Weekly Virus Report – Kazoa Worm, NTRootkit Tool and Egrof Trojan

This week’s report looks at a Trojan calledEgrof, the ‘C’ variant of the Kazoa worm and the NTRootkit tool, used byhackers to hide their activity on the computers they attack.

Egrof saves, in a file called FLOG.TXT, the user name and password enteredby the user of the affected computer to access the America On Line (AOL)instant messaging service. Hackers can then use this information to accessthe connection accounts of the computer in which they have installed thisTrojan.

Egrof is very easy to recognize, as it simulates a connection to the AmericaOn Line (AOL) instant messaging service and returns an error message.

Today’s worm, Kazoa.C, also acts as a Trojan. It spreads rapidly via KaZaAand IRC. This virus is considered dangerous, as it opens a communicationsport in the affected computer (usually 31337) and sends the IP address andthe number of the open port to the attackers, leaving the computervulnerable to remote attacks.

Kazoa.C creates a large number of infected files whose names can refer toerotic photos of famous people or IT utilities in order to trick KaZaA usersinto downloading the infected files. It also creates a numerous copies ofitself on the hard disk, using up a large amount of the memory. Finally,Kazoa.C ends active processes related to antivirus, system and securityprograms and creates keys in the Windows Registry.

We are going to close this week’s virus report with NTRootkit, which onlyworks on machines with the operating systems Windows NT, 2000 or XPinstalled. After gaining remote access to a computer, the hacker installsthis tool on the affected machine. Then, the files DEPLOY.EXE and NTROOT.SYSare created in the Windows system directory.

There are different versions of NTRootkit that have different effects oncomputers. These include:

– It hides any file, process or entry in the Windows Registry that startswith _root_.

– It captures keystrokes, which allows hackers to find out data the userenters in the affected computer, such as the user name and password foraccessing certain services. However, due to a bug when NTRootkit captureskeystrokes in Windows NT computers, it can sometimes cause a fatal error,and therefore a Windows blue screen is displayed.

For further information about these and other viruses, visit Panda
Software’s Virus Encyclopedia at: http://www.pandasoftware.com/virus_info/