|
Updated: September 11, 2006 08:50:06 AM GDT
Type: Worm
Infection Length: 21,262 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
W32.Areses.Q@mm is a mass-mailing worm that opens a back door on the compromised computer and may download files.
ProtectionVirus Definitions (LiveUpdate™ Daily) September 6, 2006
Virus Definitions (LiveUpdate™ Weekly) September 6, 2006
Virus Definitions (Intelligent Updater) September 6, 2006
Virus Definitions (LiveUpdate™ Plus) September 6, 2006
Threat AssesmentWildWild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
DamageDamage Level: Medium
Payload: Sends copies of itself by email to addresses gathered from the compromised computer.
Large Scale E-mailing: Uses its own SMTP engine to mass-mail copies of itself to addresses gathered from the compromised computer.
DistributionDistribution Level: Medium
Subject of Email: Varies
Name of Attachment: Varies
Size of Attachment: Varies
When W32.Areses.Q@mm is executed, it performs the following actions:
Copies itself as the following file:
%Windir%\csrss.exe
Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
Adds the value:
"Debugger" = "%Windir%\csrss.exe"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Image File Execution Options\explorer.exe
so that it runs every time Windows starts.
Adds the value:
"Application" = "[VARIABLE DWORD VALUE]"
to the registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT
\CurrentVersion\Devices
so that it runs every time Windows starts.
Attempts to create a mutex named Numen#Syscall@ and exits if the attempt fails. This ensures that no more than one instance of the worm can run on a computer at any time.
Attempts to inject its code into the svchost.exe and services.exe processes.
Checks for the presence of the 127.0.0.1 string in the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
\Parameters\Interface\[INTERFACE CLSID]\"NameServer"
Stops the mass-mailing routine if the above value is found.
Creates the file %Temp%\Message.hta (A copy of W32.Areses.Q!vbs.)
Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).
Gathers email addresses from files with the following extensions:
.adb
.asp
.cfg
.cgi
.mra
.dbx
.dhtm
.eml
.htm
.html
.jsp
.mbx
.mdx
.mht
.mmf
.msg
.nch
.ods
.oft
.php
.pl
.sht
.shtm
.stm
.tbb
.txt
.uin
.wab
.wsh
.xls
.xml
.dhtml
Avoids email addresses that contain any of the following strings:
@example.
2003
2004
2005
2006
@microsoft
rating@
f-secur
news
update
.qmail
.gif
anyone@
bugs@
contract@
feste
gold-certs@
help@
info@
nobody@
noone@
0000
Mailer-Daemon@
@subscribe
kasp
admin
icrosoft
support
ntivi
unix
bsd
linux
listserv
certific
torvalds@
sopho
@foo
@iana
free-av
@messagelab
winzip
google
winrar
samples
spm111@
..
-0
.00
@.
---
abuse
panda
cafee
spam
pgp
@avp.
noreply
local
root@
postmaster@
.0
.1
.2
.3
.4
.5
.6
.7
.8
.9
Uses its own SMTP engine to send itself to the email addresses that it finds. The email has the following characteristics:
From: Spoofed
Subject:
One of the following:
Hi, what's up?
He, where are you?
Hi, drop me a line!!!
Hi! Please write to me urgently!
Hi! I'm waiting you online today!
Will you be online today?
When you're gonna answer me?
Re: write to me!
Re: Call me!
Re: Where are you?
Re: When you're gonna answer me?
Hi!!! How's the mood?
Re: How's the mood?
Re: Where have you been?
Message:
One of the following:
Hi!!!!! You haven't been writing for a long time. I began to worry) Where have you been? You remember, you've asked a progy from me? I've finally found it, so here it is. Check it out if this is what you've been looking for... bye
Hi, what's up? Will you show up online today?
Drop me a line in ICQ, ok? Btw, I'm sending you the docs you've been looking for, find them attached. Check them out, ok?
Hi!
I'm coming to you tomorrow, ok? When you are going to be home?
You remember, you've asked some docs. Please find them attached. Check and see what's inside. That's it. Bye, till tomorrow...
Hi!
You disappeared again. If you come online, drop me a line, ok?
Btw, I sent you those docs that you've been looking for. Check them out. Bye!
Hi, give me a call just when you got the message! I'm tired of waiting. Btw, I'm sending that program that you've been looking for. Check it out. Appears to be that one. Bye!
Hi, what's up? If you have time tomorrow, please come over. After midday. By the way, don't forget to check the enclosed documents. Bye. See you tomorrow.
Hi, I got a free day tomorrow, and I'm waiting for you. Please come after midday. By the way, I'm sending you the documents that you've been asking for. Read them out... Bye!
