New Kazzaa Virus

There is a new Kazzaa virus out there.

W32/KWBot-A

Alias
W32.Kwbot.Worm, Worm.Win32.SdBot, W32/Moocow-A

Is it a worm wich uses the kazzaa network.

It copies itself as"explorer32.exe" in the windows systemfolder and creates 2 new
registry entries for running on system startup.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Explorer Update Build 1142 = explorer32

and

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Windows Explorer Update Build 1142 = explorer32

The worm infected the following files in the kazzaa network (examples only):

Star Wars Episode 2 - Attack of the Clones VCD CD1.exe
Spiderman The Movie - The Game.exe
Grand Theft Auto 3 CD1 ISO.exe
ZoneAlarm Firewall Pro.exe
Windows XP Professional iso.exe
Unreal Tournament cracked (works on all servers).exe
University Study Guide (cheat sheet).exe
Quicken Pro 2002 iso.exe
Perl Ultimate Study Guide.exe
Office XP Corporate Ed. iso.exe
Norton Utilities 2002.exe
Microsoft Visual C++ 7.0 iso.exe
MCSE Ultimate Study Guide.exe
Max Payne full iso.exe
Macromedia Flash 5.exe
Kazaa Advertisement Ad remover.exe
DSL Anonymizer.exe
DoS Attacker.exe
DivX Codec 6.0 beta (codec only).exe
Credit Card number generator VERIFIER (cc cc#).exe
cows gone wild.exe
100 XXX Passwords (verified 3-24-02).exe

Its possible that he attacker can control your infected system
with commands over IRC.

I hope my translation is not too bad, I got these informations
from the German Website of Sophos Antivir.

Thanks for the info monoton

it's me V-I-R-U-S

Kazaa is becoming a Virus. Used to love it, but now its nothing more than a huge inconvience.

Hey man thanks for the info..... Do you know if Norton AV will detect it...?..or any other AntiVirus prog

Thanx

Quote:

---

Originally posted here by kewlphatdude
Do you know if Norton AV will detect it...?..or any other AntiVirus prog

Thanx

---

I got this info from Sophos, I also found the English version,
http://www.sophos.com/virusinfo/anal...32kwbota.html,
there you can download the update for Sophos AntiVir.

Im sure other AntiVirus software developers will provide updates in the next days.

"W32.Kwbot.Worm has backdoor Trojan capability, which allows a hacker to gain control of the compromised computer. The worm can update itself by checking for newer versions over the Internet. W32.Kwbot.Worm disguises itself as popular movie, game, or software files, and it attempts to spread across KaZaA file-sharing networks by tricking KaZaA users into downloading the program and opening it. "

That is from Norton website and also said the protection is on the virus definition dated on June 19 so I guess is not that new... I used Norton CE and works. Virus definition 7/8/2002 Rev 5

>>Shakes head<< Yeah, KaZaA is gonna get worse before it gets better. Just like with other warez an unknown sources, there is always that "off chance" files could be infected, it is best not to even mess with it, IMHO.

I am sure more virii for p2p systems will be developed, and for those who continue to download: Save everybody the heartache of virii and make sure you scan, scan, scan for virii before sharing! Also, p2p could also be a great breeding ground for new and unusual backdoors, so careful out there...

OOOooooOO.....well isn't that a suprise, If you could infect an Mp3 Nappster would have done the same.....
This is getting really stupid, I dono y ppl still use it.

- Noia

Yeah I know it is becoming beyond a joke now, every day a new virus is on it

Never download .exe with p2p like kazaa/morpheus or others!

Well, i'm sure we all know the risks of downloading from and unknown source, the result is being infected by an unknown virus that you can't contain, yet still downloading files from that source.. It's pointless and meaningless, you might as wel go out and acuallyspend your money instead of going on those bogus file servers that only produce and duplicate viruses.. Therefore, your responsible for what you download, if your computers harddrive melts, your only have one person to blaim, the person that made that virus..

I've already got five quarantined viruses in my norton and it isn't even the popular viruses in kazaa. I just suggest having something monitor your major files and registry just in case. Roxio's GoBack would help also. If you do want to get the programs then for the registry is agnitums Jammer. GoBack does help especially if you are prone to getting a lot of errors and viruses.

My friend uses kaaza all the time to download games and movies, he can not be bothered to save up a little bit of money and buy them whist I prefer to buy the proper thing, every few weeks I get a phone call saying help I'v got a virus again!

if you just pay ATTENTION to what you download i.e. if most of the files are 156,398,428 bytes, then you should probably download one thats that size instead of downloading one that is 156,401,263 bytes. sure it could just be some extra credits or extra black at the beginning or end of the movie but its unlikely. my advice? just quit using kazaa and if you run windows, use WinMX, if you use *nix then download limewire, you can get those at http://p2ptransfers.com/filelist.htm they've got more but those are the best ones ive found for their respective OS's.

Quote:

---

Originally posted here by mrcoffee12
if you just pay ATTENTION to what you download i.e. if most of the files are 156,398,428 bytes, then you should probably download one thats that size instead of downloading one that is 156,401,263 bytes.

---

Avery good point. Just use some common sense and makes sure all .exe files are scanned before being launched.....

Yea fakeboy is right all kazzaa and morpheus has is virus' and trojans so be careful!!!!!!!! :eek:

Hello people. I am new to these file sharing programs. I know you have talked about Kazza and how vulnerable our systems are to viri threads.

What have been your experienced with Imesh?

Based on what you have said about Kazaa p2p file sharing, I assume it wouldn't be any diffence with iMesh since I would assume these two programs may shared the same codes functionality and downloading a virus could be as easy as downloading with Kazaa.

What can you expand on this issue?

wow thanks man for the look out. time to delete KaZaA and use a different P2P program. Off to imesh or morpheus

It really doesn't matter what P2P software you use, each has their own "issues". Plus it's Peer to Peer software... meaning if the person you are connecting into has a virus, then the files you are downloaded are probably infected... meaning you get the virus. There are always risks with any P2P software out there, not just Kazaa.

Personally though I think Kazaa is the best sofrware out there, as of now. I find most of what I need on tehre. But I also keep very up-to-date with my virus defs and keep an eye on new viruses, worms, etc.

~ My 2 cents...

AciDriveHB is right, you need to watch your P's & Q's when it comes to P2P...it can be very dangerous...sometimes, when I NEED an exe...I run it off a dummy system. One I can just re-ghost if anything happens. But then, I'm just paranoid. I'd rather be safe, then sorry. When it comes to games..ect...ect...ect..just go buy it...give homage to the poor souls who lived off cigarettes and coffee to program it.

Guess it's up to the various intelligence og the people using P2P proggies... personally i would scan any .exe file i'd downloaded before executing it... If it's rancid.. i'd just discard it! But then again... it's a free world!