製品情報
導入事例
サービス
サポート
ダウンロード
セキュリティ情報
 
- 最新ウイルス一覧
- ウイルス検索
- 駆除ツール
- Daily DATリリースに関するFAQ
- ウイルス絵とき理解
- ウイルス画像事典
- ウイルス解析依頼
- ウイルス用語集
- ウイルスの危険度格付け
- セキュリティ対策のヒント
パートナー
会社案内
個人のお客様
中堅・中小企業のお客様
企業のお客様
製品アップグレード
評価版
セミナー・イベント
キャンペーン
サポートQ&A
お問い合わせ
Global Sites:
Home → セキュリティ情報 → ウイルス情報:K
ウイルス情報
ウイルス名危険度
W32/Kickin@MM
企業ユーザ:
個人ユーザ:
種別ワーム
最小定義ファイル
(最初に検出を確認したバージョン)
4262
対応定義ファイル
(現在必要とされるバージョン)
4262 (現在7512)
対応エンジン4.1.60以降 (現在5600) 
エンジンバージョンの見分け方
情報掲載日03/05/08
発見日(米国日付)03/05/07
駆除補足ウイルス駆除のヒント
概要ウイルスの特徴感染症状感染方法駆除方法
セキュリティ情報

最新ウイルス一覧へ >>
最新ウイルス
07/26Generic.dx!0...
07/26RDN/Generic....
07/26RDN/Generic....
定義ファイル・エンジンの
ダウンロード!
  定義ファイル:7512
 エンジン:5600
 
ウイルス検索
 


ウイルスの特徴TOPに戻る

・W32/Kickin@MMは、大量メール送信またはピアツーピアファイル共有ネットワークでの共有によって繁殖します。また、さまざまなウイルス対策製品やファイアウォール製品を無効にします。

・W32/Kickin@MMが実行されると、C:\WINDOWSディレクトリにCyberwolf.exeというファイル名で自身をコピーします。

・Windows Systemディレクトリにも、以下のファイル名で自身をコピーします。

  • Api Hooking-Tutorial.exe
  • Christina Aguilera-The most beautiful girl on earth.scr
  • FixSql.com
  • format.com
  • Hotmail Hacker.exe
  • Kernel32.exe
  • Last Summer.scr
  • Love.scr
  • Magical-Screensaver.scr
  • mapi32.drv
  • MsnMsgs.exe
  • OutWar Demo.exe
  • Q30215HOTFIX.pif
  • Saddam-the real pics.scr
  • SARS-Guide.scr
  • Setup.exe
  • Soccer Database.exe
  • Virtual Joke.scr

・以下のレジストリキーを改変して、.EXEファイルが実行されると、代わりに自身を読み込むようにします。

  • HKEY_CLASSES_ROOT\exefile\shell\open\command (デフォルト) = "C:\WINDOWS\System\Kernel32.exe%1 %* "

・以下のレジストリキーに、エントリ“Cyberwolf”および“Windows Kernel”を追加します(レジストリー値をC:\WINDOWS\SYSTEM\Kernel32.exeにして、Windowsを再起動するたびにW32/Kickin@MMを実行します)。

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

・KaZaaピアツーピアファイル共有ダウンロードフォルダを検索して、以下のファイルをコピーします。

  • Virus Creation ToolKit-VX v7.1_create virii with this tool,Klez.H and Sircam has been created with version 6.exe
  • WebAttack-DoS Tool.exe
  • FTP Cracker-2003(Crack the password of ANY FTP server with this tool!).exe
  • Yahoo Remote Password Cracker Deluxe 2003.exe
  • AIM Remote Password Cracker.exe
  • Hotmail Exploiter2003.exe
  • XNuker 2003.exe
  • Ultimate HackProg.exe
  • Msn Messenger Remote Password Cracker 2003.exe
  • Netbios hacker.exe
  • Chaos Ip Spoof 2003.exe

・以下のフォルダも検索します。

  • C:\Program Files\Morpheus\My Shared Folder
  • C:\Program Files\Bearshare\Shared
  • C:\Program Files\Edonkey2000\Incoming

・上記のいずれかのフォルダが存在する場合は、発見したフォルダに以下のファイルをコピーします。

  • Chaos Ip Spoof 2003.exe
  • Hotmail Exploiter 2003.exe
  • Msn Messenger Remote Password Cracker 2003.exe
  • Netbios hacker.exe
  • Ultimate HackProg.exe

・テキストファイルc:\windows\cyberwolf.txtを作成します。このファイルには、ウイルスの作成者からの情報が記載されています。

・MIRCが終了すると、スクリプトファイルを作成してIRCチャネルを介して自身を送信します。

・自身のSMTPエンジンを使用して、自身を大量メール送信します。電子メールアドレスは、ローカルマシン上のさまざまなアドレス帳やhtmlファイルから収集します。

・以下のような電子メールを送信します。

送信者:Admin@jokes.com
件名:The Virtual Joke...
本文:Have you seen it yet? You should because its soooooo funny,i wish the real jokes where that funny =:) Check out the attached screensaver and enjoy the pleasure of laughing...
添付ファイル: Virtual Joke.scr

