Parent class: VirWare
Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:- file viruses
- boot sector viruses
- macro viruses
- script viruses
Class: Email-Worm
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website). In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated. Email-Worms use a range of methods to send infected emails. The most common are: using a direct connection to a SMTP server using the email directory built into the worm’s code using MS Outlook services using Windows MAPI functions. Email-Worms use a number of different sources to find email addresses to which infected emails will be sent: the address book in MS Outlook a WAB address database .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses emails in the inbox (some Email-Worms even “reply” to emails found in the inbox) Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Description
Technical Details
General Characteristics
This worm is able to work on Chinese versions of Windows only, and spreads itself by sending infected e-mail messages. The worm has two components: a script program and Windows PE EXE file. The first component (script) is sent in infected e-mails, infects the computer, then downloads and executes a EXE component that completes the infection and spreads the worm copies further.
Installation
The worm arrives as an HTML message with a JavaScript program inside. That script is automatically processed upon opening a message, and the worm code gets control.
Note:
Internet browsers and e-mail clients have built-in security protections that prevent script programs embedded into messages, to access disk files and system resources (the worm needs both to spread itself - see below). To infect the system from an e-mail message, the worm needs to avoid these protections. To do this, it exploits an Internet Explorer 5 security breach - a so-called "Scriptlet.Typelib vulnerability" (see below).
The worm then searches for the startup directory - it looks for Windows directories in the following order:
C:WINDOWSStart MenuPrograms-T-�
C:WINDOWStart MenuPrograms-T-�
C:WINStart MenuPrograms-T-�
C:WIN98Start MenuPrograms-T-�
C:WIN95Start MenuPrograms-T-�
C:WINDOWS.000Start MenuPrograms-T-�
C:WINDOWS.001Start MenuPrograms-T-�
D:WINDOWSStart MenuPrograms-T-�
D:WINDOWStart MenuPrograms-T-�
D:WINStart MenuPrograms-T-�
D:WIN98Start MenuPrograms-T-�
D:WIN95Start MenuPrograms-T-�
D:WINDOWS.000Start MenuPrograms-T-�
D:WINDOWS.001Start MenuPrograms-T-�
In case there are no such directories on the machine, the worm cannot infect the system and cannot spread further. The last characters in each line are Chinese strings, and they can't be used under any other local Windows version, which is why the worm is able to affect Chinese Windows only.
If any appropriate directory has been found, the worm creates "Microsoft Internet Explorer.hta" file in there. This file contains HTML Application that contains one more worm's script program. Because the file is created in Windows startup directory it will be executed at next Windows startup.
Onceexecuted "Microsoft Internet Explorer.hta" script creates MSIE.INI file in the Windows system directory and stores the local SMTP server address in there (the worm gets that SMTP server address from system registry).
Note:
the SMTP server is a machine that receives e-messages from computer. In cases where there is a stand-alone PC or email server, it is provider's address, or some other address that is used as a host email server to send [and receive] emails.
After that the worm creates "system" folder in Windows system directory (for example "C:WINDOWSSYSTEMsystem") and tries to download to there the MSIE.EXE file from the Internet. To do this the worm connects to one of ten FTP sites using script for standard utility FTP.EXE. If download fails the worm goes into a loop and attempts to repeat it every three minutes.
When the file MSIE.EXE is downloaded, the worm executes it (MSIE.EXE is selfextracting archive) and gets two more files:
EXPLORER.EXE
MSWINSCK.OCX
EXPLORER.EXE is the second worm component (Windows EXE file), and MSWINSCK.OCX is a library to access Windows sockets.
The worm then starts EXPLORER.EXE file that obtains the email addresses and sends infected messages with the worm's script program inside by using SMTP protocol. To acquire the victims' email addresses the worm scans the subdirectory tree on all drives, searching for *.NCH, *.SNM, *.DBX files (mail database files), it then scans them and looks for email addresses.
The worm's EXPLORER.EXE also performs additional actions. First of all it erases "traces" of its script component and deletes files that were created by it: MSIE.HTA, MSIE.LST, MSBOOT.BAT, MSIE.EXE. It then registers itself in WIN.INI file in the "run=" command to be automatically run on each Windows startup.
The worm will also notify its author (or possible host) about its presence on the infected machine. To do that it sends message to one of the addresses:
leebill_001@yahoo.com
leebill_002@yahoo.com
...
leebill_023@yahoo.com
there are 23 possible addresses, and the worm randomly selects one of them.
Payload
The worm has a "backdoor" payload that "listens" for a remote host and executes its commands: show a directory, open/close/create/execute/delete file, e.t.c.
Demo-versions of Kaspersky AntiViral Toolkit Pro (AVP) able to combat against "Unicle" worm are available on Kaspersky's Web site on http://www.kasperskylab.ru/eng/products/eval.asp.
You can purchase fully functional version of AntiViral Toolkit Pro online via the Internet on the following address: http://www.kasperskylab.ru/eng/buy/default.asp
How to protect against "Unicle" worm?
Microsoft has released an update that eliminates security "Scriptlet.Typelib" vulnerability. We strongly recommend you visit http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP and install this update.
If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use "Scriptlet.Typelib" security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps:
1. Double click "My Computer" icon on desktop.
2. In appeared window choose menu "View" -> "Options...".
3. On "File Types" tab in "Registered file types" listbox select "HTML Applicaton" item.
4. Click "Remove" button and confirm action.
5. Close options dialog box.
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com