Lame Aim Worm

Printable View

October 19th, 2005, 03:55 AM
Dr Toker

Lame Aim Worm

I got a message from some obscure, probobly random person on my buddy list, telling me to click here..i know the person the link came from (or at least i think i do)... so i click.. (I have already known by this time that the link is obviously not a real picture, as the IM described) so i choose to save it as a txt... instead of its default .COM.

So its prolly some MS-Dos file. I read the file as txt and cant find much.

Anyone else experience this?

I am going to attach the file as a txt. If you guys check it out maybe you can find a cure. As I was writing this, my girlfriend IMs me saying that she just got the same link, prior to me getting the message, and she opened the file.. which explains why i got the IM in the first place...i am just wondering what else it has done to her computer that she cant see..

BEWARE, dont put this back to .com and run it... it is live... and will do something you dont want it to do.
October 19th, 2005, 04:29 AM
manicintoxicant

Re: Lame Aim Worm

Quote:

Originally posted here by Dr Toker
I got a message from some obscure, probobly random person on my buddy list, telling me to click here..i know the person the link came from (or at least i think i do)... so i click.. (I have already known by this time that the link is obviously not a real picture, as the IM described) so i choose to save it as a txt... instead of its default .COM.

So its prolly some MS-Dos file. I read the file as txt and cant find much.

Anyone else experience this?

I am going to attach the file as a txt. If you guys check it out maybe you can find a cure. As I was writing this, my girlfriend IMs me saying that she just got the same link, prior to me getting the message, and she opened the file.. which explains why i got the IM in the first place...i am just wondering what else it has done to her computer that she cant see..

BEWARE, dont put this back to .com and run it... it is live... and will do something you dont want it to do.

I accidently ran it> (clicked the link that said "http://LifeyPicy.idleplay.net/show.php"). It seemed to go through each of the people on the buddy list and a window would come up and then close, figured it was some kind of worm. People started responding what is this, i just told them not to open it and apologized, the 'person' who accidently sent it to me had no clue. It seemed that closing aim and reopening it ended the sending, however I went back and looked at the file. It listed the file on my computer as "img552.com" . It's icon is an .exe and the type of file is MS-DOS Application. Set to autostart. Running Scans now and it seems to have found 12 virii so far. It starts itself again at setup. The power went out so, it seems to have multiplied. I'm totally guessing, there is nothing in all of google about this. That is wierd that it showed up on my boyfriends box as picture007 and img552 on mine... <shrugs> any ideas on how to make sure it's gone are welcome, Thanks
October 19th, 2005, 01:31 PM
CuseMMA

This is where the beauty of the mouseover comes into play. Whenever someone sends you a link mouseover the link and see where it points. Most of the time these worms are sloppy and show that the file points to a .scr file but just recently I got sent this same IM from someone that pointed to a PHP file. Most of these worms also rely on the fact that you're on AIM. Solution? Use Trillian. Also make sure you have UP TO DATE antivirus, a good spyware package and a good head on your shoulders. By that last part I mean you must have enough awareness not to click/open everything that comes your way even if its sent by someone you know. If you need help cleaning your PC I wrote a tutorial:

http://www.antionline.com/showthread...r=1#post837790
October 19th, 2005, 01:50 PM
phishphreek

My brother got hit by this less than a week ago. I know becuase I got a IM from him with similar link. I found over 10 different viruses and trojans on his PC along with a crap load of spyware. I finally kicked him off my LAN. This is at LEAST the 10th time he's crapped up his PC and I always have to deal with it. I figured... if he has no internet on that PC... he can't screw it up and I don't have to fix it.
October 19th, 2005, 02:47 PM
Spyder32

Bleh, thanks for the heads up. AIM's worms are starting to bug the crap out of me. I think I'm going to have to make some changes 'round here concerning that (like getting rid of AIM or finding a more secure version/app).

/me run's off like Batman to the Batmobile :D
October 19th, 2005, 04:12 PM
nihil

OK, this is what I got:

ArcaVir: Trojan.Rbot.Agh
Kaspersky: Backdoor.Win32.Rbot.agh
Nod32: Win32/Oscarbot.AN

Hope that helps :)
October 20th, 2005, 02:11 AM
Dr Toker

awesome, Yeah i figured since it was sent to me, others would have gotten this same deal. But with me, there was no link to a php script.. it was a direct link to the file.

What i was wondering... is how to decompile this file to see exactly what it does..obviously not as easy as renaming it as a .txt...
October 20th, 2005, 02:49 AM
nihil

Hi "MrHerb" :D

I believe that you can get a time limited trial of Winhex that has decompiling capabilities. Otherwise just google for "rbot.agh" and you will get links to AV company analyses of it. Kaspersky usually has quite detailed ones.

It looks like someone just snagged a copy of the bot and used a social engineering style of delivery?

:)
October 20th, 2005, 11:06 PM
manicintoxicant

http://www.trendmicro.com/vinfo/viru...TROJ_ROOTKIT.H ...
this is what it found ... seems to be ok now, thanks
October 21st, 2005, 04:01 AM
whizkid2300

yea... this thing has been going on for a little while. It seems like most end users just look at it and save it.

I was trying to get the source to it to check it out and see everything it does.
October 21st, 2005, 04:50 AM
manicintoxicant

Quote:

Originally posted here by whizkid2300
yea... this thing has been going on for a little while. It seems like most end users just look at it and save it.

I was trying to get the source to it to check it out and see everything it does.

i would like to see that source, i think it'd be interesting
October 21st, 2005, 05:36 AM
nihil

Hi guys,

I am afraid my last post was a little brief..........................like what I gave you were the ONLY three AVs that recognised it....................everything else thought it was OK :eek:

I am afraid that I do not have time at the moment to put it on a "labrat" and decompile it, or to go on the "darkside" and get the source.................if you do, please be careful............thanks

:)
October 21st, 2005, 09:10 AM
the_JinX

some assembly required

Couldn't get a good decompilation of this file..
Most decompilers just seem to sigsev on it.
Some did get some info out of it (mostly obscured)..

Did get something out of PEDasm
attached is the output (in a zip)..

It's not all that usefull with a copletely stripped binary like this..

Perhaps someone with IDApro or something can get more out of it..

(F-Secure detects the worm btw)