CastleCops® - Virus Report - Kazoa Worm, NTRootkit Tool and Egrof Trojan

This week's report looks at a Trojan calledEgrof, the 'C' variant of the Kazoa worm and the NTRootkit tool, used byhackers to hide their activity on the computers they attack.

Egrof saves, in a file called FLOG.TXT, the user name and password enteredby the user of the affected computer to access the America On Line (AOL)instant messaging service. Hackers can then use this information to accessthe connection accounts of the computer in which they have installed thisTrojan.

Egrof is very easy to recognize, as it simulates a connection to the AmericaOn Line (AOL) instant messaging service and returns an error message.

Today's worm, Kazoa.C, also acts as a Trojan. It spreads rapidly via KaZaAand IRC. This virus is considered dangerous, as it opens a communicationsport in the affected computer (usually 31337) and sends the IP address andthe number of the open port to the attackers, leaving the computervulnerable to remote attacks.

Kazoa.C creates a large number of infected files whose names can refer toerotic photos of famous people or IT utilities in order to trick KaZaA usersinto downloading the infected files. It also creates a numerous copies ofitself on the hard disk, using up a large amount of the memory. Finally,Kazoa.C ends active processes related to antivirus, system and securityprograms and creates keys in the Windows Registry.

We are going to close this week's virus report with NTRootkit, which onlyworks on machines with the operating systems Windows NT, 2000 or XPinstalled. After gaining remote access to a computer, the hacker installsthis tool on the affected machine. Then, the files DEPLOY.EXE and NTROOT.SYSare created in the Windows system directory.

Article source and further details:

Help Net Security


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 156ppm 0.118s (0.005s) Making cybercriminals unhappy since 2002*