|
Sunday, 23 January 2005 |
W32.Mirsa.A@mm is a mass-mailing worm that uses MAPI to send an email to all addresses in the Microsoft Outlook Address Book. This threat is written in Visual Basic.
Type: Worm
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When W32.Mirsa.A@mm is executed, it performs the following actions:
Creates the following files:
C:DataBase.exe
C:Memo.exe
C:Memorandon.exe
C:Important.exe
C:Protocol.exe
C:promotions.exe
Overwrites the following file (Microsoft Word) with itself:
C:Program FilesMicrosoft OfficeOfficeWinword.exe
Creates the following registry entries:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesEbola
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunEbola
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesAnthrax
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunAnthrax
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesF4J
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunFathers
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesFour
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunJustice
so that it is executed every time Windows starts.
Creates additional registry entries:
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersion
WindowsLOAD"C:serious.exe"
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersion
WindowsOPEN"C:serious.exe"
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersion
WindowsRUN"C:serious.exe"
Uses MAPI to send an e-mail with itself to all addresses it finds in the MS Outlook address book.
The e-mail has the following properties:
From: (one of the following)
This email address is being protected from spam bots, you need Javascript enabled to view it
This email address is being protected from spam bots, you need Javascript enabled to view it
This email address is being protected from spam bots, you need Javascript enabled to view it
This email address is being protected from spam bots, you need Javascript enabled to view it
This email address is being protected from spam bots, you need Javascript enabled to view it
Subject: (one of the following)
How NOT to get Promotion
Memorandom to all staff
Urgent Document
Alterations to my last letter
Amendments for...
Extremely Important
Sorry my mistake heres the...
Private and personal
Message Body: (one of the following)
Please read the attached file and get back to me ASAP
Its been ages since I last saw you
Hello, Can you read the file i sent then let me have it back
Cheers
Hey
Read this because i need your opinion
see you latter
Bye
I need you to read this document ASAP
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.
|
