Cảnh báo virus: W32/Sober-F

- Trong lần chạy đầu tiên, sâu sẽ tạo ra một file .txt trong thư mục Temp và sử dụng NOTEPAD.EXE để hiển thị nội dung. File text của sâu được bắt đầu bằng những đoạn thông điệp sau:

"#Mail Transaction Failed
#This mail couldn't be converted
---------------- Damage #Mime base64# part ----------------
<random text>"

- Sâu tự nhân bản vào thư mục hệ thống Windows dưới dạng file thực thi .exe, với tên được kết hợp từ một trong số những từ sau:

sys, host, dir, expolrer, win, run, log, 32, disc, crypt, data, diag, spool, service, smss32

- Để có thể tự động chạy khi hệ thống khởi động, W32/Sober-F sẽ tạo ra các giá trị sau trong khoá registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\<tên ngẫu nhiên>= <SYSTEM>\<file ngẫu nhiên> %1

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\<random name>\<tên ngẫu nhiên>= <SYSTEM>\<file ngẫu nhiên>

- W32/Sober-F có thể thay đổi giá trị registry tại vị trí sau để có thể tự động chạy trước khi file "exe" được kích hoạt.

HKCR\exefile\shell\open\command

- W32/Sober-F cũng tạo ra các file sau trong thư mục hệ thống Windows:

BCEGFDS.LLL - zero byte file
SPOOFED_RECIPS.OCX - list of harvested email addresses
SYST32WIN.DLL - list of harvested email addresses
WINHEX32XX.WRM - base64 encoded version of the worm
WINSYS32XX.ZZP - base64 encoded ZIP archive of the worm
ZHCARXXI.VVX - zero byte file
ZMNDPGWF.KXX - zero byte file

- W32/Sober-F thu thập địa chỉ e-mail từ các file có phần mở rộng sau:

WAB, TBB, ABD, ADB, PL, CTL, DHTM, CGI, PP, PPT, MSG, JSP, OFT, VBS, UIN, LDB, ABC, PST, CFG, MDW, MBX, MDX, MDA, ADP, NAB, FDB, VAP, DSP, ADE, SLN, DSW, MDE, FRM, BAS, ADR, CLS, INI, LDIF, LOG, MDB, XML, WSH, ABX, ,ADB, RTF, MMF, DOC, ODS, NCH, XLS, NSF, TXT, EML, HLP, MHT, NFO, PHP, ASP, SHTML, DBX

- E-mail (ở hai định dạng: tiếng Anh và tiếng Đức) bị nhiễm W32/Sober-F thường có các đặc điểm sau:

Dòng tiêu đề (tiếng Anh):

Details
Oh my God
Hey
Hi!
Hi, it's me
hey you
damn
Well, surprise?!
Info
Information
.
Faulty mail delivery
Mail delivery failed
Mail Error
Illegal signs in Mail-Routing
Connectio failed
Invalid mail sentence length
Mail Delivery failure
Message Error
mail delivery status
Confirmation Required
Bad Gateway
Warning!
Your document

Thông điệp (tiếng Anh):

I was surprised, too! :-( Who could suspect something like that?

All OK smile_image see, what i've found!

hi its me i've found a shity virus on my pc. check your pc, too! follow the
steps in this article. bye

I 've told you!:-) sometime I grab your passwords!

I hope you accept the result! Follow the instructions to read the message.
Please read the document

Registration confirmation
Confirmation
Your Password
Your mail account
Your password was changed successfully.
Protected message is attached.
++++ Service: http://www.
++++ Mail To: User-info

*** Auto Mail Delivery System ***
67.28.114.32_failed_after_I_sent_the_message./Remote_host_said
:_554_delivery_error:_dd_Sorry_your_message_cannot_be_delivered.
_This_account_has_been_disabled_or_discontinued_[#102]._-_mta134.mail.dcn.com
** End of Transmission The original message is a separate attachment.
--- Web: http://www.
--- Mail To: UserHelp

Read the attachment for details.
Bad Gateway: The message has been attached.
+++ A service of +++ http://www. Mail: home

The message has been attached.

Database #Error -- Partial message is available! -- Error: llegal signs in
Mail-Routing -- Mail Server: ESMTP VX32.9 Version Betha Alpha

Anybody use your accounts! For further details see the attachment.

I have received your document. The corrected document is attached. greets corrected_text-file

The message text may end with the following:

Mail- Attachment: No suspicious Virus signatures
Mail Scanner: No Virus found
Anti-Virus: No Virus!

Dòng tiêu đề (tiếng Đức):

Einzelheiten
Hallo Du!
Hallo!
Hey Du
Hi, Ich bin's
Ich bin es .-)
Verdammt
berrascht?!
Information
Fehlerhafte Mailzustellung
Mailzustellung fehlgeschlagen
Fehler
Illegale Zeichen in Mail-Routing
Verbindung fehlgeschlagen
ltige Mail-Satzl
Fehler in E-Mail
tigung
Registrierungs-Best
tigung
Ihr neues Passwort
Ihr Passwort
Datenbank-Fehler
Warnung!

Dòng thông điêp (tiếng Đức):

Ich war auch ein wenig Wer konnte so etwas ahnen!? Lese selbst

Alles klaro bei dir? Schau mal was Ich gefunden habe!

Meinst Du das wirklich?

Sieh mal nach ob du den Scheiss auch bei dir drauf hast! Ist ein ziemlich
nervender Virus. Mach genau das, wie es im Text beschrieben ist! Bye

Ich habs dir doch gesagt, irgendwann schaffe ich es deine Passwrter
rauszubekommen!!!

Details entnehmen Sie bitte dem Attachment NShere Informationen befinden
sich im Anhang.

*** Auto Mail Delivery System *** Ihre E-Mail konnte nicht gesendet oder
empfangen werden. Bitte attach: * End Transmission
--- Web: http://www.
--- Mail To: User-Hilfe

Passwort und Benutzername wurde erfolgreich ge Mail- Anhang: Keine verd chtigen Virus- Signaturen gefunden Ihre Benutzernamen und Passwrter befinden sich im Anhang dieser E-Mail ++++ Im www erreichbar unter: http://www. ++++ E-Mail: KundenInfo

Wegen eines Datenbank- Fehlers k Wenn Sie Unregelm
igkeiten festgestellt haben, melden Sie uns bitte umgehend den Datenverlust.
Vielen Dank f +++ Ein Service von

Internet Provider Abuse: Wir haben festgestellt, dass Sie illegale Internet-
Seiten besuchen. Bitte beachten Sie folgende Liste:

The message text may end with the following:

Mail- Anhang: Keine verdchtigen Virus- Signaturen gefunden
Mail Scanner: Kein Virus gefunden
Anti- Virus: Es wurde kein Virus erkannt

File đính kèm (phần mở rộng ở dạng PIF hoặc ZIP):

Webmaster, Fehler-Info, Administrator, RobotMailer, AutoMailer, Dokumente,
Dokument, KurzText, Register, Service, Info, Passwort, Kundenservice, Liste,
Schwarze-Liste, Information, text, Textdocument, anitv_text, instructions,
your_article, your_passwords, messagedoc, admin, pass-message, database, help, check_this, Police.