Andr0m3da
25-05-2002, 17:17
Three computer worms are described in this week's
report on malicious code: Spida.B, W32/Kazoa and VBS/Chick.E.
Spida.B spreads through servers with the Microsoft SQL application installed
and whose system administrator account is not password protected. For this
reason, machines that have not been correctly protected -by default the
administrator account is not password-protected after installation- could be
infected by this worm. Spida.B is also designed to obtain passwords from the
affected computer and send them to an e-mail address with a file called
"Send.txt".
W32/Kazoa is a worm that spreads through the file-swapping application
"Kazaa" and uses the name of a well-known computer game, film or music file
to disguise itself and trick users into downloading the worm to their
computers. After getting into a computer, Kazoa generates a large number of
files infected with its code and 3,083 copies of itself in the folder
"%Windows%\Temp\sys32", adding unusable data in order to increase the file
size. In order to ensure that it is run every time the computer is started
up, this worm modifies an entry in the Windows Registry in the affected
computer.
;)
report on malicious code: Spida.B, W32/Kazoa and VBS/Chick.E.
Spida.B spreads through servers with the Microsoft SQL application installed
and whose system administrator account is not password protected. For this
reason, machines that have not been correctly protected -by default the
administrator account is not password-protected after installation- could be
infected by this worm. Spida.B is also designed to obtain passwords from the
affected computer and send them to an e-mail address with a file called
"Send.txt".
W32/Kazoa is a worm that spreads through the file-swapping application
"Kazaa" and uses the name of a well-known computer game, film or music file
to disguise itself and trick users into downloading the worm to their
computers. After getting into a computer, Kazoa generates a large number of
files infected with its code and 3,083 copies of itself in the folder
"%Windows%\Temp\sys32", adding unusable data in order to increase the file
size. In order to ensure that it is run every time the computer is started
up, this worm modifies an entry in the Windows Registry in the affected
computer.
;)