|
|
| BASSO |
Alias: |
W32/Bagle.AC@MM |
| |
Tipo: |
Internet Worm |
| |
Dimensione: |
18,432 bytes |
| |
Piattaforma: |
Microsoft Windows 9x/ME/NT/2000/XP/2003 Server |
| |
|
|
| |
Descrizione: |
Worm/Bagle.AC is an Internet worm that tries to spread via network connection TCP 2535 with the following IP addresses:
12.*.*.*
127.*.*.1
141.*.*.*
144.*.*.*
150.*.*.*
165.*.*.*
168.*.*.*
195.*.*.*
198.*.*.*
199.*.*.*
200.*.*.*
203.*.*.*
204.*.*.*
205.*.*.*
206.*.*.*
207.*.*.*
208.*.*.*
209.*.*.*
210.*.*.*
211.*.*.*
212.179.*.*
212.199.*.*
213.*.*.*
216.*.*.*
217.*.*.*
218.*.*.*
220.*.*.*
221.*.*.*
24.*.*.*
38.112.*.*
38.113.*.*
38.115.*.*
38.118.*.*
38.119.*.*
4.*.*.*
61.152.*.*
61.172.*.*
61.220.*.*
61.231.*.*
61.236.*.*
61.59.*.*
61.64.*.*
62.*.*.*
63.*.*.*
64.132.*.*
64.191.*.*
64.201.*.*
64.223.*.*
64.251.*.*
64.27.*.*
64.5.*.*
65.*.*.*
66.*.*.*
67.108.*.*
67.164.*.*
67.17.*.*
67.172.*.*
67.18.0.*
67.18.20.*
67.18.46.*
67.18.3.*
67.18.65.*
67.18.66.*
67.61.*.*
67.68.*.*
67.70.*.*
67.71.*.*
67.73.*.*
67.86.*.*
68.*.*.*
69.10.*.*
69.115.*.*
69.13.*.*
69.22.*.*
69.132.*.*
69.145.*.*
69.148.*.*
69.199.*.*
69.22.*.*
69.27.*.*
69.29.*.*
69.31.*.*
69.41.*.*
69.42.*.*
69.44.*.*
69.46.*.*
69.56.132.*
69.56.160.*
69.56.165.*
69.56.171.*
69.56.172.*
69.56.180.*
69.56.181.*
69.56.183.*
69.56.184.*
69.56.187.*
69.56.189.*
69.56.195.*
69.56.197.*
69.56.201.*
69.56.202.*
69.56.203.*
69.56.206.*
69.56.209.*
69.56.213.*
69.56.218.*
69.56.225.*
69.56.226.*
69.56.228.*
69.56.238.*
69.56.239.*
69.56.240.*
69.56.244.*
69.56.244.*
69.56.255.*
69.59.130.*
69.59.156.*
69.60.*.*
69.64..*.*
69.71.*.*
69.90.*.*
69.93.101.*
69.93.114.*
69.93.117.*
69.93.123.*
69.93.137.*
69.93.139.*
69.93.161.*
69.93.169.*
69.93.201.*
69.93.202.*
69.93.207.*
69.93.211.*
69.93.218.*
69.93.235.*
69.93.241.*
69.93.242.*
69.93.244.*
69.93.252.*
69.93.32.*
69.93.35.*
69.93.5.*
69.93.51.*
69.93.52.*
69.93.54.*
69.93.60.*
69.93.62.*
69.93.68.*
69.93.94.*
69.93.96.*
80.*.*.*
81.*.*.*
82.*.*.*
83.*.*.*
64.235.248.237
64.235.248.242
64.235.248.37
64.235.248.38
64.235.248.48
64.235.248.54
64.235.248.56
1.2.3.4
Please note: Sending via e-mail fails.
If executed, the worm copies itself in the \windows\%system% directory under the filename "irun4.exe". The following files will also get created in the %system% directory:
- C:\Windows\system32\system.exe
- C:\Windows\system32\iinj4.exe
- C:\Windows\system32\ban_list.txt |
| |
Consigli: |
|
| |
|
|
| |
Link Utili: |
http://punto-informatico.it/salvapc/index.asp |
| |
|
http://www.centralcommand.com/virus_descriptions.html |
|
|
|
|
|
| |
|
|
|
|
|
|
|
|
