Parent class: VirWare
Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:- file viruses
- boot sector viruses
- macro viruses
- script viruses
Class: Virus
Viruses replicate on the resources of the local machine. Unlike worms, viruses do not use network services to propagate or penetrate other computers. A copy of a virus will reach remote computers only if the infected object is, for some reason unrelated to the virus function, activated on another computer. For example: when infecting accessible disks, a virus penetrates a file located on a network resource a virus copies itself to a removable storage device or infects a file on a removable device a user sends an email with an infected attachment.Read more
Platform: MSAccess
No platform descriptionDescription
Technical Details
This is a multi-component Internet-worm infecting Win32 machines and spreading in e-mail messages as an attached EXE file. The worm has several components, and is able to "upgrade" itself from an Internet Web site.
There are two principal worm components: Loader and Main component.
The Loader is a Windows EXE file about 25K in size (it is compressed by a UPX PE EXE file-compression utility, which being decompressed reaches about 70K in size). When the loader is activated on a computer (being run from e-mail attach), it registers itself as a hidden process (service), copies itself to the Windows system directory with the name GDI32.EXE, and registers in the auto-run system registry key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
GDI = WinSystemGDI32.EXE
where "WinSystem" is the Windows system directory name. As a result, the worm Loader then is executed upon each Windows startup. Note that there are standard Windows components in this directory: GDI.EXE and GDI32.DLL. The worm uses the GDI32.EXE name to disguise itself in a standard Windows environment.
To hide its activity, the worm then displays the fake error message:
FileName n' est pas une application Win32 valide.
where FileName is the actual file name the worm was started from.
The worm then activates the main procedure that obtains and executes the Main component. It enters the http://www.geocities.com/olivier1548/ Web page and obtains several files from there:
- LASTVERSION.TXT - a text file with the number of the latest worm version available there. If there is no new version, the worm exits.
- nn.ZIP - latest version of worm Main component, "nn" is defined in LASTVERSION.TXT.
- GATEWAY.ZIP - latest version of worm Loader component.
The nn.ZIP and GATEWAY.ZIP files are not actually archives, but an encrypted Windows EXE file. The worm Loader decrypts them, copies to the Windows directory and spawns. As a result, the Main component is activated on the computer.
The Main worm component is the Windows EXE file about 40K in size (it is compressed by a UPX PE EXE file-compression utility, which being decompressed reaches 120K in size). It is installed to the Windows directory with the GDI32A.EXE name and is registered in the system registry in a similar way as described above for the virus loader. The main components then, depending on some conditions, open the Windows Address Book, obtain Inet addresses from there and send infected e-mail messages. In the known worm version, these messages have:
Subject: Choose your poison
Attached file name: girls.exe
The Main worm component also has Backdoor abilities to watch at infected computer and run its resources from remote host machine.
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com