Several antivirus vendors issued a high-level threat warning Thursday to computer users of a new variant of the Nachi worm (W32/Nachi-B) that attempts to remove infections of W32/MyDoom-A and W32/MyDoom-B, and download Microsoft security patches to unprotected computers.
Taking advantage of the same critical security hole in Microsoft Windows that was exploited by the Blaster worm, Nachi searches for unpatched computers, according to Sophos. Once located, it infects the computer without asking the user's permission and hunts for traces of the MyDoom worms. If a MyDoom infection is found, the Nachi-B worm attempts to remove it and download patches to fix the Microsoft vulnerability.
W32/Nachi-B spreads by exploiting the following Microsoft vulnerabilities:
--Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability.
Microsoft issued a patch for the vulnerability exploited by this worm on July 16, 2003. The patch is available from http://www.microsoft.com/technet/security/bulletin/MS03-026.asp.
--WebDAV vulnerability and IIS5/WEBDAV Buffer Overrun vulnerability Microsoft issued a patch for the vulnerability exploited by this worm on March 17, 2003. The patch is available from http://www.microsoft.com/technet/security/bulletin/MS03-007.asp.
When run the worm copies itself to the subfolder drivers located in the Windows system folder using the filename svchost.exe. The worm also tries to download and execute some of the following Microsoft patches:
http://download.microsoft.com/download/4/d/3/4d375d48-04c7-411f-959b- 3467c5ef1e9a/WindowsXP-KB828035-x86-CHS.exe
http://download.microsoft.com/download/a/4/3/a43ea017-9abd-4d28-a736- 2c17dd4d7e59/WindowsXP-KB828035-x86-KOR.exe
http://download.microsoft.com/download/e/a/e/eaea4109-0870-4dd3-88e0- a34035dc181a/WindowsXP-KB828035-x86-ENU.exe
http://download.microsoft.com/download/9/c/5/9c579720-63e9-478a-bdcb- 70087ccad56c/Windows2000-KB828749-x86-CHS.exe
http://download.microsoft.com/download/0/8/4/084be8b7-e000-4847-979c- c26de0929513/Windows2000-KB828749-x86-KOR.exe
http://download.microsoft.com/download/3/c/6/3c6d56ff-ff8e-4322-84cb- 3bf9a915e6d9/Windows2000-KB828749-x86-ENU.exe
W32/Nachi-B checks every 20 minutes for a live Internet connection by attempting to connect to either microsoft.com, intel.com or google.com and will attempt to infect random IP addresses if the connection was successful.
W32/Nachi-B will uninstall itself from June 2004.
More information is at Sophos page.
According to McAfee, W32/Nachi.worm.b exploits the MS03-026 / MS03-039 vulnerability (DCOM RPC), the MS03-007 vulnerability (NTDLL via WebDav), and the MS03-049 vulnerability (Workstation service). WksPatch_Mutex
The virus installs itself within a DRIVERS directory in the Windows System directory: C:\WINNT\SYSTEM32\DRIVERS\SVCHOST.EXE (12,800 bytes)
Please Note: There is a perfectly legitimate system file with filename SVCHOST.EXE in the WINDOWS SYSTEM directory with the same filesize.
The following service is installed:
WksPatch Set to run the installed copy of the worm (SVCHOST.EXE).
Visit this McAfee page for more information.
Nachi.B is a worm that affects Windows XP/2000/NT computers only, according to Panda Software. Nachi.B exploits the vulnerabilities Buffer Overrun in RPC Interface, WebDAV and Workstation Service Buffer Overrun in order to spread to as many computers as possible.
Nachi.B spreads by attacking remote computers and exploits the vulnerabilities mentioned above to download a copy of itself to the compromised computer. In order to do this, Nachi.B incorporates its own web server.
Nachi.B uninstalls the worms Mydoom.A and Mydoom.B, by ending their processes and deleting the files carrying the worms.
If you have a Windows XP/2000/NT computer, it is highly recommendable to download the security patches from the Microsoft Web site for the following vulnerabilities: Buffer Overrun in RPC Interface, WebDAV and Workstation Service Buffer Overrun.
