Virus Characteristics
Update October 27, 2000:
In recent news, it has been noted that a large corporation recently experienced an attack by this Trojan and Internet worm.
It should also be noted that W32/QAZ can give access to the host system which will allow a hacker or group of hackers to install other malware programs if desired. It is this feature that was exploited at the large corporation It was also speculated that this worm had been received over e-mail; this is unlikely, QAZ spreads only over open network shares.
This is an Internet worm that also acts as a backdoor. When running, it listens on TCP port 7597 for instructions from a client component. This worm also communicates with the IP address 202.106.185.107 which is physically located somewhere in China. The backdoor allows the remote user only to upload and run any program, which is enough to install a more complex backdoor or password-stealing program.
This worm browses the network connections to spread to other machines that allow passwordless write access to their Windows folders over NetBIOS, and copies itself as "NOTEPAD.EXE" and renames the existing NOTEPAD.EXE to NOTE.COM.
After the newly infected computer tries to run NOTEPAD, the worm modifies the registry to include this key value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq
When ever the user runs NOTEPAD, the worm is executed and this then runs NOTE.COM.
One major significance is the real NOTEPAD.EXE is 52Kb while this worm is 120,320 bytes.