Email-Worm.Win32.Ganda

Jest to robak rozprzestrzeniaj膮cy si臋 przez internet jako za艂膮cznik zainfekowanych wiadomo艣ci e-mail oraz infekuj膮cy pliki wykonywalne. Ma posta膰 pliku PE EXE o rozmiarze 45 056 bajt贸w i zosta艂 stworzony przy u偶yciu j臋zyka programowania Assembler.

Tematy oraz tre艣ci zainfekowanych wiadomo艣ci wybierane s膮 spo艣r贸d poni偶szych mo偶liwo艣ci. W zale偶no艣ci od ustawie艅 j臋zykowych w wiadomo艣ciach umieszczane s膮 angielskie lub szwedzkie teksty.

Wiadomo艣ci w j臋zyku szwedzkim

  • Wariant 1:

    Temat: =?iso-8859-1?Q?Olaglig_sk=E4rmsl=E4ckare=3F?=

    Tre艣膰:

    Hej!

    Min son visade mig denna sk=E4rmsl=E4ckare som jag misst=E4nker kan = bryta mot lagen om hets mot folkgrupp. Eftersom du =E4r verksam som = jurist, s=E5 vore jag tacksam f=F6r en fackmans syn p=E5 saken. Tack = p=E5 f=F6rhand.

  • Wariant 2:

    Temat: Rashets eller inte?

    Tre艣膰:

    Hejsan!

    Min datal=E4rare gjorde mig uppm=E4rksam p=E5 att denna = sk=E4rmsl=E4ckare m=F6jligen kan t=E4nkas vara ett verk av rasister. Nu = vet jag varken ut eller in, eftersom jag hade t=E4nkt anv=E4nda den p=E5 = min skoldator. B=F6r jag att forts=E4tta att anv=E4nda den? Svara helst = snarast. Tack p=E5 f=F6rhand.

  • Wariant 3:

    Temat: Hakkors.

    Tre艣膰:

    Hej!

    Min klassf=F6rest=E5ndare gick i taket n=E4r hon fick se = sk=E4rmsl=E4ckaren som jag har anv=E4nt under tv=E5 terminer. Hon = anklagade mig f=F6r antisemitism eftersom den ibland visar ett hakkors. =' Tycker du att jag b=F6r acceptera detta fr=E5n henne? Vore tacksam f=F6r = ett utl=E5tande fr=E5n dig. Svara helst s=E5 snart det g=E5r.

  • Wariant 4:

    Temat: Suspekta semaforer.

    Tre艣膰:

    Hejsan !

    I skolan hittade jag en CD skiva som inneh=F6ll bl.a denna = sk=E4rmsl=E4ckare. En l=E4rare som r=E5kade kasta ett =F6ga p=E5 den = avf=E4rdade dess inneh=E5ll som ren rasistisk propaganda. Sj=E4lv tycker = jag inte att det =E4r n=E5got att orda om. Vore tacksam f=F6r din uppfattning. Tack p=E5 f=F6rhand.

  • Wariant 5:

    Temat: =?iso-8859-1?Q?Avskyv=E4rd_reklam.?=

    Tre艣膰:

    Hej!

    Min minder=E5rige son fick denna sk=E4rmsl=E4ckare p=E5 en CD skiva via = ett massutskick av reklam. Jag uppr=F6rs =F6ver det s=E4tt p=E5 vilket = rasistiska och nazistiska propagandister till=E5ts f=F6rmedla sin = avskyv=E4rda ideologitill barn. Jag =F6verv=E4ger nu att polisanm=E4la detta tilltag s=E5 = snart du, i egenskap av juridisk fackman, delgett mig din =E5sikt. Tack = p=E5 f=F6rhand.

  • Wariant 6:

    Temat: =?iso-8859-1?Q?=D6verviktiga_f=F6rnedras.?=

    Tre艣膰:

    Hejsan !

    Jag =F6verv=E4ger att polisanm=E4la denna sk=E4rmsl=E4ckare. Jag anser = att den har en nedl=E5tande attityd gentemot =F6verviktiga personer. Jag = skulle bli ytterst tacksam om du kunde bidra med din syn p=E5 saken. Tack p=E5 f=F6rhand.

  • Wariant 7:

    Temat: Go ack ack ack....

    Tre艣膰:

    Hej igen!

    Den h=E4r sk=E4rmsl=E4ckaren verkar vara en amerikansk parodi p=E5 = n=E5got som svenskarna g=F6r p=E5 midsommar. Skratta inte ihj=E4l dig = bara. :-)

  • Wariant 8:

    Temat: =?iso-8859-1?Q?=C4r_USA_ett_UFO=3F?=

    Tre艣膰:

    Hej igen!

    H=E4r =E4r sk=E4rmsl=E4ckare nummer 4. Kolla in den och tala sedan om = f=F6r mig att George W Bush INTE =E4r en rymdvarelse. ;-)

  • Wariant 9:

    Temat: Korkad president.

    Tre艣膰:

    Hej igen!

    H=E4r =E4r sk=E4rmsl=E4ckaren som jag snackade om. George W Bush verkar = inte vara allf=F6r bright om man ska tro brittiska komiker. ' :-)

  • Wariant 10:

    Temat: Katt, hund, kanin.

    Tre艣膰:

    Hej igen!

    Om du gillar djur s=E5 m=E5ste denna sk=E4rmsl=E4ckare vara n=E5't f=F6r = dig. Mjau, Voff, Arf Arf.... ;-)

Wiadomo艣ci w j臋zyku angielskim

  • Wariant 1:

    Temat: Screensaver advice.

