VIRUSES & WORMS — THE HEADLINES

 2002/2/21 

W32/Yarner

 2002/2/04 

W32.Whitebait@mm

 2002/1/28 

W32.Myparty@mm

 2002/1/22 

W32/Maldal-F

 2002/1/18 

W32.Klez.E@mm

VIRUSES & WORMS — THE LINKS

• "e-virus scanner" active filtering program for mail server by PT. IndoInternet

  Disclaimer: These hyper-links can be placed by visitors of this site. The link, the description and the content of the linked pages do not fall under the responsibility of the SYS-2064 editors and do not represent their opinion. The editors may modify or delete any entries.

VIRUSES & WORMS — THE NEWS

2002/2/21

11:37 +0100

W32/Yarner

[Viruses & Worms] W32/Yarner alias W32/Yaw, W32/Yarner-A, W32/Yarner-B, Worm/Yarner, Win32.Yarner.A@mm, W32/YAWsetup, WORM_YARNER.B is an internet worm which uses its own SMTP routines to send email messages. The worm attempts to send itself to email addresses found on infected machines and in the Microsoft Windows address book. The email mimics the appearance of a well-known German anti-trojan newsletter and has the following characteristics: Subject Trojaner-Info Newsletter [Date]. Attachment: yawsetup.exe.

The body reads:

Hallo !

Willkomen zur neuesten Newsletter-Ausgabe der Webseite Trojaner-Info.de.

Hier die Themen im Ueberblick:

1. YAW 2.0 - Unser Dialerwarner in neuer Version

Viele haben ihn und viele moegen ihn - unseren Dialerwarner YAW. YAW ist nun in einer brandneuen und stark erweiterten Version verfuegbar. Alle unsere Newsletterleser bekommen ihn kostenlos zusammen mit diesem Newsletter. Also einfach die angehaengte Datei starten und YAW 2.0 installieren. Bei Fragen steht Ihnen der Programmierer des bislang einzigartigen Programmes Andreas Haak unter [email protected] zur Verfügung. Viel Spaß mit YAW!
(...)

W32/Yarner renames notepad.exe in the Windows directory to notedpad.exe and copies itself to notepad.exe. It creates a randomly named file with an .EXE extension in the Windows directory and changes a registry key so that the worm file runs on Windows startup. After a period of running on the system, the worm executes its destructive payload and attempts to delete all files from the hard drive. :: [dre].

Comments (0)

2002/2/04

09:46 +0100

W32.Whitebait@mm

[Viruses & Worms] W32.Whitebait@mm is a mass-mailing email worm, reported in the wild by Symantec. If it is executed, it searches for email addresses on the computer and sends an email message to all of the addresses that it finds by searching all .htm, .html, .php, .asp, and Readme.txt files on the computer.

The worm replicates using its own SMTP engine by sending email to the addresses that it previously retrieved. The email message has the following characteristics: Subject WARNING : Black_Piranha, message Si vous pouvez lire cet e-mail, c'est que les services Microsoft on détecter la présence du virus Black_Piranha dans votre système Windows. pour désinfecter votre système vous n'avez qu'a exécuter le programme en piece jointe. Pour plus d'informations : http:/ /www.microsoft.com. Attachment: MSsecu.exe (This is the host application; it is 618 KB in size) To trick the recipients to trust this mail, it spoofs the sender address "[email protected]"

W32.Whitebait@mm consists of two parts: the host program and the worm component. Both the host program and the worm component are UPX-compressed Delphi applications. The host program can be spread by IRC channels as a program that displays pornographic pictures. When it is run, it copies itself as \Windows\MSsecu.exe and displays the pictures. It then drops the worm component as \Windows\WinSystem.exe and runs the worm.

The worm component of W32.Whitebait@mm adds a value to the registry. It then searches all .htm, .html, .php, .asp, and Readme.txt files on the computer for email addresses that it will use for replication. The retrieved email addresses are stored in the text file \Windows\Bdm.com // c.f. golem.de :: [dre].

Comments (0)

2002/1/28

14:07 +0100

W32.Myparty@mm

[Viruses & Worms] Symantec and McAfee report the epidemic of a new mass-mailing worm named W32.Myparty@mm. The worm arrives via email with the following characteristics: Subject: new photos from my party! Body: Hello! My party... It was absolutely amazing! I have attached my web page with new photos! If you can please make color prints of my photos. Thanks! Attachment name: www.myparty.yahoo.com

The worm searches through the Windows Address Book (used by Microsoft Outlook (Express)) and through files with the extension .DBX, which are Microsoft Outlook Express folders and inboxes.

The worm uses its own SMTP engine to send out mails to the SMTP server configured on the machine. As further analyses are underway, no destructive payload is yet been reported. // c.f. golem.de :: [dre].

Comments (0)

2002/1/22

11:32 +0100

W32/Maldal-F

[Viruses & Worms] W32/Maldal-F is a worm which uses Microsoft Outlook to send itself to everyone in the Outlook address book. The email will have the following characteristics: Happy New Year. Message text: Hii // I can't describe my feelings // But all I can say is happy New Year :) bye. Attached file: Christmas.exe

When first run the worm copies itself to the Windows folder as Christmas.exe and creates a registry entry so that this file is run automatically each time the computer is restarted.

The worm then disables the keyboard and also changes the computer name by setting a registry key and the default browser start page. // c.f. Sophos :: [dre].

Comments (1)

2002/1/18

16:16 +0100

W32.Klez.E@mm

[Viruses & Worms] W32.Klez.E@mm is similar to W32.Klez.A@mm. It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses random subject lines and message bodies, according to analyses by Symantec.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. Information and a patch for the vulnerability can be found at MS01-020.

The worm drops a virus similar to W32.ElKern.3326, and it attempts to disable some common antivirus products. In addition, the worm will infect executable files by prepending itself to the infected files.

The worm attempts to disable on-access virus scanners and some previously distributed worms (such as W32.Nimda and CodeRed) by stopping any active processes. The worm copies itself to local, mapped, and network drives. The worm copies itself as a random file name with a double extension such as filename.txt.exe. In addition, the worm copies itself as a .rar archive with a double extension, for example filename.txt.rar.

In addition, the worm searches the Windows address book, which is used by Microsoft Outlook, for email addresses. The worm sends an email message to these addresses with itself as an attachment. The subject line and message bodies are random. If the message is opened in an unpatched version of Microsoft Outlook or Outlook Express, the attachment may be automatically executed. The worm also infects executables by prepending itself to the infected files. // c.f. golem.de :: [dre].

Comments (0)