe
Harry Potter and the Sorcerers Stone no cd crack.exe
Harry Potter and The Sorcerers Stone no cd crack.exe
Heroes of Might and Magic IV no cd crack.exe
Hidden and Dangerous 2 NO CD Crack.exe
HijackThis.exe
Icewind Dale 2 no cd crack.exe
ICQ 4.exe
ICQ Pro 2003b.exe
iMesh.exe
Internet Download Manager v4.02 crack.exe
IsoBuster Professional v1.7.0.0 crack.exe
Jedi Academy NO CD Crack.exe
JetAudio Basic.exe
Joint Operations - Typhoon Rising NovaLogic crack.exe
Juiced Acclaim crack.exe
K-Lite Codec Pack v2.31 Full crack.exe
K-Lite Mega Codec Pack 1.13 keygen.exe
Kaspersky Anti-Hacker v1.7 crack.exe
Kazaa Download Accelerator Pro.exe
Kingdom Hearts II Square Enix crack.exe
Knights Apprentice Memoricks Adventures Games crack.exe
LimeWire (International).exe
LimeWire server scanner.exe
LimeWire.exe
Lord of the Rings: The Battle for Middle-earth 1.00 crack.exe
LOTR NO CD Crack.exe
Macromedia ColdFusion MX crack.exe
Macromedia Contribute v2.0 crack.exe
Macromedia Director 8 Crack.exe
Macromedia Dreamweaver 4.0 Patch.exe
Macromedia Dreamweaver MX 2004 7.0 crack.exe
Macromedia Dreamweaver MX v6.0 crack.exe
Macromedia Dreamweaver UltraDev 4.0 Patch.exe
Macromedia Fireworks 4.0 Patch.exe
Macromedia Flash 5 Crack.exe
Macromedia Flash All Versions keygen.exe
Macromedia Flash MX v6.0 crack.exe
Macromedia Flash SWF-Unprotect v2.0.exe
Macromedia FreeHand v10 Loader.exe
Madden NFL 2003 no cd crack.exe
Madden NFL 2005 EA crack.exe
Mafia no cd crack.exe
MagicScore maestro 3.5 keygen.exe
Malice Mud Duck Productions crack.exe
Mario Pinball Land GBA Puzzle Nintendo crack.exe
Mario Tennis GC Nintendo crack.exe
Matrix Screensaver.exe
Max Payne 2 Fall Of Max Payne no cd crack.exe
Max Payne 2 NO CD Crack.exe
Max Payne 2 The Fall of Max Payne NO CD crack.exe
MaxPayne 2 The Fall Of Max Payne Crack.exe
McAfee VirusScan 9.0 crack.exe
McFarlanes Evil Prophecy Konami crack.exe
Medal of Honor- Allied Assault no cd crack.exe
Medal Of Honor - Allied Assault BreakThrough no cd crack.exe
Medal Of Honor - Allied Assault no cd crack.exe
Medal of Honor Pacific Assault EA Games crack.exe
Medieval - Total War no cd crack.exe
Mega Man Anniversary Collection GC Capcom crack.exe
Metal Gear Acid PSP Konami crack.exe
Metal Gear Solid 3 - Snake Eater Konami crack.exe
Microsoft Flight Simulator 2004 - A Century Of Flight no cd crack.exe
Microsoft Office 2000 Regmaker.exe
Microsoft Office XP Activation Crack.exe
Microsoft Office XP Activation Killer.exe
Microsoft Office XP Professional Crack.exe
Microsoft Office XP Professional Serial.exe
Microsoft Office XP Universal Activator v1.0.exe
Microsoft Windows Media Player.exe
Microsoft Windows Xp Profesional Sp 2 keygen.exe
Microsoft Windows XP Professional ( Corp key ) keygen.exe
Midnight Club 3 - DUB Edition Rockstar Games crack.exe
mirc 6.1x reg entries.exe
mIRC 6.X crack.exe
Monopoly 3 ISO crack.exe
Monopoly 3 keygen.exe
Morpheus.exe
Mortal Kombat 4 crack.exe
Mozilla Firefox.exe
MP3 Doctor 5.11.15 crack.exe
mp3DirectCut 1.38 keygen.exe
MS Office XP Activation Crack.exe
MS Zoo Tycoon no cd crack.exe
MSN advert remover.exe
MSN Messenger (Windows XP).exe
MSN Toolbar advert remover.exe
MSN Toolbar.exe
MusicMatch Jukebox Plus 9.00 crack.exe
MVP Baseball 2004 EA crack.exe
Need For Speed: Underground 2 crack.exe
Need for Speed4 - NOCD.exe
NeedforspeedUnderground-nocd.exe
