Virus Database

Bazil.1956

Description Bazil.1956

It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. In some cases the virus displays the message:
*****************************************************************
* THIS FILE IS INFECTED AS WELL AS ALL COM FILES ON THIS DISC! *
* [BaZiL] *
*****************************************************************

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Trood

Description I-Worm.Trood

This is Internet worm that spreads attached to e-mails. The worm itself is a Windows application (EXE file) about 10K in length. The worm is able to infect Win9x/ME systems only.
When the worm is activated (executed by a user from a attached file), it installs itself to the system and displays a fake message:

Spreading
The worm stays in the Windows memory, registers itself as a hidden application (service), then copies a block of its code to the Win9x system area (as a VxD driver), and hooks TDI (Transport Driver Interface) functions that are responsible for connection and data sending (i.e., the worm spreading routine does not depend on the e-mailer, and is able to infect e-mailers of any type). So, the worm hooks transport protocols similar to firewall utilities.
The worm then monitors all messages that are being sent by SMTP protocol. If a message has no attached file(s), the worm appends its own file as an attachment with a TCPIPUPD.EXE name.
Run Each Time Windows Starts
To force Windows to run itself upon the next reboot, the worm copies itself to the Windows system directory with a SYSTRAY.EXE name. As that file usually is registered in the system registry auto-run key, the worm code is activated upon each Windows restart instead of the original SYSTRAY.
The SYSTRAY.EXE is usually active, and locked for writing by Windows as a result. To avoid this, the worm uses a standard trick of replacing files by using a WININIT.INI file.
To release control to an original SYSTRAY file, the worm, while installing, renames it with a SYSTRAY.SYS name. When the installing worm's routine is complete, it runs this SYSTRAY.SYS file, and the original SYSTRAY program starts.
Payload
On Saturdays, the worm activates its payload routines that slowly move an active application window to a random direction (outside the desktop), and in five minutes, restarts Windows.
The worm code also contains the text strings:
I-Worm.Win9X.Troodon v1.0 Project
Developed by Clau.

I-Worm.Unicle

Description I-Worm.Unicle

General Characteristics
This worm is able to work on Chinese versions of Windows only, and spreads itself by sending infected e-mail messages. The worm has two components: a script program and Windows PE EXE file. The first component (script) is sent in infected e-mails, infects the computer, then downloads and executes a EXE component that completes the infection and spreads the worm copies further.
Installation
The worm arrives as an HTML message with a JavaScript program inside. That script is automatically processed upon opening a message, and the worm code gets control.
Note:
Internet browsers and e-mail clients have built-in security protections that prevent script programs embedded into messages, to access disk files and system resources (the worm needs both to spread itself - see below). To infect the system from an e-mail message, the worm needs to avoid these protections. To do this, it exploits an Internet Explorer 5 security breach - a so-called "Scriptlet.Typelib vulnerability" (see below).
The worm then searches for the startup directory - it looks for Windows directories in the following order:
C:WINDOWSStart MenuPrograms-T-?
C:WINDOWStart MenuPrograms-T-?
C:WINStart MenuPrograms-T-?
C:WIN98Start MenuPrograms-T-?
C:WIN95Start MenuPrograms-T-?
C:WINDOWS.000Start MenuPrograms-T-?
C:WINDOWS.001Start MenuPrograms-T-?
D:WINDOWSStart MenuPrograms-T-?
D:WINDOWStart MenuPrograms-T-?
D:WINStart MenuPrograms-T-?
D:WIN98Start MenuPrograms-T-?
D:WIN95Start MenuPrograms-T-?
D:WINDOWS.000Start MenuPrograms-T-?
D:WINDOWS.001Start MenuPrograms-T-?
In case there are no such directories on the machine, the worm cannot infect the system and cannot spread further. The last characters in each line are Chinese strings, and they can't be used under any other local Windows version, which is why the worm is able to affect Chinese Windows only.
If any appropriate directory has been found, the worm creates "Microsoft Internet Explorer.hta" file in there. This file contains HTML Application that contains one more worm's script program. Because the file is created in Windows startup directory it will be executed at next Windows startup.
Onceexecuted "Microsoft Internet Explorer.hta" script creates MSIE.INI file in the Windows system directory and stores the local SMTP server address in there (the worm gets that SMTP server address from system registry).
Note:
the SMTP server is a machine that receives e-messages from computer. In cases where there is a stand-alone PC or email server, it is provider's address, or some other address that is used as a host email server to send [and receive] emails.
After that the worm creates "system" folder in Windows system directory (for example "C:WINDOWSSYSTEMsystem") and tries to download to there the MSIE.EXE file from the Internet. To do this the worm connects to one of ten FTP sites using script for standard utility FTP.EXE. If download fails the worm goes into a loop and attempts to repeat it every three minutes.
When the file MSIE.EXE is downloaded, the worm executes it (MSIE.EXE is selfextracting archive) and gets two more files:
EXPLORER.EXE
MSWINSCK.OCX
EXPLORER.EXE is the second worm component (Windows EXE file), and MSWINSCK.OCX is a library to access Windows sockets.
The worm then starts EXPLORER.EXE file that obtains the email addresses and sends infected messages with the worm's script program inside by using SMTP protocol. To acquire the victims' email addresses the worm scans the subdirectory tree on all drives, searching for *.NCH, *.SNM, *.DBX files (mail database files), it then scans them and looks for email addresses.
The worm's EXPLORER.EXE also performs additional actions. First of all it erases "traces" of its script component and deletes files that were created by it: MSIE.HTA, MSIE.LST, MSBOOT.BAT, MSIE.EXE. It then registers itself in WIN.INI file in the "run=" command to be automatically run on each Windows startup.
The worm will also notify its author (or possible host) about its presence on the infected machine. To do that it sends message to one of the addresses:
leebill_001@yahoo.com
leebill_002@yahoo.com
all
leebill_023@yahoo.com
there are 23 possible addresses, and the worm randomly selects one of them.
Payload
The worm has a "backdoor" payload that "listens" for a remote host and executes its commands: show a directory, open/close/create/execute/delete file, e.t.c.
Demo-versions of Kaspersky Lab AntiViral Toolkit Pro (AVP) able to combat against "Unicle" worm are available on Kaspersky Lab's Web site on http://www.kasperskylab.ru/eng/products/eval.asp.
You can purchase fully functional version of AntiViral Toolkit Pro online via the Internet on the following address: http://www.kasperskylab.ru/eng/buy/default.asp
How to protect against "Unicle" worm?
Microsoft has released an update that eliminates security "Scriptlet.Typelib" vulnerability. We strongly recommend you visit http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP and install this update.
If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use "Scriptlet.Typelib" security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps:
1. Double click "My Computer" icon on desktop.
2. In appeared window choose menu "View" -> "Options...".
3. On "File Types" tab in "Registered file types" listbox select "HTML Applicaton" item.
4. Click "Remove" button and confirm action.
5. Close options dialog box.

Home