送信者:Lovergirl963@hotmail.com
件名:Do you remember last summer?
本文: hi Do you remember we met last summer? We became very good friends at the end huh! Well i looked a bit over internet and i encountered your Email,so i thought why not send him the pics from last summer I've attached them in this email,there in ScreenSaver format,pls reply to me if you liked them See you soon again xxx Love ya...
添付ファイル: Last Summer.scr

送信者:webmaster@screensavers.com
件名: Fwd:Whats really happening in bagdad
本文: Someone of the britisch army has made some Secret Spy Cam pics,and uploaded it to the internet!! The pics show you exactly whats reall happened in Irak!Its really not what you've seen on tv! Check out the attached file and forward this to as much friends so that they can all see what has really happened in Irak. FlipBabe xxx
添付ファイル: Saddam-the real pics.scr

送信者:twistmaster13@hotmail.com
件名: Hi,i'm 100% sure i'm infected!
本文: mmm...if you received this mail,then someone has been infected with W32.CyberWolf.B@mm => a new massmailer worm. For every infection this worm does,you'll receive an email like this. It has never been my intention to cause your mailbox any harm,nor mailbomb it. Its just so that you can have a quite accurate view on how many infections..because most of the times,Av companies are miles away from the real number... .
添付ファイル:(no attachment)

送信者:Soccerfan@yahoo.com
件名: Fwd:Fwd:Fwd:Soccer...
本文: Ever wanted to see the best goals,the most beautiful freekicks etc.with just 2 clicks with your mouse? Ever wanted to acces the largest Soccer Database on the internet where all goals from more then 25 international competitions from the past 15 years are stored? Here is your chance,this program has instant acces it,so you can enjoy how Diego Maradonna scored ,or how Johan Cruyff curled that ball into the goal...Enjoy! The database contains goals from countries like:Spain,Italy,France,Germany,England,Belgium,The Netherlands,Sweden,Finland and much more Also forward this to all football fans you know so they can enjoy this to.
添付ファイル: Soccer Database.exe

送信者: Admin@hackers.com
件名: u wanted to hack?
本文: hi there,so you wanted to hack your friends hotmail account huh,well use this xss-exploit tool to find his password within 3 minutes!! Simply open it and enter your victims email ID and select This will also work on Yahoo and Icq accounts Admin@hackers.com
添付ファイル: Hotmail Hacker.exe

送信者:mailinglist@healthcare.com
件名: Watch out for SARS!
本文:SARS aka Severe Acute Respiration Syndrome is infecting more and more people every day Soon it will get to USA,Europe,Asia,Africa and Australia if we don't do something Thats why we started this chain letter with a single attachment Our mission is to make all people aware of the disease and to give them a handy guide on how to protect themselves The attachment(SARS-Guide) is a guide (like the name says;)) with instructions for avoiding infection and what to do when infected Ofcourse we cannot send this Guide to all people,thats why the WHO(World Health Organisation) has made a deal with WISI(World Internet Statistic Institute):For mail FORWARD of this email WITH the Guide,0.50US$ will be transfered to the WHO bank account They will use this money to make a vaccin for the SARS Virus,and thus help mankind If you want to participate to this project,and thus help mankind,you should FORWARD this email to at least 1 person with this Guide Attached Thas all you'll have to do Do,'t forget!Every FORWARD is 0.50US$ more for the vaccin,a vaccin is very expensive,so forward it if you want to participate in helping mankind! For more information contact: Dick Thompson - Communication Officer
添付ファイル:SARS-Guide.scr

送信者: Webmaster@beautifulgirls
件名: Christina Aguilera:The most beautiful girl on earth
本文: Don't you think Christina Aguilera is the most beautiful girl on earth? She is soo nice!!! That clip was amazing... If you wanne see some hidden pics of that videoclip then check out this screensaver Its nice...Very nice,if you get what i mean ;) Webmaster@beautifulgirls.com
添付ファイル: Christina Aguilera-The most beautiful girl on earth.scr

送信者:SecurityResponse@symantec.com
件名: Warning from Symantec.com
本文: 5/4/2003 A NEW INTERNET WORM HAS BEEN FOUND IN THE WILD A new very dangerous internet worm has been found in the wild.This worms goes under the name W32.SqlSlammer.C@mm and has the possibility to spread by several ports on your pc(139,25,445,446,10252). It will infect you without your knowlegde because it uses the Sql Buffer Overflow exploit.Because of this its very hard for Av companies and Microsoft to contain this thread.Thats why we decided to protect our customors by sending then SqlFix and thus protecting them from infection. After installation the fix will determine if the SqlSlammer.C has infected your pc and clean it.If it didn't infect it then it will make sure it will never infect you by closing the bug in your OS. Simply run the attached fix and wait for the dialog to prompt,select the feature and wait till its finished. Sincerely, Symantec Security Response Team Symantec Corporation
添付ファイル:FixSql.com

