Virus Characteristics
-- Update August 28, 2003 --
A new variant of the W32/Dumaru@MM virus has been discovered on 25th August 2003.
This variant is detected heuristically as virus or variant of New BackDoor1 using DATs 4230 (available since 10/23/2002) and later with engine 4.1.60. McAfee customers who updated to this version of DATs, or above, are therefore protected from this new variant.
Mass Mailing Component
The email sent by this variant is similar to W32/Dumaru.a@MM. It contains its own SMTP engine for constructing outgoing messages.
From:
"Microsoft" security@microsoft.com
Subject:
Use this patch immediately !
Attachment:
patch.exe
The worm trawls the harddisk for files with extensions .htm .wab .html .dbx .tbb .abd
for email addresses to send itself to. These email addresses are written to file winload.log
.
Keylogger Backdoor Component
The worm contains a keylogger component, which logs user events and key inputs. The events are logged to files vxdload.log, rundllx.sys, or rundlln.sys. From strings within the virus body, it seems that passwords saved in Far Manager, and data from the clipboard are logged as well.
Payload
Like previous variants, the password stealer PWS-Narod
is dropped by this worm.
The worm attempts to stop the following security services processes.
ZAUINST.EXE
ZAPRO.EXE
ZONEALARM.EXE
ZATUTOR.EXE
MINILOG.EXE
VSMON.EXE
LOCKDOWN.EXE
ANTS.EXE
FAST.EXE
GUARD.EXE
TC.EXE
SPYXX.EXE
PVIEW95.EXE
REGEDIT.EXE
DRWATSON.EXE
SYSEDIT.EXE
NSCHED32.EXE
MOOLIVE.EXE
TCA.EXE
TCM.EXE
T DS-3.EXE
SS3EDIT.EXE
UPDATE.EXE
ATCON.EXE
ATUPDATER.EXE
ATWATCH.EXE
WGFE95.EXE
POPROXY.EXE
NPROTECT.EXE
VSSTAT.EXE
VSHWIN32.EXE
NDD32.EXE
MCAGENT.EXE
MCUPDATE .EXE
WATCHDOG.EXE
TAUMON.EXE
IAMAPP.EXE
IAMSERV.EXE
LOCKDOWN2000.EXE
SPHINX.EXE
WEBSCANX.EXE
VSECOMR.EXE
PCCIOMON.EXE
ICLOAD95.EXE
ICMON.EXE
ICSUPP95.EXE
ICLO ADNT.EXE
ICSUPPNT.EXE
FRW.EXE
BLACKICE.EXE
BLACKD.EXE
WRCTRL.EXE
WRADMIN.EXE
WR CTRL.EXE
PCFWALLICON.EXE
APLICA32.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET32.EXE
CF INET.EXE
TDS2-98.EXE
TDS2-NT.EXE
SAFEWEB.EXE
NVARCH16.EXE
MSSMMC32.EXE
PERSFW.E XE VSMAIN.EXE
LUALL.EXE
LUCOMSERVER.EXE
AVSYNMGR.EXE
DEFWATCH.EXE
RTVSCN95.EXE
VPC42.EXE
VPTRAY.EXE
PAVPROXY.EXE
APVXDWIN.EXE
AGENTSVR.EXE
NETSTAT.EXE
MGUI.EX E MSCONFIG.EXE
NMAIN.EXE
NISUM.EXE
NISSERV.EXE
It was observed that the virus also connects to a restricted russian site by ftp, probably to download updates of itself. This site cannot be accessed during this moment of writing.