Hi, how are you? What are your plans today? If you have time, please come over, and don't forget to check the program attached. Bye!
Hi, what's you gonna do today? I'll come over tonight! By the way, don't give anyone this funny program I'm sending. Check it out. Bye!
Hi, I found that program you asked for. Find it attached. Bye.
Hi, I saw you around today, but you didn't noticed me ( If you're gonna be at home, give a call, ok? By the way, check this file I'm sending. A very interesting program...
What's up! You haven't been writing for a long time
I got news. I've finally that program you needed
I'm sending it out. Use it. Bye!
Hi, drop me a line today, ok? And see the program I'm sending. Bye!
Hi, drop me a line if you can. Btw, I have a new ICQ. Please don't forget to check the attached documents. Bye.
Hi! How are you? Drop me a line if you can. I found your documents and I'm emailing them to you. Bye.
Attachment:
One of the following with a .hta extension:
Message
File
Document
README
Passwords
Readme
Important
New
COOL
Archive
Fotos
private
confidential
secret
images
your_documents
backup
Attempts to contact the following remote site and may download a file:
[http://]xeseretuo.com/m2/g[REMOVED]
May open a back door on a random TCP port.
May search for folders that contain the following strings:
bear
donkey
download
ftp
htdocs
http
icq
kazaa
lime
morpheus
mule
shar
source
upload
pub
If the above folders are found, it attempts to copy itself as one of the following files with a .exe, .pif or .scr extension:
1
1001 Sex and more.rtf
3D Studio Max 6 3dsmax
ACDSee 10 full
Adobe Photoshop 10 full
Adobe Premiere 10
Ahead Nero 8
Altkins Diet.doc
American Idol.doc
Arnold Schwarzenegger.jpg
Best Matrix Screensaver new
Britney sex xxx.jpg
Britney Spears and Eminem porn.jpg
Britney Spears blowjob.jpg
Britney Spears cumshot.jpg
Britney Spears *****.jpg
Britney Spears full album.mp3
Britney Spears porn.jpg
Britney Spears Sexy archive.doc
Britney Spears Song text archive.doc
Britney Spears.jpg
Britney Spears.mp3
Clone DVD 6
Cloning.doc
Cracks & Warez Archiv
Dark Angels new
Dictionary English 2004 - France.doc
DivX 8.0 final
Doom 3 release 2
E-Book Archive2.rtf
Eminem blowjob.jpg
Eminem full album.mp3
Eminem Poster.jpg
Eminem sex xxx.jpg
Eminem Sexy archive.doc
Eminem Spears porn.jpg
Eminem.mp3
Full album all.mp3
Gimp 1.8 Full with Key
Harry Potter 1-6 book.txt
Harry Potter 5.mpg
Harry Potter all e.book.doc
Harry Potter e book.doc
Harry Potter game
Harry Potter.doc
Harry Potter and the Sorcerer',27h,'s Stone game
How to hack new.doc
Internet Explorer 9 setup
Kazaa Lite 4.0 new
Kazaa new
Keygen 4 all new
Learn Programming 2004.doc
Lightwave 9 Update
Magix Video Deluxe 5 beta
Matrix 3 .mpg
Microsoft Office 2003 Crack best
Microsoft WinXP Crack full
MS Service Pack 6
source code
Norton Antivirus 2005 beta
Opera 11 free
Partitionsmagic 10 beta
Porno Screensaver britney
RFC compilation.doc
Ringtones.doc
Nostradamus.doc
World Trade Center last video.mpeg
anthrax.doc
Osama Bin Laden.jpg
Taliban
Osama bin Laden.mpg
Yellow Pages
Ringtones.mp3
Saddam Hussein.jpg
Screensaver2
Serials edition.txt
Smashing the stack full.rtf
Star Office 9
Teen Porn 15.jpg
The Sims 4 beta
Ulead Keygen 2004
Visual Studio Net Crack all
Vista review.doc
WinAmp 13 full with sources
Windows Vista Sourcecode.doc
Windows 2003 crack
Windows XP crack
WinXP eBook newest.doc
XXX hardcore pics.jpg
To delete the value from the registry:
Click Start > Run.
Type regedit
Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.
Navigate to the subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
\CurrentVersion\Image File Execution Options\explorer.exe
In the right pane, delete the value:
"Debugger" = "%Windir%\csrss.exe"
Navigate to the subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT
\CurrentVersion\Devices
In the right pane, delete the value:
"Application" = "[VARIABLE DWORD VALUE]"
Exit the Registry Editor.
|
