W32/Bagle-J

Vea la información para eliminar gusanos.

W32/Bagle-J es un gusano de email que se envía mediante su propio programa de correo SMTP a todas las direcciones encontradas en el disco duro (en archivos con extensiones WAB, TXT, MSG, HTM, XML, DBX, MDX, EML, NCH, MMF, ODS, CFG, ASP, PHP, PL, ADB, TBB, SHT, UIN y CGI).

Al ejecutarse, el gusano se copia en la carpeta System de Windows con el nombre IRUN4.EXE y crea el archivo IRUN4.EXEOPEN (copia del gusano en formato comprimido ZIP con contraseña) en la misma carpeta.

W32/Bagle-J crea la siguiente entrada en el registro para activarse en el inicio del sistema:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run ssate.exe = <SYSTEM>\i11r54n4.exe

W32/Bagle-J llega en un email con las siguientes características:

Asuntos: E-mail account security warning. Notify about using the e-mail account. Warning about your e-mail account. Important notify about your e-mail account. Email account utilization warning. Notify about your e-mail account utilization. E-mail account disabling warning.

Mensajes: creado con una combinación aleatoria de las siguientes frases "Dear user of <dominio>," "Dear user of <dominio> gateway e-mail server," "Dear user of e-mail server "<dominio>"," "Hello user of <dominio> e-mail server," "Dear user of "<dominio>" mailing system," "Dear user, the management of <dominio> mailing system wants to let you know that,"

seguido de

"Your e-mail account has been temporary disabled because of unauthorized access." "Our main mailing server will be temporary unavaible for next two days, to continue receiving mail in these days you have to configure our free auto-forwarding service." "Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information." "We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions." "Our antivirus software has detected a large ammount of viruses outgoing from your email account, you may use our free anti-virus tool to clean up your computer software." "Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions."

seguido de

"For more information see the attached file." "Further details can be obtained from attached file." "Advanced details can be found in attached file." "For details see the attach." "For details see the attached file." "For further details see the attach." "Please, read the attach for further details." "Pay attention on attached file."

seguido de

"For security reasons attached file is password protected. The password is "<contraseña aleatoria del archivo zip>"." "For security purposes the attached file is password protected. Password is "<contraseña aleatoria del archivo zip>"." "Attached file protected with the password for security reasons. Password is <contraseña aleatoria del archivo zip>." "In order to read the attach you have to use the following password: <contraseña aleatoria del archivo zip>."

seguido de

"Sincerely," "Best wishes," "Have a good day," "Cheers," "Kind regards," "The Management,"

seguido de

"The <domain_name> team, http://www.<dominio>"

Archivo adjunto: (archivo ZIP con contraseña) Attach Information Readme Document TextDocument TextFile MoreInfo Message

W32/Bagle-J abre el puerto 2745 y aguarda las instrucciones del atacante, que podría copiar y ejecutar archivos. El gusano contactará con un sitio Web para comunicar su disponibilidad y ubicación

W32/Bagle-J intentará terminar los siguientes procesos relacionados con productos antivirus y de seguridad:

ATUPDATER.EXE AVWUPD32.EXE AVPUPD.EXE LUALL.EXE DRWEBUPW.EXE ICSSUPPNT.EXE ICSUPP95.EXE UPDATE.EXE NUPGRADE.EXE ATUPDATER.EXE AUPDATE.EXE AUTODOWN.EXE AUTOTRACE.EXE AUTOUPDATE.EXE AVXQUAR.EXE CFIAUDIT.EXE MCUPDATE.EXE NUPGRADE.EXE OUTPOST.EXE AVLTMAIN.EXE

W32/Bagle-J intentará copiarse en carpetas compartidas que incluyan la cadena de texto "shar" con los siguientes nombres:

Microsoft Office 2003 Crack, Working!.exe Microsoft Office XP working Crack, Keygen.exe Microsoft Windows XP, WinXP Crack, working Keygen.exe Porno Screensaver.scr Porno, sex, oral, anal cool, awesome!!.exe Porno pics arhive, xxx.exe Serials.txt.exe Windown Longhorn Beta Leak.exe Windows Sourcecode update.doc.exe XXX hardcore images.exe Opera 8 New!.exe WinAmp 5 Pro Keygen Crack Update.exe WinAmp 6 New!.exe Matrix 3 Revolution English Subtitles.exe Adobe Photoshop 9 full.exe Ahead Nero 7.exe ACDSee 9.exe

A partir del 25 de abril de 2005, W32/Bagle-J se eliminará a sí mismo y borrará las entradas que creó en el registro.