Email-Worm.Win32.Unicle

Technical Details

General Characteristics

This worm is able to work on Chinese versions of Windows only, and spreads itself by sending infected e-mail messages. The worm has two components: a script program and Windows PE EXE file. The first component (script) is sent in infected e-mails, infects the computer, then downloads and executes a EXE component that completes the infection and spreads the worm copies further.

Installation

The worm arrives as an HTML message with a JavaScript program inside. That script is automatically processed upon opening a message, and the worm code gets control.

Note:
Internet browsers and e-mail clients have built-in security protections that prevent script programs embedded into messages, to access disk files and system resources (the worm needs both to spread itself – see below). To infect the system from an e-mail message, the worm needs to avoid these protections. To do this, it exploits an Internet Explorer 5 security breach – a so-called “Scriptlet.Typelib vulnerability” (see below).

The worm then searches for the startup directory – it looks for Windows directories in the following order:

C:WINDOWSStart MenuPrograms-T-�
C:WINDOWStart MenuPrograms-T-�
C:WINStart MenuPrograms-T-�
C:WIN98Start MenuPrograms-T-�
C:WIN95Start MenuPrograms-T-�
C:WINDOWS.000Start MenuPrograms-T-�
C:WINDOWS.001Start MenuPrograms-T-�
D:WINDOWSStart MenuPrograms-T-�
D:WINDOWStart MenuPrograms-T-�
D:WINStart MenuPrograms-T-�
D:WIN98Start MenuPrograms-T-�
D:WIN95Start MenuPrograms-T-�
D:WINDOWS.000Start MenuPrograms-T-�
D:WINDOWS.001Start MenuPrograms-T-�

In case there are no such directories on the machine, the worm cannot infect the system and cannot spread further. The last characters in each line are Chinese strings, and they can’t be used under any other local Windows version, which is why the worm is able to affect Chinese Windows only.

If any appropriate directory has been found, the worm creates “Microsoft Internet Explorer.hta” file in there. This file contains HTML Application that contains one more worm’s script program. Because the file is created in Windows startup directory it will be executed at next Windows startup.

Onceexecuted “Microsoft Internet Explorer.hta” script creates MSIE.INI file in the Windows system directory and stores the local SMTP server address in there (the worm gets that SMTP server address from system registry).

Note:
the SMTP server is a machine that receives e-messages from computer. In cases where there is a stand-alone PC or email server, it is provider’s address, or some other address that is used as a host email server to send [and receive] emails.

After that the worm creates “system” folder in Windows system directory (for example “C:WINDOWSSYSTEMsystem”) and tries to download to there the MSIE.EXE file from the Internet. To do this the worm connects to one of ten FTP sites using script for standard utility FTP.EXE. If download fails the worm goes into a loop and attempts to repeat it every three minutes.

When the file MSIE.EXE is downloaded, the worm executes it (MSIE.EXE is selfextracting archive) and gets two more files:

EXPLORER.EXE
MSWINSCK.OCX

EXPLORER.EXE is the second worm component (Windows EXE file), and MSWINSCK.OCX is a library to access Windows sockets.

The worm then starts EXPLORER.EXE file that obtains the email addresses and sends infected messages with the worm’s script program inside by using SMTP protocol. To acquire the victims’ email addresses the worm scans the subdirectory tree on all drives, searching for *.NCH, *.SNM, *.DBX files (mail database files), it then scans them and looks for email addresses.

The worm’s EXPLORER.EXE also performs additional actions. First of all it erases “traces” of its script component and deletes files that were created by it: MSIE.HTA, MSIE.LST, MSBOOT.BAT, MSIE.EXE. It then registers itself in WIN.INI file in the “run=” command to be automatically run on each Windows startup.

The worm will also notify its author (or possible host) about its presence on the infected machine. To do that it sends message to one of the addresses:

leebill_001@yahoo.com
leebill_002@yahoo.com
…
leebill_023@yahoo.com

there are 23 possible addresses, and the worm randomly selects one of them.

Payload

The worm has a “backdoor” payload that “listens” for a remote host and executes its commands: show a directory, open/close/create/execute/delete file, e.t.c.

Demo-versions of Kaspersky AntiViral Toolkit Pro (AVP) able to combat against “Unicle” worm are available on Kaspersky’s Web site on http://www.kasperskylab.ru/eng/products/eval.asp.

You can purchase fully functional version of AntiViral Toolkit Pro online via the Internet on the following address: http://www.kasperskylab.ru/eng/buy/default.asp

How to protect against “Unicle” worm?

Microsoft has released an update that eliminates security “Scriptlet.Typelib” vulnerability. We strongly recommend you visit http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP and install this update.

If you do not use any HTML applications (HTA-files), there is another way to prevent infection by viruses of such type (the worms and viruses that use “Scriptlet.Typelib” security vulnerability). You need to remove file association for .HTA extension. To do this you have to follow these steps:

1. Double click “My Computer” icon on desktop.
2. In appeared window choose menu “View” -> “Options…”.
3. On “File Types” tab in “Registered file types” listbox select
“HTML Applicaton” item.
4. Click “Remove” button and confirm action.
5. Close options dialog box.