*heads up* PWSteal.Navu trojan

Quote:

---

PWSteal.Navu is a Trojan Horse with keylogging capabilities.

The presence of the file Msdirectx.dll or Navupd.dll is an indication of a possible infection.

Type: Trojan Horse
Infection Length: 901,122 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, OS/2, UNIX

THREAT ASSESSMENT

Wild:

Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Moderate

Wild:
Low
Damage:
Medium
Distribution:
Low

Damage

Payload:
Releases confidential info: Intercepts keystrokes.

TECHNICAL DETAILS

PWSteal.Navu consists of a .dll file. Routines within the .dll are invoked using Rundll32.exe.

When PWSteal.Navu is executed, it performs the following actions:


Copies itself to the %Windir% directory as:

msdirectx.dll
navupd.dll

NOTE: %Windir% is a variable. The Trojan locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.


Adds the value:

"NAVUpd" = "rundll32.exe navupd.dll,Startup"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the Trojan starts when Windows starts.


Uses ICQ to send a notification to the Trojan's author that it is running.


Hooks keyboard events, allowing it to log keystrokes.


May display one of the following error messages while the Trojan is running:

"failed at address conversion"
"failed at socket creation"
"failed at startup"

---

For complete details visit:
http://securityresponse.symantec.com...teal.navu.html

Cheers,
BD]Hobbit

Ok ENOUGH!

Seriously dude, this is getting ****ing annoying. All you are doing is flooding the board with virus alerts. We can all go to the website ourselves and read up on the new virii. Sure it's raising your post count, but it's pissing the rest of us off.

Ok #1 regz, you could've asked nicely. I am not flooding the boards the virus section is meant to post info and viruses and such. No one else seems to be posting virus warnings either. but for your satisfaction and "happiness" of others, i will stop. Go read your own damn virus warnings, because i won't post them any more.

I prolly could have asked nicely but i'm in a bad mood.. I was supposed to babysit til 11 and i'm still here at 12:30.. so I apologize. Anyways you are flooding the board, look at the main page. People can't see anything else, because your posts are taking up all the top thread spots.. It's annoying.

Quote:

---

Originally posted here by HTRegz
Anyways you are flooding the board, look at the main page. People can't see anything else, because your posts are taking up all the top thread spots.. It's annoying.

---

LMAO indeed, this is tottally blocking my view on the main page filled with all the useless **** JAGUAR291's (or someone useing that account) ranting 'n raveing bullshit thats been going on lately while I was gone.

|The|Specialist jokeingly says: Oh man! Dude you tottaly covered up all the useless stuff with warning labels !!!OH NO!!! :p

BD, the warnings are nice, it's good to be able to get them right here, but next time, maybe you could just combine them all into one post. It's nice to have them here, and we appreciate the effort, it makes it nice for lazy people, but it is a little annoying to have nothing but virus warnings on the first page.

HT, I hope you're at least getting overtime :shocked:

Quote:

---

Originally posted here by debwalin
HT, I hope you're at least getting overtime :shocked:

---

hrm.. dinner, 30 bux, cab fare home and chips and ice cream and pink lemonaid for 4 hours of sitting in a house with internet access and cable tv, because the kid was in bed 5 minutes after the parents went out the door.... So I guess I kinda got overtime. It was a decent deal.

Beats the hell out of what I used to get babysitting, but considering the last time I did it was over 10 years ago...Good God, I'm glad I have family close-by that babysits for me when I need it, I couldn't afford to go out after paying the babysitter :p

Ok, how about i post three or four different virus warnings in one post, or should i just stop altogether?

BD]Hobbit > you could do that, or perhaps like one weekly post with the latest viri out for that week?

Lol then just name the topic *Heads up*

-my 2 cents :D

My Thought was..
One daily Heads up of Low Level Virus warnings..ie the Symantec Cat 1's, as some of these are only proof of concept.. the risk to the majority is low.. but the knowledge is helpful..

I had been posting the Cat2's and above.. normally as these Are more likley in the Wild..but .. not all of them, Cat 3's are in the wild and doing harm..

In the past 2 weeks I have found that a virus warning is posted almost anywhere on this site..

I'm pleased that someone else has the time to post these warnings.. Since Blaster et al I have been to darn busy to do to much.. and for 3 days I have not seen the AO home page.. i suspect due to Sobig.f.. (only way now is via a US based Proxy)

BD]Hobbit is eager to helpout and we shouldn't condem him.. we need to help him smooth his approach..
Oh and not everyone has a JS scripted page to keep them uptodate with 3 or so AV warning services.. so thats why I ever bothered.. help some annoy some.. thats life..

Cheers..

Or you can name a topic called *Heads up* and reply virus info to it daily....

Just a thought.

And one other thing... you don't have to post the ENTIRE virus warning. Make one post a day or every other day saying latest viruses, give a BRIEF discription of them, and then post links to the website.

Most people don't even need the virus warning because if you keep your Antivirus updated, then it isn't a concern. They are only useful when someone you konw gets a virus and you have to help them sort it out.

Quote:

---

Originally posted here by BD]Hobbit
Ok, how about i post three or four different virus warnings in one post, or should i just stop altogether?

---

I feel that you should take the advice of the concensus of the members who have replied in this thread. There are lots of other topics you could post about apart from you favourite. To other members , bear in mind that BD is only 13, and for some reason I imagine him as a little guy, but as I've said before he could be 6'4" and built like a brick S***house, anyway he is at least attempting to contribute some useful information to the community