Virus Characteristics
-- Update Feb 2, 2006 --
CME number assigned ( CME-24
)
This worm is proactively detected by 4642 and higher DATs as W32/Generic.worm!p2p. 4677 and higher DATs will detect this specifically as W32/MyWife.d@MM
This is a mass-mailing worm that bears the following characteristics:
- contains its own SMTP engine to construct outgoing messages
- spreads through open network shares
- tries to lower security settings and disable security software
- overwrites files on the 3rd of each month
E-mail Component:
The virus arrives in an email message as follows:
From:
(Spoofed email sender)
Do not assume that the sender address is an indication that the sender is infected. Additionally you may receive alert messages from a mail server that you are infected, which may not be the case.
Subject:
(Varies, such as)
- Photos
- My photos
- School girl fantasies gone bad
- Part 1 of 6 Video clipe
- *Hot Movie*
- Re:
- Fw: Picturs
- Fw: Funny :)
- Fwd: Photo
- Fwd: image.jpg
- Fw: Sexy
- Fw:
- Fwd: Crazy illegal Sex!
- Fw: Real show
- Fw: SeX.mpg
- Fw: DSC-00465.jpg
- Re: Sex Video
- Word file
- the file
- eBook.pdf
- Miss Lebanon 2006
- A Great Video
- give me a kiss
Body:
(Varies, such as)
- Note: forwarded message attached.
- You Must View This Videoclip!
- >> forwarded message
- i just any one see my photos.
- forwarded message attached.
- Please see the file.
- ----- forwarded message -----
- The Best Videoclip Ever
- Hot XXX Yahoo Groups
- F***in Kama Sutra pics
- ready to be F***ED ;)
- VIDEOS! FREE! (US$ 0,00)
- It's Free :)
- hello,
- i send the file.
- bye
- hi
- i send the details
- i attached the details.
- how are you?
- What?
- Thank you
- i send the details.
- OK ?
(N.B. *** replaces content for filtering purposes)
Attachment:
The files attached to the email may either be the executable itself or a MIME encoded file which contains the executable.
The executable filename is chosen from the following list:
- 04.pif
- 007.pif
- School.pif
- photo.pif
- DSC-00465.Pif
- Arab sex DSC-00465.jpg
- image04.pif
- 677.pif
- DSC-00465.pIf
- New_Document_file.pif
- eBook.PIF
- document.pif
The MIME encoded files' name is chosen from the following list:
- SeX.mim
- Sex.mim
- WinZip.BHX
- 3.92315089702606E02.UUE
- Attachments[001].B64
- eBook.Uu
- Word_Document.hqx
- Word_Document.uu
- Attachments00.HQX
- Attachments001.BHX
- Video_part.mim
It may also be chosen from the following list of prefaces:
- 392315089702606E-02
- Clipe
- Miss
- Sweet_09
with the following file extensions:
- .mim
- .HQX
- .BHx
- .b64
- .uu
- .UUE
The filename within the MIME encoded file is chosen from the following list:
- Attachments[001],B64 .sCr
- 392315089702606E-02,UUE .scR
- SeX,zip .scR
- WinZip.zip .sCR
- ATT01.zip .sCR
- Word.zip .sCR
- Word XP.zip .sCR
- New Video,zip .sCr
- Atta[001],zip .SCR
- Attachments,zip .SCR
- Clipe,zip .sCr
- WinZip,zip .scR
- Adults_9,zip .sCR
- Photos,zip .sCR
Installation:
When this file is run, it copies itself to the Windows System directory as one or more of the following filenames.
- %SysDir%
\Winzip.exe
- %SysDir%
\Update.exe
- %SysDir%
\scanregw.exe
- %WinDir%
\Rundll16.exe
- %WinDir%
\winzip_tmp.exe
- c:\winzip_tmp.exe
- %Temp%
\word.zip .exe
(Where
%Sysdir% is the Windows System directory - for example C:\WINDOWS\SYSTEM -
%WinDir% is the Windows Directory, and
%Temp% is the Temp Directory)
It creates the following registry entry to hook Windows startup:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Run\ScanRegistry="scanregw.exe /scan"
The worm will go through the following directories
- \Documents and Settings\
- \Documents and Settings\%USERS%\My Documents\
- \Program Files\
- \RECYCLER\
- \System Volume Information\
in order to place three files in each directory with the following names:
- desktop.ini
- Temp.Htt
- WinZip_Tmp.exe (copy of the worm)
It will also change the system settings to "Hide Protected operating system files".
Having DESKTOP.INI and TEMP.HTT in any folder will turn it into an HTML browseable folder. DESKTOP.INI will point to TEMP.HTT as its template file that would run every time the folder is viewed. Inside TEMP.HTT, there will be another call to "WinZip_Temp.exe" to activate it in case there is not any instances of the worm currently running.
Network Share Component:
The worm will attempt to copy itself to the following shares, using the current user's authentication:
- C$\documents and settings\all users\start menu\programs\startup\winzip quick pick.exe
- Admin$\winzip_tmp.exe
- C$\winzip_tmp.exe
The worm creates scheduled tasks on the remote computer to run winzip_tmp.exe during the 59th minute of every hour. Once the 59th minute is reached, the remote computer would itself be infected as it runs the dropped payload.
Variants
Variants information
| Virus Name |
Type |
Subtype |
Differences |
| W32/MyWife.e@MM |
Virus |
E-mail |
This detection was added briefly, but it has since been determined that it was in fact a corrupted W32/MyWife.d@MM. Such files will now be detected as W32/MyWife.d@MM!M24. |