    Tre艣膰:

    Do you think this screensaver could be considered illegal? Would = appreciate if you or any one of your friends could check it out and = answer as soon as humanly possible. Thanx !

  • Wariant 2:

    Temat: Spy pics.

    Tre艣膰:

    Here's the screensaver i told you about. It contains pictures taken by = one of the US spy satellites during one of it's missions over iraq. If = you want more of these pic's you know where you can find me. Bye!

  • Wariant 3:

    Temat: GO USA !!!!

    Tre艣膰:

    This screensaver animates the star spangled banner. Please support the = US administration in their fight against terror. Thanx a lot!

  • Wariant 4:

    Temat: G.W Bush animation.

    Tre艣膰:

    Here's the animation that the FBI wants to stop. Seems like the feds are = trying to put an end to peoples right to say what they think of the US = administration. Have fun!

  • Wariant 5:

    Temat: Is USA a UFO?

    Tre艣膰:

    Have a look at this screensaver, and then tell me that George.W Bush is = not an alien. ;-)

  • Wariant 6:

    Temat: Is USA always number one?

    Tre艣膰:

    Some misguided people actually believe that an american life has a = greater value than those of other nationalities. Just have a look at = this pathetic screensaver and then you'll know what i'm talking about. = All the best.

  • Wariant 7:

    Temat: LINUX.

    Tre艣膰:

    Are you a windows user who is curious about the linux environment? This = screensaver gives you a preview of the KDE and GNOME desktops. What's = more, LINUX is a free system, meaning anyone can download it.

  • Wariant 8:

    Temat: Nazi propaganda?

    Tre艣膰:

    This screensaver has been banned in Germany. It contains a number of = animated symbols that can be related to the nazi culture. What do you = think, is it a legitimate ban or not? Please answer asap. Thanx!

  • Wariant 9:

    Temat: Catlover.

    Tre艣膰:

    If you like cats you'll love this screensaver. It's four animated = kittens running around on the screen. Contact me for more clipart. Have = fun! ;-)

  • Wariant 10:

    Temat: Disgusting propaganda.

    Tre艣膰:

    Hello! My 12 year old doughter received this screensaver on a CDROM that = was sent to her through advertising. I find it disturbing that children = are now being targets of nazi organizations. I would appreciate to hear = from you on this matter, as soon as possible. Thank you.

Nazwa za艂膮cznika posiada format xx.scr, gdzie xx to dwie losowe litery od 'a' do 'z'.

Robak aktywuje si臋 z zainfekowanych wiadomo艣ci tylko wtedy, gdy u偶ytkownik uruchomi za艂膮cznik.

Instalacja

Podczas instalacji robak kopiuje si臋 do folderu Windows z nazw膮 SCANDISK.exe i tworzy klucz auto-run w rejestrze systemowym:

HKLMSoftwareMicrosoftWindowsCurrentVersionRun
ScanDisk=SCANDISK.exe

Dodatkowo robak tworzy w folderze Windows plik o nazwie xx.scr, gdzie xx to dwie losowe litery od 'a' do 'z'.

Rozprzestrzenianie

W celu wysy艂ania zainfekowanych wiadomo艣ci e-mail robak korzysta z serwera SMTP. Adresy "ofiar" pobierane s膮 z plik贸w WAB, EML, HTM oraz DBX.

Infekowanie plik贸w PE EXE

Robak skanuje wszystkie pliki EXE oraz SCR zapisane na lokalnych dyskach twardych w poszukiwaniu specjalnych polece艅 i w przypadku ich wykrycia umieszcza w atakowanym pliku sw贸j kod zawieraj膮cy nast臋puj膮cy tekst:

KERNEL32.DLL
CreateProcessA  
GlobalAlloc 
GetWindowsDirectoryA 
SetCurrentDirectoryA 
CreateProcessA 
hvjxlzna.EXE

Wy艂膮czanie ochrony antywirusowej

Robak zamyka procesy, kt贸rych kod zawiera nast臋puj膮ce teksty:

virus, firewall, f-secure, symantec, mcafee, pc-cillin, trend micro, kaspersky, sophos, norton.

Nast臋pnie szkodnik usuwa wszystkie pliki, na kt贸re wskazuj膮 nast臋puj膮ce klucze rejestru systemowego:

  • HKLMSystemCurrentControlSetServicesVxD,
  • HKLMSoftwareMicrosoftWindowsCurrentVersionRun,
  • HKLMSoftwareMicrosoftWindowsCurrentVersion
    RunServices.

Funkcje dodatkowe

Robak wysy艂a nast臋puj膮c膮 wiadomo艣膰 e-mail

Od: skrattahaha@hotmail.com

Do:

red@fna.se, debatt@svt.se, susanne.sjostedt@tidningen.to, skolverket@skolverket.se, mary.martensson@aftonbladet.se, katarina.sternudd@aftonbladet.se, cecilia.gustavsson@aftonbladet.se, jessica.ritzen@aftonbladet.se, margareta.cronquist@tidningen.to, annika.sohlander@aftonbladet.se, kerstin.danielson@aftonbladet.se, insandare@tidningen.to, insandare@aftonbladet.se.

Temat: DISKRIMINERAD !!!!

Tre艣膰 wiadomo艣ci zawiera szwedzki tekst.

W kodzie robaka znajduj膮 si臋 zaszyfrowane teksty:

[WORM.SWEDENSUX] Coded by Uncle Roger 
in H盲rn枚sand, Sweden, 03.03.
I am being discriminated by the swedish schoolsystem. 
This is a response to eight long years of discrimination.
I support animal-lierators worldwide.