Newsgroup: it.comp.sicurezza.varie
Titolo: anti-bo version -----> from DR. SCHaFauSeN

ANTI-BO.txt version 0.1.2* Skip to there for quick instructions
 This file is intended to:
 1) Familiarize the populace with the trojan: Back Orifice
 2) Enable the reader to recognize if they are infected
 3) Show how to identify the pertinent files 4) Show how to delete them
 5) Explain the effects BO has on your system00 Table of Contents
   What is Back Orifice?...........................................01
   How does Back Orifice work?.....................................02
   Finding out if you are infected.................................03*
   Finding the Back Orifice files..................................04*
   Deleting the files..............................................05*
01 What is Back Orifice?
   Back Orifice was published by the Cult of the Dead Cow for the "benign"
   purpose of making a simple and efficient client/server relationship
   between two computers.
   Of course, we all know it's just another trojan, but with little to no
   knowledge, the average newbie hacker can take over your entire system
   and make it do their bidding.02 How does Back Orifice work?
   Imagine if you will.  A person, much like you or me, goes to the CDC
   website and downloads bo120.zip.  They unzip it, and read the readme.
   They simply rename boserve.exe (the trojan) to an innocent sounding name.
   Then they run BOCONFIG.  This gives them the following options:
    * When the trojan is run, what name to hide itself under
    * What port to open    * What registry name to us
    * An encryption password    * Plugin to run    * File to attach
   We really only need to be concerned about the first two, but I will dis-
   cuss the latter in a moment.
   Once boserve.exe (or innocent sounding name) is configured (btw, the
   name it can hide itself under can be any extension, so don't be looking
   for exe, com, dll, and vxd only) the person will either start sending it
   to people just like that, or they'll take apart legitimate zip files and
   add it to the setup routine.
   When you (the victim) receive the file, and are tricked into running it,
   here's what happens.
    1) Boserve looks at it's configuration, and extracts the full trojan
       under the name it's been told to use, and places it in
       C:\WINDOWS\SYSTEM (in this version, that's the default directory)
    2) Edits your registry and gives itself a valid name.
    3) Loads itself into memory and makes itself a lowend level program.
       (Loaded on startup, but not shown in Task Manager)
    4) Opens a listening port on your internet connection
   Once this is done, everytime you are on the net, you are a potential
   target.  DO NOT think that if you are not on irc you can't be hit.
   BO has a nifty addition which scans entire subnets, so if the "elite
   hacker" types in the first 3 sections of an ip, he can scan all 255
   people using it.03 -- Finding out if your infected
   If you skipped to this section, you are in a hurry.   1) Open a dos
prompt
   2) type: NETSTAT -a -n
      This will list all your connections and open ports.
      If you see an open UDP connection under the following criteria:
      1) The port of the UDP is 31337, 666, 411 (can be others, most common)
      or      2) The ip of the UDP is 0.0.0.0      You are infected.
      If you cannot access netstat.exe, arp.exe, or other network
identifying
      programs you are probably infected and the "hacker" has melted them.
      If you cannot use netstat, open FIND in Windows 95/98 and look for
      windll.dll (should be in C:\WINDOWS\SYSTEM
      Note that not all UDP connections with 0.0.0.0 mean you are infected,
      try to find someone in #backorifice who will scan you to make sure.
                             (Undernet)
04 -- Identifying the files that are ruining your life.
   There are several ways, the safest is to download anti-gen or something,
   but in all likelyhood, downloading a helper while being attacked on the
   net isn't the brightest thing in the world.   My main two methods:
   1) Search for the file windll.dll in C:\WINDOWS\SYSTEM, if you find it,
      use method two.
   2) Open FIND again, and set the directory for C:\WINDOWS\SYSTEM
      Go to Advanced, and put: bofile  in the search for text box.
   3) Open a dos prompt      Switch to C:\WINDOWS\SYSTEM       (CD SYSTEM)
      Type: DIR /OS /P and go down until you reach the sizes that are 124k
      Open the files and if you see a part that looks like this:
I/O control operation- not enough space for lowio initialization
- not enough space for stdio initialization- pure virtual function call
- not enough space for _onexit/atexit table- unable to open console device
- unexpected heap error- unexpected multithread lock error
- not enough space for thread data
      Then that file is one of the ones that need to be deleted.
      (Note that the above is included in many legitimate VC++ applications,
      so only delete the ones that are 123-125k)
05 -- Deleting the $&@*#itch BO files
  Most likely you cannot delete the files if you are running Windows, since
  that would be an access violation to kill a file in use.
  Restart in MS-DOS and blow away the files you've indentified.
  For the ms-dos illiterate, type del /? for deletion instruction
  WINDLL.DLL is a Back Orifice Library, delete it with prejudice.
  Registry:  Open your registry data by Start:Run  and the file name is
             regedit
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices
  Use your own discretion when deleting the values, please note that it is
  not actually necessary to delete them after deleting BO.  I urge you to
  use a professional program.
from DR. SCHaFauSeN

hai hai hai .. mi sento come un bruciore dietro!;-)))
  AIDS .. il primo sintomo .. e' un rumore dietro le spalle! hi hi hi