PE_MABEZAT.B-O

Infiziert dadurch, dass der eigene Code an die Zielhostdateien angehängt wird.

Verbreitet sich über Freigabenetzwerke und schleust Eigenkopien in verfügbare Netzwerke ein. Legt eine AUTORUN.INF-Datei ab, um automatisch die eingeschleusten Kopien auszuführen, wenn ein Benutzer auf die Laufwerke eines betroffenen Systems zugreift.

Installation

Schleust folgende Dateien/Komponenten ein:

• %System Root%\Documents and Settings\tazebama.dll - detected as WORM_MABEZAT.AW
• %User Profile%\Application Data\tazebama\tazebama.log - contains logs
• %User Profile%\Application Data\tazebama\zPharaoh.dat - contains logs

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.. %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000, XP und Server 2003.)

Schleust die folgenden Eigenkopien in das betroffene System ein:

• %System Root%\Documents and Settings\hook.dl_
• %System Root%\Documents and Settings\tazebama.dl_

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Erstellt die folgenden Ordner:

• %User Profile%\Application Data\tazebama

(Hinweis: %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000, XP und Server 2003.)

Andere Systemänderungen

Ändert die folgenden Registrierungseinträge:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

Löscht die folgenden Registrierungsschlüssel:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun =

Dateiinfektion

Infiziert die folgenden Dateitypen:

• .lnk
• .scr
• .exe

Infiziert dadurch, dass der eigene Code an die Zielhostdateien angehängt wird.

Verbreitung

Verbreitet sich über Freigabenetzwerke und schleust Eigenkopien in verfügbare Netzwerke ein.

Legt eine AUTORUN.INF-Datei ab, um automatisch die eingeschleusten Kopien auszuführen, wenn ein Benutzer auf die Laufwerke eines betroffenen Systems zugreift.

Die besagte .INF-Datei enthält die folgenden Zeichenfolgen:

[AutoRun]
ShellExecute=zPharaoh.exe
shell\open\command=zPharaoh.exe
shell\explore\command=zPharaoh.exe
open=zPharaoh.exe

Verhindert das Versenden von E-Mail-Nachrichten an Adressen, die diese Zeichenfolgen enthalten:

• Microsoft
• Kasper
• Panda

Sendet die folgenden Nachrichten:

Subject: ABOUT PEOPLE WITH WHOM MATRIMONY IS PROHIBITED
Message Body: 1 : If a man commits adultery with a woman, then it is not permissible for him to marry her mother or her daughters.
2 : If a woman out of sexual passion and with evil intent commits sexual intercourse with a man, then it is not permissible for the mother or daughters of that woman to merry that man. In the same way, the man who committed sexual intercourse with a woman, because prohibited for her mother and daughters.
Download the attached article to read.
Attachment: PROHIBITED_MATRIMONY.rar

Subject: Windows secrets
Message Body: The attached article is on
how to make a folder password
. If your are interested in this article download it, if you are not delete it.
Attachment: FolderPW_CH(1).rar

Subject:Canada immigration
Message Body: The debate is no longer about whether Canada should remain open to immigration. That debate became moot when Canadians realized that low birth rates and an aging population would eventually lead to a shrinking populace. Baby bonuses and other such incentives couldn't convince Canadians to have more kids, and demographic experts have forecasted that a Canada without immigration would pretty much disintegrate as a nation by 2050.
Download the attached file to know about the required forms.
The sender of this email got this article from our side and forwarded it to you.
Attachment: IMM_Forms_E01.rar

Subject: Viruses history
Message Body: Nowadays, the viruses have become one of the most dangerous systems to attack the computers. There are a lot of kinds of viruses. The common and popular kind is called
Trojan.Backdoor
which runs as a backdoor of the victim machine. This enables the virus to have a full remote administration of the victim machine. To read the full story about the viruses history since 1970 download the attached and decompress It by WinRAR.
The sender has red the story and forwarded it to you.
Attachment: virushistory.rar

Subject:Web designer vacancy
Message Body: Fortunately, we have recently received your CV/Resume from moister web site
and we found it matching the job requirements we offer.
If your are interested in this job Please send us an updated CV showing the required items with the attached file that we sent.
Thanks
Regards,
Ajy Bokra
Computer department.
AjyBokra@webconsulting.com
Attachment: JobDetails.rar

Subject: MBA new vision
Message Body: MBA (Master of business administration ) one of the most required degree around the world. We offer a lot of books helping you to gain this degree. We attached one of our .doc word formatted books on
Marketing basics
to download.
Our web site http://ww w.tazeunv.edu.cr/mba/info.htm
Contacts:
Human resource
Ajy klaf
AjyKolav@tazeunv.com
The sender has added your name to be informed with our services.
Attachment: Marketing.rar

Subject: problemo
Message Body: When I had opened your last email I received some errors have been saved in the attached file.
Please inform me with those errors as soon as possible.
Attachment: utlooklog.rar

Subject: hi
Message Body: notes.rar
Unfortunately, I received unformatted email with an attached file from you. I couldn't understand what is behind the words.
I wish you next time send me a readable file!.I forwarded the attached file again to evaluate your self.
Attachment: doc2.rar