送信者:Webmaster@planet-source-code.com
件名: Api Hooking Tutorial...
本文: Did you wanted to learn how to api hook? Here your chance!This tutorial explains all the basics AND moderate Api Hookings Starting by hooking Registry Keys,Till hiding files from view in Windows Explorer After reading this tut you can even start Windows RootKit Programming but ofcourse thats up to you to decide... The Tutorial attached in this e-mail is for privat use only and may never be distributed under any curcumstances
添付ファイル: Api Hooking-Tutorial.exe

送信者:mailinglist@Msn.com
件名: Get the new Msn 5.1!
本文:Tired of the little nicknames in Msn,tired of all the limits? Well we've got news for you,Msn 5.1 is the newest and best msn messenger ever! It allows nicknames up to 500 characters and has many new functions who will make your cyberlife easyier and better! Msn Messenger 5.1 is avaible for following Operating Systems: Windows Xp Windows ME and 2000 Windows 98 and NT Is not avaible for:Windows 95 This version of msn messenger supports also Api's in Windows Xp so you can make your own addons. To download Msn Messenger 5.1 install the attached Root Setup. WARNING:MSN MESSENGER IS NOT AVAIBLE FOR DOWNLOAD AT OUR WEBSITE DUE TO = JURIDICAL RESTRICTIONS,IF YOU WANT IT YOU'LL HAVE TO INSTALL THE ROOT SETUP. If you don't want to install it then you'll have to wait for another 5 weeks because of the juridical restricions. Please do not forward this email.Every user who has Msn Messenger installed will receive this email sooner or later,so its up to them to decide to use the new version of not Sincerely yours: The Msn Messenger Team The Hotmail Team
添付ファイル:MsnMsgs.exe

送信者:Webmaster@Loveforlife.com
件名: Feel the reason why we fall in love...
本文: It takes One minute to find someone special One hour to like someone 1 Day to fall in love with someone But it takes a lifetime to forget someone. If you have ever been in love then you'll know about what i am talking. If you wanne have that same old feeling then open the lovescreensaver and realise why we fall in love all the time...
添付ファイル:Love.scr

送信者:webmaster@screensavers.com
件名: Saddam a live and kickin
本文: The whole world wants to know it,is saddam a live,or death? Well somedays a go the britisch took secret spy cam pics,and luckely someone has uploaded this pics to the internet,and now their avaible! You won't believe what you see!its amazing!!!The spy cam was hidden inside a tower in Bagdad and it took pics from saddam and his sons,they our 250m beneath the ground! Check out the pics i attached,you won't believe what you see!
添付ファイル: Saddam-the real pics.scr

送信者: Webmaster@Outwar.com
件名: Outwar is proud to present you:Outwar InterActive
本文:After beeing succesfull for quit some years now and having more then 20000 clients,it was time for something new. Thats why we decided to take our OutWar into the game market and developed OurWar InterActive This game will be in shops late summer and will cost about 36$. It will be avaible across the Usa,Europe,Australia and Asia.Our release for Africa is scheduled early 2004. Because this will mean a lot of waiting,we developed the first Official OutWar Int. Demo! The attached file contains Installation Packet for the downloader. Install it and download the game from our Private FTP servers,and then enjoy it on your home pc!. Sincerely yours Webmaster@outwar.com
添付ファイル: OutWar Demo.exe

送信者: Support@microsoft.com
件名: Windows Hotfix!
本文:Attached is the HotFix for several bugs in Windows Operating Systems. The following Windows versions are vulnerable: Windows Xp home and Pro edition (with/without SP1) Windows ME,2000 and NT Home and Pro Edition(With/without SP) Windows 98 Home,Pro and Special Edition(With/without SP) The following Windows Operating Systems are not vulnerable: Windows 95(All editions With or Without Sp Microsoft IIS(all versions) If your Operating System is one of the vulnerable systems listed above then Microsoft Corp. recommends you to install this HotFix If you for some reason didn't install this hotfix,then your pc will be vulnerable to this bugs allowing an attacker to Remote Control your pc,or beeing infected with the infamous SqlSlammer. Because this is an critical bug,Microsoft Corp. has send this HotFix to all of his customors who use one of the OS's. For more information about this bug or about Microsoft Corp.,please visit www.microsoft.com Presented to you by:Microsoft HelpDesk
添付ファイル: Q30215HOTFIX.pif

・以下のWebサイトに接続します。

  • www.indiansnakes.cjb.net.
  • www.christinaaguilera
  • www.brain-hack.com

以下の症状が見られる場合、このウイルスに感染している可能性があります。TOPへ戻る

・上記のファイルおよびレジストリキーが存在します。

感染方法TOPへ戻る

・W32/Kickin@MMは、SMTPメールおよびピアツーピアファイル共有を介して繁殖します。