Trojaner "TR/Dldr.Small.23" nutzt "social engineering" wie Sober

Die neue Sicherheitslücke in Windows 2000 (MS05-039) wurde erst kürzlich "gestopft", weshalb genau vor einer Woche der Worm/Zotob so viele Computer infizieren konnte. Der neue Trojan-Downloader kommt mit einem Betreff, Body und Dateianhang und führt ahnungslose Benutzer in die Irre:

Die Charakteristiken der Email mit dem Trojaner:

Absender: "[email protected]" Betreff: "What You Need to Know About the Zotob.A Worm" Body: "What You Should Know About Zotob Published: August 14, 2005 | Updated: August 19, 2005 Severity VirusGreen

What the levels mean

Supported Software Affected
Windows All Version
Microsoft Security Advisory 899588
Zotob.A
Zotob.B
Zotob.C
Zotob.D
Zotob.E
Bobax.O
Esbot.A
Rbot.MA
Rbot.MB
Rbot.MC

Zotob is a worm that targets All Windows computers and takes advantage of a security issue that was addressed by Microsoft Security Bulletin MS05-039. This worm and its variants install malicious software, and then search for other computers to infect. Important If you have installed the update released with Security Bulletin S05-039, you are already protected from Zotob and its variants. If you are using any supported version of Windows, you are not at risk from Zotob and its variants. Use the Microsoft Windows Malicious Software Removal Tool to search for and remove the Zotob worm and its variants from your hard drive. This tool checks for and removes infections from Zotob.A through Zotob.E as well as Bobax.O, Esbot.A, Rbot.MA, Rbot.MB, and Rbot.MC. It also checks or and removes all versions of malicious software that the tool has been updat=d to remove.

Dateianhang: MS05-039.exe

Statt des besagten Sicherheitspatches ist diese Datei der Trojaner selbst. Der Trojaner lädt weiteren Schadcode von noktomaster.com aus dem Internet. Zum gegenwärtigen Zeitpunkt sei diese Datei noch nicht vollständig analysiert, so H+BEDV.