1.  "Randon" Threatens Port 445!
A new blended worm / trojan threat appears. Kaspersky Labs, an
international data security software developer, reports registered
infections at the hands of the new network worm "Randon". Kaspersky Labs
has already received several incident reports from both Russian and the
Netherlands connected with this malicious program.

"Randon" spreads via IRC channels and local area networks and infects
computers running Windows 2000 and Windows XP. To penetrate computer
systems the worm registers itself in the IRC server (or local area
network), scans for all present users and connects to victim computers
via port 445 and attempts to gain access by using a fixed list of the
most commonly used passwords. When "Randon" manages to successfully
break-in it proceeds to transmit to this system the Trojan program
"Apher", which then, from a remote web site, loads worm's remaining
components (a total of 13 files, including a full-fledged mIRC client
for work with IRC channels).

"Randon" installs its components to the Windows system directory,
registers its main file and the mIRC client in the Windows registry
auto-run key, and then executes them. To keep its activities secret,
"Randon" uses a special utility called "HideWindows", which is also part
of the worm. "HideWindows" renders the worm invisible to victims and its
active processes can only be detected in the Windows task manager.

Fortunately "Randon" does not carry out any destructive functions.
Collateral effects on infected machines include a high volume of
redundant or excess traffic and the overflow of IRC channels. To defend
against this worm it is enough to load an updated anti-virus program,
install a personal firewall such as KasperskyR Anti-Hacker or use
long access passwords.

The defense against "Randon" has already been added to the
KasperskyR Anti-Virus databases.

A more detailed description of the "Randon" worm can be found in the
Kaspersky Virus Encyclopedia at:
http://www.viruslist.com/eng/viruslist.html?id=59741

2. Crv Deloder traga za slabim lozinkama
----------------------------------------------------------------------
Novi računarski crv koji se upravo pojavio na Internetu napada računare s
operativnim sistemom Windows i pokušava da otkrije manje komplikovane
lozinke administratorskog naloga, saopštilo je u ponedeljak nekoliko
antivirusnih kompanija.

Crv klasifikovan pod imenom W32/Deloder-A (Deloder), pojavio se u nedelju i
smatra se slabo infektivnim sudeći po upozorenju finske kompanije F-Secure
koja veruje da je Deloder poreklom iz Kine.

Crv nastoji da se poveže s drugim računarima na Mreži preko TCP ulaza broj
445, a nasumično generiše IP adrese u potrazi za ranjivim računarima.

Ulaz 445 se koristi za pristup deljenim datotekama na računarima koji rade
pod Windowsom a koriste protokol za prenos blokova serverskih poruka (Server
Message Block, SMB).

Crv nastoji da se prijavi kao administrator tako što isprobava pedeset
verovatnih lozinki kao što su "admin", "password", "12345" i
"administrator", navodi F-Secure.

Ukoliko uspe da "provali" lozinku crv na nekoliko mesta na računaru
instalira kopiju trojanskog konja poznatog pod imenom "inst.exe" a potom
menja i sadržaj baze Registry kako bi pokrenuo izvršavanje još jedne svoje
kopije čije je ime "DVLDR32.EXE", izveštavaju F-Secure, Sophos i Symantec.

Na udaru crva Deloder nalaze se računari koje koriste Windows 95, 98, NT,
2000, ME i XP, navodi Symantec.

Još nisu zabeležene brojnije infekcije jer većina programa u funkciji
zaštitniih zidova  onemogućava pristup ulazu 445. Bez obzira na to računari
koji nemaju zaštitni zid izloženi su pretnji novog crva.

Većina antivirusnih kompanija je već u ponedeljak ponudila nove definicije
virusa koje otkrivaju crva Deloder, kao i uslužne programčiće koji ga
uklanjaju s inficiranih mašina.

Ko još drži takve password-e??

Na udaru crva Deloder nalaze se računari koje koriste Windows 95, 98, NT,
2000, ME i XP, navodi Symantec


Znaci SVI Bas fino...  

W32/Deloder-A is a network worm and backdoor Trojan.

W32/Deloder-A attempts to logon to other computers on the local network via port 445 and if successful, copies itself as Dvldr32.exe and tries to install a backdoor Trojan component, inst.exe, to the startup folders:

\WINNT\All Users\Start Menu\Programs\Startup\,
\WINDOWS\Start Menu\Programs\Startup\ and
\Documents and Settings\All Users\Start Menu\Programs\Startup\inst.exe,

so that inst.exe is run automatically each time Windows is started.

The worm uses the valid utility Psexec.exe to remotely set the attributes for inst.exe and Dvldr32.exe to read only, to launch these files and to disable selected network shares.

When first run, the worm creates the following registry entry so that the worm executable is run automatically each time Windows is started:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\messnger
= <pathname of worm>

When the backdoor Trojan component inst.exe is run, it copies itself to the Fonts folder as explorer.exe and rundll32.exe, drops cygwin1.dll to the System32 folder and creates the following registry entries so that both explorer.exe and rundll32.exe are run automatically on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer =
C:\WINNT\Fonts\explorer.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TaskMan =
C:\WINNT\Fonts\rundll32.exe

W32/Deloder-A is designed to work primarily on Windows 2000/XP.