Technical details are at this Panda Software page.
Mydoom Virus Now at High Outbreak Status
And the Mydoom virus has now escalated into a high outbreak, according to McAfee. A new variant of this virus has been discovered, the vendor reported Thursday. The file size is 24,048 bytes (petite packed). It is proactively detected as W32/Mydoom.a@MM using the above specified DATs. The functionality of this new variant is similar to the .a variant, except that the body of the email it sends out may contain the following:
ROFL HELLO SAM HOWS UPZ. Partial message is available
This is a mass-mailing and peer-to-peer file-sharing worm that bears the following characteristics:
contains its own SMTP engine to construct outgoing messages
contains a backdoor component
contains a Denial of Service payload
Read more at this McAfee page.
Deadhat Worm Also Targets Systems Infected With Mydoom Virus
Some antivirus vendors also issued medium-level threat alerts for Worm_Deadhat.B, a memory-resident worm that propagates on systems that are infected with WORM_MYDOOM.A and WORM_MYDOOM.B, according to Trend Micro. It is also capable of spreading via the popular peer-to-peer file-sharing application, SoulSeek.
It has the following capabilities:
Drop itself as the file MSGSVR32.EXE in the Windows system folder
Enumerate all running processes
Terminate processes associated with antivirus programs
Terminate instances of WORM_MYDOOM.A and WORM_MYDOOM.B
Delete several system files such as BOOT.INI and AUTOEXEC.BAT
Open port 2766, connect to an Internet Relay Chat (IRC) server, and joins a channel to wait for malicious commands from a remote user
It runs on Windows 98, ME, NT, 2000, and XP.
Technical details are at this Trend Micro page.
Deadhat.B is a worm with destructive effects that spreads through the peer-to-peer (P2P) file sharing program SoulSeek and via Internet, according to Panda Software. Deadhat.B causes the affected computer to not start up correctly, as it deletes files that are vital to its functioning.
Deadhat.B ends processes belonging to some antivirus programs and firewalls, among others. This leaves the computer vulnerable to the attack of other malware. It also ends the processes belonging to Mydoom.A and Mydoom.B.
In addition, Deadhat.B opens the TCP port 2766, connects to an IRC server, and waits for control commands to be carried out on the affected computer. It allows to download files to the computer, using a remote connection.
Technical details are atthis Panda Software page.
Virus Attempts to Move .Exe Files to New Folder
Sophos has also issued a warning for W32/Order-A, a companion virus that attempts to move EXE files into the \Fonts folder and overwrite the original file with itself. The files in the fonts folder will be called .chaos. The original extension will be lost.
Note that files in the Fonts folder cannot be seen using Explorer but can be seen from the command prompt.
W32/Order-A may drop a file called Chaos.txt which contains the following text:
Do you believe in a god that satisfies
Do you believe in a god that opens eyes
Do you believe in a god that tells you lies
Or do you believe in me?
Do you believe in a god that brings you down
Do you believe in a god that wears a crown
Do you believe in a god that makes you bow
Or do you believe in me?
~ Marco V - Godd
[Chaos] created by Xevion
The lyrics are from a song called "Godd" by Marco V, a DJ based in the Netherlands.
More information is at this Sophos page.
Welchia Worm Tries to Download, Install Patch From Microsoft Site
W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the operation system version of the infected machine is Chinese, Korean, or English, the worm attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then restart the computer. The worm also attempts to remove W32.Mydoom.A@mm and W32.Mydoom.B@mm worms. W32.Welchia.B.Worm exploits multiple vulnerabilities, including:
The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit. The worm's use of this exploit will impact Windows 2000 systems and may impact Windows NT/XP systems.
The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049).
The presence of the file %windir%\system32\drivers\svchost.exe is an indication of possible infection.
This threat is compressed with UPX.
Technical details are at this Symantec page.
--Compiled by Esther Shein
Nachi Worm Exploits Security Hole in Microsoft Windows