Nero 6 Ultra Edition 6.6.0.1 crack.exe
Nero 6 Ultra Edition Crack.exe
Norton AntiVirus 2004 Professional Edition keygen.exe
norton antivirus 2005 crack.exe
Norton Antivirus 2005 crack.exe
RollerCoaster Tycoon NO CD Crack (Including Attractions Pack).exe
RYL crack.exe
Second Life Linden Lab crack.exe
Serials 2000 v7.1 Plus (build 06.16.04) keygen.exe
Shadow Ops - Red Mercury Atari crack.exe
ShellShock - Nam 67 Eidos Interactive crack.exe
Shockwave Player.exe
Silent Storm - Sentinels _No Company crack.exe
Sim City 4 - Rush Hour no cd crack.exe
Sim City 4 Deluxe no cd crack.exe
Sim Theme Park World no cd crack.exe
Sims 2 crack.exe
Singles - Flirt Up Your Life Eidos Interactive crack.exe
Snood crack.exe
Snood Crack.exe
Snood.exe
Snowblind Eidos Interactive crack.exe
SolSuite 2004 - Solitaire Card Games Suite.exe
Sonic the Hedgehog 3 crack.exe
Spider-Man 2 Activision crack.exe
Spider-Man 2 GC Activision crack.exe
Sponge Bob Square Pants - Operation Krabby Patty no cd crack.exe
Spy Sweeper 3.2 147 crack.exe
Spybot - Search & Destroy.exe
The Sims - Vacation Expansion Pack no cd crack.exe
The Sims 2 crack.exe
The Sims Deluxe no cd crack.exe
The Sims Double Deluxe no cd crack.exe
The Sims no cd crack.exe
The Suffering Encore Software Inc. crack.exe
The Suffering Midway crack.exe
Thief - Deadly Shadows Eidos Interactive crack.exe
Tiger Woods PGA Tour 2004 crack.exe
Tom Clancys Ghost Recon - Desert Siege no cd crack.exe
Tom Clancys splinter cell pandora tomo db
Tom Clancys Splinter Cell Pandora Tomorrow Ubisoft crack.exe
Tom Clancys Splinter Cell Ubisoft crack.exe
Tony Hawks Underground crack.exe
Total Commander v6.03a PowerPack 25 crack.exe
Trillian crasher.exe
Trillian Pro v3.0.950 crack.exe
Trillian.exe
Tweak-XP Pro 4.0.2 crack.exe
Unreal Tournament 2003 no cd crack.exe
Unreal Tournament 2004 Atari crack.exe
Unreal Tournament 2004 crack (keygen).exe
Unreal Tournament 2004 Crack.exe
Unreal Tournament 2004 NO CD crack.exe
Vampire - The Masquerade - Bloodlines Activision crack.exe
VirtualLab Data Recovery crack.exe
VirtualLab Data Recovery.exe
Virtuosa Phoenix Edition Crack.exe
Warcraft III - Reign Of Chaos no cd crack.exe
Warez P2P.exe
WebRoot Spy Sweeper 3.5.0.189 crack.exe
Webroot Spy Sweeper Crack.exe
Webroot Spy Sweeper.exe
WebSite Watcher v4.02 crack.exe
Winace 2.x Crack.exe
Winamp 5.03 Full crack.exe
Winamp Full.exe
windows server 2003 crack.exe
Windows Server 2003 SP1 Build 1039-2l crack.exe
Windows XP Activation Crack.exe
Windows XP home edition Activation.exe
Windows XP Pro 64-bit crack.exe
Windows XP Professional crack.exe
Windows XP SP2 KeyGen.exe
WinDVD Platinum 5.0.26.23 crack.exe
WinMX.exe
WinRAR 3.30 Corporate Ed crack.exe
WinRAR 3.x Crack.exe
WinRAR All KeyGen.exe
WinRAR crack (keygen).exe
WinRAR v3.20 Final keygen.exe
WinRAR v3.30 Final keygen.exe
WinRAR v3.41 Final keygen.exe
WinRAR.exe
WinZip 9.x Crack.exe
WinZip All KeyGen.exe
WinZip All Versions keygen.exe
Winzip keygen.exe
WinZip Self-Extractor v2.2 keygen.exe
WinZip Self-Extractor v2.2 Patch.exe
WinZip v8.0 Keygen.exe
WinZIP v9.0 Keygen.exe
WinZip v9.0 Registration.exe
WinZip.exe
World of Warcraft Blizzard Entertainment crack.exe
Worms Armageddon NO CD crack.exe
WWE Day of Reckoning GC THQ crack.exe
WWE SmackDown! vs. Raw THQ crack.exe
XBOX X-Fer Ripper and Transfer.exe
XP Slipstreamer v1.0 crack.exe
