Signature Detail

TROJAN: QAZ Calling Home on TCP/25

This signature detects the string "nongmin_cn" within an SMTP header-from field sent from a remote system to local server port 25. This can indicate an attacker is attempting to access the Trojan/Worm QAZ. The QAZ Trojan/Worm, famous for infecting the Microsoft network October 2000, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems.

Extended Description

Qaz is a worm. It spreads via NetBIOS, modifies the registry, changes the Notepad executable file, and opens a backdoor for further attacks.

References

• CVE: CVE-1999-0660
• URL: http://secunia.com/virus_information/2514
• URL: http://www.f-secure.com/v-descs/qaz.shtml
• URL: http://vil.nai.com/vil/content/v_98775.htm