Classification

Category :

Malware

Type :

Trojan

Aliases :

NewsFlood, Win32/NewsFlood.7168.A, Trojan.Win32.NewsFlood

Summary

Newsflood is a trojan with the purpose of posting vast amount of messages to certain usenet groups.

It is 7 kilobytes in size (28 uncompressed).

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

When executed it starts to post messages in an endless loop using 'news.hispeed.ch' as newsserver. It has functionality for supplying username and password combination on the server but that feature is not used. It is also capable of encoding itself in uuencode format that might be used to send the trojan along with the other messages. Fortunately this is also disabled. When communicating with the news server all the events are logged to a logfile called 'Starorbita.txt' in the same directory where the trojan is located.

The targeted newsgroups:

'news.admin.net-abuse.usenet'
'alt.binaries.nospam.teenfem.nonude'
'alt.2600'
'alt.binaries.pictures.erotica.male'
'alt.religion.scientology'
'alt.comp.virus'
'alt.hackers.malicious'
'alt.religion.christian'
'alt.politics.bush'
'alt.binaries.pictures.asparagus'

Each message is posted to two randomly chosen groups (sometimes to the same group twice).

The random meassages are created from the following components:

Sender adresses in the form 'jdavis@aol.com (Jack Davis)' using

First names:

'Neil Jack Frank Randy Keith Rick Timothy Mark Charlie Mike
 Gordon Joe Habib George Albert Herbert Roosevelt David
 Carl Nicholas Peter Shaniqua'

Last names:

'Black Rogers White Colt Smith Elm Bell Ash Walton Davis
 Carter Wilson Andrews Chung Elliott Harvey Brown Williams
 Todd Sawyer Jones Axelrod'

Domains:

'scientology.org'
'elsitio.com'
'EnlargeYourPenisToday.Com'
'netexplora.com'
'google.com'
'my-deja.com'
'yahoo.com'
'hotmail.com'
'aol.com'
'fed.rr.com'
'mailman.lanl.gov'
'nuddie.com'
'baldpussy.org'
'hairless.net'
'fuck-a-preteen.com'
'postmans0.tripod.com'
'fenvhs.org'
'pteens.net'
'nohairboys.com'
'nohairgirls.com'
'preteen-paradise.net'
'buddingtittys.com'
'tenyearolds.net'
'allvirgins.com'
'little-virgins.com'

Organization field:

'Martiza Internet Services'
'Disorganized'
'Amigo Org.'
'Wakkina Software'
'Executive Orifice of the President'
'The Christian Coalition'
'little or none at all'
'FBI-CIA-NSA-DOJ-MI5-AOL-TimeWarner, Inc.'
'Lbh unir gbb zhpu shpxvat serr gvzr'
'wHipcreme'
'Iggerbay Enispay'
' '

Subject line is constructed from:

'12-15 yo. girls on nuddie webcam'
'13 y.o. webcam girls (nuddie) '
'12 - 13 yrs_old teen models UPDATED SITE'
'12yo ICQ girls'
'13 yo. webcam girls (1/1)'
'pteen chat grls (11-12yrs)'
'10 yr/old babydoll tittys'
'NEW URL 12 yr. old Michelle 1/1'
'10yrs. P-teen G1RLS? here:'
'Girls of 13-16'
'14 yo_webcam girls'
'15 yo. lolitas room'
'13 y/o ICQ girl'
'14yo daughter, nude asleep pics'
'Cindy 15 yrs_old'

A random string is appended to the subject line (up to 30 characters).

The trojan also adds the 'X-No-Archive: Yes' field to the header.

Message body contains a randomly chosen advertisment like this:

'take a look
 http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
 babydolls chatting nudy on IRC, mirc, dalnet'

followed by a fake random file name ('*.jpg') and a fake error message:

'Error: Specified file not found to attach!'

A couple of empty lines and random characters (up to 250) are closing the message.

An example of the possible messages:

From: CRogers@my-deja.com (Charlie Rogers)
Subject: Girls of 13-16 y
Newsgroups: alt.comp.virus,alt.comp.virus
X-No-Archive: Yes
Organization:
NNTP-Posting-Host: 127.0.0.1
Message-ID: [3b065ceb$1@user.]
Date: 19 May 2001 14:45:47 +0300
X-Trace: user. 990272747 127.0.0.1 (19 May 2001 14:45:47 +0300)
Lines: 28
Path: user.
Xref: user alt.comp.virus:3
young, babyface adolescents
http://www.computer2030.com/miembro/schoolpervs
free previews
now improved new site !! view of pthc xxx FREE !Y.jpg
Error: Specified file not found to attach!

It does not do anything to hide it's activity. Once it is started it runs until the next reboot.