Date: Tue Aug 30 06:10:13 2005
From: vvandal at well.com (Vic Vandal)
Subject: No one else seeing the new MS05-039 worm yet?

This has been going around since early Monday afternoon.  Symantec
and other AV vendors have had code since then, and no details STILL.

I guess one can call it the Katrina worm until something better comes
along.

Details:
- Exploits MS05-039, but also MS04-011 and MS03-026.
- Scans on port 5000 and 135.
- On workstations opens up range of listening ports above 1024,
  visible with "netstat -a".
- Creates 40K svc.exe and several randomly named LARGE .exe files
  in: C:\WINNT directory.
- Sticks a long line of hosts resolving to broadcast address in:
  C:\WINNT\System32\Drivers\etc in hosts file.
- Adds reg key(s) under:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  which are those random .exe file names mentioned above.
- May create svc.exe and exe.tmp reg keys under:
  HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\(machine key)\
  FilesNamedMRU (may be unrelated, not generally found on infected box).
- Prevents killing processes via Task Manager (all processes backed by
  gray color, clicking individual processes does nothing).
- One can use other utilities to kill running malware processes.
- Symantec may report as Bobax.Z@mm and/or W32.HLLW.Nebiwo.

Cleanup:
- Backup registry.
- Delete malware-related reg keys as noted.
- Delete malware-related files.
- Re-check registry, as executables may enter new values before all
  cleanup actions complete.
- Edit hosts file, removing added data and saving afterward.
- Empty Recycle Bin.
- Patch infected machine.
- Reboot.
- Verify that symptoms are gone.

I've not had time to decompile code to dig out other details, but
cleanup routine seems sufficient for most part.  Have had working
routine since early afternoon, and expected details from vendors
long before now.

Peace,
Vic

Powered by blists - more mailing lists