Yahoo Messenger.exe
Yoshinoya Success crack.exe
ZeroSpyware Lite.exe
Zone Alarm Security Suite 5.5.062 crack.exe
ZoneAlarm crack (keygen).exe
ZoneAlarm.exe
Zoo Tycoon- Dinosaur Digs no cd crack.exe
Zoo Tycoon - Complete Collection no cd crack.exe
Zoo Tycoon no cd crack.exe
W32/Tibick-C will then set some of the following registry entries to point to
the MSVIEW folder to allow the worm to spread via KaZaA and iMesh:
HKCU\Software\Kazaa\LocalContent
Dir<NUM>
(where <NUM> is in the range 0-100)
HKCU\Software\iMesh\Client\LocalContent
Dir<NUM>
(where <NUM> is in the range 0-100)
W32/Tibick-C may add a line to the file MorphConfig.ini in the folder found at
HKLM\SOFTWARE\Morpheus\Install_Dir, pointing to the MSVIEW folder to allow the
worm to spread via Morpheus.
W32/Tibick-C may add a line to the file Shared Folders.txt in the Data
subfolder of the folder found at HKCR\wareo\shell\open\command, pointing to the
MSVIEW folder to allow the worm to spread via Warez.
W32/Tibick-C may add a line to the file shareddir.dat in the Config subfolder
of the folder found at HKCU\Software\eMule\Install Path, pointing to the MSVIEW
folder to allow the worm to spread via eMule.
W32/Tibick-C may write a long XML string to the file DCPlusPlus.xml found in
the folder at HKLM\SOFTWARE\DC++\Install_Dir, ending with a line pointing to
the MSVIEW folder to allow the worm to spread via DC++.
W32/Tibick-C may also set some of the following registry entries to help it
spread via KaZaA and iMesh:
HKCU\Software\Kazaa\Advanced
SuperNode
0
HKCU\Software\Kazaa\Advanced
ScanFolder
0
HKCU\Software\Kazaa\LocalContent
DisableSharing
0
HKCU\Software\Kazaa\LocalContent
DisableListFiles
1
HKCU\Software\Kazaa\ResultsFilter
firewall_filter
0
HKCU\Software\Kazaa\ResultsFilter
virus_filter
0
HKCU\Software\Kazaa\Transfer
UploadBandwidth
0
HKCU\Software\Kazaa\Transfer
ConcurrentUploads
0
HKCU\Software\Kazaa\Transfer
NoUploadLimitWhenIdle
1
HKCU\Software\Kazaa
LimitBitrate
0
HKCU\Software\Kazaa\DontShow
CloseToSystray
1
HKCU\Software\Kazaa\InstantMessaging
IgnoreAll
1
HKCU\Software\Kazaa\UserDetails
AutoConnected
1
HKCU\Software\iMesh\Client\LocalContent
DisableSharing
0
HKCU\Software\iMesh\Client\LocalContent
ConcurrentUploads
20
W32/Tibick-C also contains limited IRC backdoor Trojan functionality.
W32/Tibick-C will attempt to connecting to a remote IRC server and may attempt
to download and execute a file from a specified address to a random filename
with an EXE extension in the Windows system folder if instructed to do so.
This IDE file also includes detection for:
W32/Agobot-QS
http://www.sophos.com/virusinfo/analyses/w32agobotqs.html
Troj/Sivion-A
http://www.sophos.com/virusinfo/analyses/trojsiviona.html
W32/Forbot-FX
http://www.sophos.com/virusinfo/analyses/w32forbotfx.html
Troj/Corp-A
http://www.sophos.com/virusinfo/analyses/trojcorpa.html
W32/Myfip-I
http://www.sophos.com/virusinfo/analyses/w32myfipi.html
W32/Rbot-XC
http://www.sophos.com/virusinfo/analyses/w32rbotxc.html
Troj/Ablank-H
http://www.sophos.com/virusinfo/analyses/trojablankh.html
Troj/Ablank-G
http://www.sophos.com/virusinfo/analyses/trojablankg.html
Troj/Ablank-I
http://www.sophos.com/virusinfo/analyses/trojablanki.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/tibickc.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Tibick-C
