Newsflood is a trojan with the purpose of posting vast amount of messages to certain usenet groups.
It is 7 kilobytes in size (28 uncompressed).
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
When executed it starts to post messages in an endless loop using 'news.hispeed.ch' as newsserver. It has functionality for supplying username and password combination on the server but that feature is not used. It is also capable of encoding itself in uuencode format that might be used to send the trojan along with the other messages. Fortunately this is also disabled. When communicating with the news server all the events are logged to a logfile called 'Starorbita.txt' in the same directory where the trojan is located.
The targeted newsgroups:
'news.admin.net-abuse.usenet' 'alt.binaries.nospam.teenfem.nonude' 'alt.2600' 'alt.binaries.pictures.erotica.male' 'alt.religion.scientology' 'alt.comp.virus' 'alt.hackers.malicious' 'alt.religion.christian' 'alt.politics.bush' 'alt.binaries.pictures.asparagus'
Each message is posted to two randomly chosen groups (sometimes to the same group twice).
The random meassages are created from the following components:
Sender adresses in the form 'jdavis@aol.com (Jack Davis)' using
First names:
'Neil Jack Frank Randy Keith Rick Timothy Mark Charlie Mike Gordon Joe Habib George Albert Herbert Roosevelt David Carl Nicholas Peter Shaniqua'
Last names:
'Black Rogers White Colt Smith Elm Bell Ash Walton Davis Carter Wilson Andrews Chung Elliott Harvey Brown Williams Todd Sawyer Jones Axelrod'
Domains:
'scientology.org' 'elsitio.com' 'EnlargeYourPenisToday.Com' 'netexplora.com' 'google.com' 'my-deja.com' 'yahoo.com' 'hotmail.com' 'aol.com' 'fed.rr.com' 'mailman.lanl.gov' 'nuddie.com' 'baldpussy.org' 'hairless.net' 'fuck-a-preteen.com' 'postmans0.tripod.com' 'fenvhs.org' 'pteens.net' 'nohairboys.com' 'nohairgirls.com' 'preteen-paradise.net' 'buddingtittys.com' 'tenyearolds.net' 'allvirgins.com' 'little-virgins.com'
Organization field:
'Martiza Internet Services' 'Disorganized' 'Amigo Org.' 'Wakkina Software' 'Executive Orifice of the President' 'The Christian Coalition' 'little or none at all' 'FBI-CIA-NSA-DOJ-MI5-AOL-TimeWarner, Inc.' 'Lbh unir gbb zhpu shpxvat serr gvzr' 'wHipcreme' 'Iggerbay Enispay' ' '
Subject line is constructed from:
'12-15 yo. girls on nuddie webcam' '13 y.o. webcam girls (nuddie) ' '12 - 13 yrs_old teen models UPDATED SITE' '12yo ICQ girls' '13 yo. webcam girls (1/1)' 'pteen chat grls (11-12yrs)' '10 yr/old babydoll tittys' 'NEW URL 12 yr. old Michelle 1/1' '10yrs. P-teen G1RLS? here:' 'Girls of 13-16' '14 yo_webcam girls' '15 yo. lolitas room' '13 y/o ICQ girl' '14yo daughter, nude asleep pics' 'Cindy 15 yrs_old'
A random string is appended to the subject line (up to 30 characters).
The trojan also adds the 'X-No-Archive: Yes' field to the header.
Message body contains a randomly chosen advertisment like this:
'take a look http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/ babydolls chatting nudy on IRC, mirc, dalnet'
followed by a fake random file name ('*.jpg') and a fake error message:
'Error: Specified file not found to attach!'
A couple of empty lines and random characters (up to 250) are closing the message.
An example of the possible messages:
From: CRogers@my-deja.com (Charlie Rogers) Subject: Girls of 13-16 y Newsgroups: alt.comp.virus,alt.comp.virus X-No-Archive: Yes Organization: NNTP-Posting-Host: 127.0.0.1 Message-ID: [3b065ceb$1@user.] Date: 19 May 2001 14:45:47 +0300 X-Trace: user. 990272747 127.0.0.1 (19 May 2001 14:45:47 +0300) Lines: 28 Path: user. Xref: user alt.comp.virus:3 young, babyface adolescents http://www.computer2030.com/miembro/schoolpervs free previews now improved new site !! view of pthc xxx FREE !Y.jpg Error: Specified file not found to attach!
It does not do anything to hide it's activity. Once it is started it runs until the next reboot.