This worm is able to work on Chinese versions of Windows only, and spreads itself by sending infected e-mail messages. The worm has two components: a script program and Windows PE EXE file. The first component (script) is sent in infected e-mails, infects the computer, then downloads and executes a EXE component that completes the infection and spreads the worm copies further.
The worm then searches for the startup directory – it looks for Windows directories in the following order:
In case there are no such directories on the machine, the worm cannot infect the system and cannot spread further. The last characters in each line are Chinese strings, and they can’t be used under any other local Windows version, which is why the worm is able to affect Chinese Windows only.
If any appropriate directory has been found, the worm creates “Microsoft Internet Explorer.hta” file in there. This file contains HTML Application that contains one more worm’s script program. Because the file is created in Windows startup directory it will be executed at next Windows startup.
Onceexecuted “Microsoft Internet Explorer.hta” script creates MSIE.INI file in the Windows system directory and stores the local SMTP server address in there (the worm gets that SMTP server address from system registry).
After that the worm creates “system” folder in Windows system directory (for example “C:WINDOWSSYSTEMsystem”) and tries to download to there the MSIE.EXE file from the Internet. To do this the worm connects to one of ten FTP sites using script for standard utility FTP.EXE. If download fails the worm goes into a loop and attempts to repeat it every three minutes.
When the file MSIE.EXE is downloaded, the worm executes it (MSIE.EXE is selfextracting archive) and gets two more files:
EXPLORER.EXE is the second worm component (Windows EXE file), and MSWINSCK.OCX is a library to access Windows sockets.
The worm then starts EXPLORER.EXE file that obtains the email addresses and sends infected messages with the worm’s script program inside by using SMTP protocol. To acquire the victims’ email addresses the worm scans the subdirectory tree on all drives, searching for *.NCH, *.SNM, *.DBX files (mail database files), it then scans them and looks for email addresses.
The worm’s EXPLORER.EXE also performs additional actions. First of all it erases “traces” of its script component and deletes files that were created by it: MSIE.HTA, MSIE.LST, MSBOOT.BAT, MSIE.EXE. It then registers itself in WIN.INI file in the “run=” command to be automatically run on each Windows startup.
The worm will also notify its author (or possible host) about its presence on the infected machine. To do that it sends message to one of the addresses:
there are 23 possible addresses, and the worm randomly selects one of them.
The worm has a “backdoor” payload that “listens” for a remote host and executes its commands: show a directory, open/close/create/execute/delete file, e.t.c.
Demo-versions of Kaspersky AntiViral Toolkit Pro (AVP) able to combat against “Unicle” worm are available on Kaspersky’s Web site on http://www.kasperskylab.ru/eng/products/eval.asp.
You can purchase fully functional version of AntiViral Toolkit Pro online via the Internet on the following address: http://www.kasperskylab.ru/eng/buy/default.asp
How to protect against “Unicle” worm?
Microsoft has released an update that eliminates security “Scriptlet.Typelib” vulnerability. We strongly recommend you visit http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP and install this update.
If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use “Scriptlet.Typelib” security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps: