[Full-disclosure] No one else seeing the new MS05-039 worm yet?

From: Vic Vandal (vvandal_at_well.com)
Date: 08/30/05

  • Next message: Martin Schulze: "[Full-disclosure] [SECURITY] [DSA 790-1] New phpldapadmin packages fix unauthorised access" 
    Date: Mon, 29 Aug 2005 22:10:05 -0700 (PDT)
To: full-disclosure@lists.grok.org.uk

    This has been going around since early Monday afternoon. Symantec
    and other AV vendors have had code since then, and no details STILL.

    I guess one can call it the Katrina worm until something better comes
    along.

    Details:
    - Exploits MS05-039, but also MS04-011 and MS03-026.
    - Scans on port 5000 and 135.
    - On workstations opens up range of listening ports above 1024,
      visible with "netstat -a".
    - Creates 40K svc.exe and several randomly named LARGE .exe files
      in: C:\WINNT directory.
    - Sticks a long line of hosts resolving to broadcast address in:
      C:\WINNT\System32\Drivers\etc in hosts file.
    - Adds reg key(s) under:
      HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      which are those random .exe file names mentioned above.
    - May create svc.exe and exe.tmp reg keys under:
      HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\(machine key)\
      FilesNamedMRU (may be unrelated, not generally found on infected box).
    - Prevents killing processes via Task Manager (all processes backed by
      gray color, clicking individual processes does nothing).
    - One can use other utilities to kill running malware processes.
    - Symantec may report as Bobax.Z@mm and/or W32.HLLW.Nebiwo.

    Cleanup:
    - Backup registry.
    - Delete malware-related reg keys as noted.
    - Delete malware-related files.
    - Re-check registry, as executables may enter new values before all
      cleanup actions complete.
    - Edit hosts file, removing added data and saving afterward.
    - Empty Recycle Bin.
    - Patch infected machine.
    - Reboot.
    - Verify that symptoms are gone.

    I've not had time to decompile code to dig out other details, but
    cleanup routine seems sufficient for most part. Have had working
    routine since early afternoon, and expected details from vendors
    long before now.

    Peace,
    Vic
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Martin Schulze: "[Full-disclosure] [SECURITY] [DSA 790-1] New phpldapadmin packages fix unauthorised access"

    Relevant Pages

    • RE: [Full-Disclosure] RE: Symantec wants to criminalize security info sharing
      ... back to the insider trading / stock price question. ... Subject: RE: Symantec wants to criminalize ... I've personally watched worms and malware affect U.S. stock prices. ... that targeted financial services companies... ...
      (Full-Disclosure)
    • Re: [fw-wiz] Antivirus vendor conspiracy theories
      ... whereas AV have typically looked at Viruses ... A/V vendors do their job of fighting the viruses and related worms well, ... > FW/AV doesn't protect well against current malware. ... failures of the active components, but do not acively participate in the ...
      (Firewall-Wizards)
    • RE: CA eTrust AV
      ... vendors on the premise that everyone except CA is using the same naming ... Note that there is no greater resemblance between the Trend and Symantec ... basis of quality of support, ease of administration, or TCO, not some ... product but I don't completely Etrust it. ...
      (Security-Basics)
    • Re: anlukx7n.sys
      ... For most of us Symantec is not free. ... infestation or you have a damaged malware infestation. ... When was your ISO ... Are you sure it's not just the ISOs of the install files? ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Nasty propaganda by "security tool" providers
      ... The reason, why this is done, should be obvious. ... consider it a risk. ... Did all 21 vendors decided to go after VB personally, ... as malware, and that theirs should be corrected. ...
      (comp.security.misc)