HAL-PC Virus, Anti-Virus and Worm Information and Microsoft Critical Updates

W32.HLLW.Gaobot.AZ is a minor variant of W32.HLLW.Gaobot.AP that attempts to spread to network shares and allows access to an infected computer through an IRC channel.

The worm uses multiple vulnerabilities to spread, including:

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.

The worm can arrive as an email attachment. The subject, body, and From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail. It often pretends to be a patch from Microsoft that patches the system for newly discovered vulnerabilities.

W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses that it finds in the files with the following extensions:

The Sobig.F worm is spreading virulently through the internet. The e-mail message that carries Sobig.F carries the message "Please see attached file for details" and one of the following subject lines:

Subject:

Re: Details
Re: Approved
Re: Re: My details
Re: Thank you!
Re: That movie
Re: Wicked screensaver
Re: Your application
Thank you!
Your details

If a recipient clicks on the attachment, which has one of a number of names ending in the .pif file extension, the computer will be infected.

Attachment names:

your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif

The virus will then send itself out to names found in the victim's address book and will use one of these names to forge a return address. As such, the infected party may not quickly learn of the infection, while an innocent party may get the blame for helping to propagate it.

You may receive virus infection notices from systems across the internet, claiming that a message you sent had the Sobig.F worm attached. Because of the way the worm operates, your email address was 'spoofed' -- pulled at random out of the actual offending user's email address book. Please just ignore and delete these messages.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, OS/2, UNIX, Windows 3.x

NOTE: The worm is due to deactivate on September 10, 2003. The last day on which the worm will spread is September 9, 2003.

Symantec Security Response

W32.Welchia.Worm

August 19, 2003 - Symantec

W32.Welchia.Worm is a worm that exploits multiple vulnerabilities:

exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
exploits the WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit.

The worm attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer. The worm checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic. The worm will also attempt to remove W32.Blaster.Worm. Compromises security settings: Installs a TFTP server on all infected machines.

For removal tool and instructions, see: Symantec Security Response

W32/Blaster

UPDATE: WORM_MSBLAST.A is a high risk alert for all users
Aliases: W32/Lovsan.worm, W32/Blaster-A, W32.Blaster.Worm, Worm.Win32.Lovesan

See: McAffeeSecurity

August 5, 2003 - Symantec

W32.Blaster.Worm is a worm that uses a published flaw in Microsoft's Windows operating systems (described in Microsoft Security Bulletin MS03-026) to spread via network connections, without using e-mail. This worm attempts to download and run the Msblast.exe file. The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.

TO TRY AND STOP THE "SHUTDOWN" (W32.Blaster) VIRUS:

There is a process (program running) called "msblast"
Boot the computer up, Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for msblast.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.
Once done immediately download and install the MS patch.
- Windows XP Patch
- Windows 2000 Patch

Symantec Security Response information
Symantec W32.Blaster.Worm Removal Tool

W32/Mimail@MM

August 5, 2003 - Network Associates

This malware bears similarities to Downloader-DK, which was spammed several days ago. This threat may have also been spammed. It is received as an email attachment as follows:

From: Admin (ADMIN@your_domain)
Subject: your account %user%
Importance: High
Hello there, I would like to inform you about important information regarding your email address. This email address will be expiring. Please read attachment for details.
--- Best regards, Administrator
Attachment: message.zip

The attached .ZIP file contains a file named MESSAGE.HTM. This file uses the codebase exploit to automatically create the file foo.exe in the Temporary Internet Files folder and run it. The following files are created in the WINDOWS (%WinDir%) directory:

videodrv.exe (19,824 bytes)
exe.tmp (20,445 bytes)
zip.tmp (20,567 bytes)

More information is available at this Network Associates page.

W32/Bugbear.b@MM

June 8, 2003 - McAfee

A virulent derivative of the Bugbear virus is curculating. This version infects a large number of files on affected computers, ends processes belonging to security programs, opens the port 1080, captures keystrokes and allows a hacker to gain remote access to the resources of the computer.

For details, see: McAfee website & Symantec website

JS/Fortnight.b@M

February 3, 2003 - McAfee

This script virus resides on a website. When users visit this page, a link to this webpage is appended to their email signature file for Outlook Express 5.0. When an infected user manually sends out an email message, a link will appear at the bottom pointing to a web page on this site. The link to the infected webpage is included in an IFrame, so if the receiving e-mail client supported HTML, the page would open automatically and be displayed inside the e-mail message.

The virus will create the file s.htm in the WINDOWS directory which contains the IFrame link to the infected website address.

It will then create an invalid Windows 'hosts' file. The Windows HOSTS file serves to associate host names with IP addresses. It is queried prior to any DNS queries being issued. The hosts file dropped by this virus contains of a list of URLs, each associated with a bogus IP address.

The code on the web page activates by using the Microsoft VM ActiveX vulnerability. This vulnerability has been fixed, and a patch is available from Microsoft

For details, see: McAfee Website & F-Secure Virus Descriptions

PWSteal.Netsnake

November 9, 2002 - Symantec

PWSteal.Netsnake is a Trojan horse that steals passwords. It collects user passwords and mails them to the intruder. After the Trojan copies itself, it It adds the value Internat.exe %windir%\internat.exe to the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the Trojan runs when you start Windows. When it runs at startup, it displays the message Hello. I'm NetSnake.

For details, see: Symantec Security Response

W32.Bugbear@mm

October 3, 2002 - McAfee

W32/Bugbear@MM is rated as HIGH RISK FOR HOME AND CORPORATE USERS. This mass-mailing worm attempts to send itself to email addresses found on an infected system. It also spreads through open network shares and has the ability to send print jobs to printers found on an infected network.

Once the virus is run, it will attempt to disable various security products, including many forms of anti-virus and personal firewall software. It will also attempt to install a backdoor trojan that will allow a hacker access to the infected PC.

This virus spreads via email and via network shares. It makes use of the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability in Microsoft Internet Explorer (v 5.01 or 5.5 without SP2). Simply opening or previewing an infected message in a vulnerable email reader can result in infection.

This virus can "spoof" the "from" field, by combining random elements to form a fake "from" address.

For details, see:
Symantec Security Response
McAfee
Sophos

I-Worm/Klez.E

April 30, 2002 (Symantec upgrade to category 4)

The spread of the Klez worm family has reached epidemic proportions.

This W32/Klez variant has the ability to spoof the email from field. The senders address used by the virus, is one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Viewing the entire email header will display the actual senders address.

This worm makes use of Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2)

This worm arrives in an Email message with a subject and body randomly composed from a rather long pool of strings that the virus carries inside itself. The worm interferes with running programs and frequently displays a fake error message. This virus can also unload several antivirus programs from memory. W32/Klez.e@MM sends itself out using SMTP protocol. It harvests the Windows address book for email addresses.

Refer to your virus protection software website for removal instructions.

MyLife

March 21, 2002 This mass-mailing worm, written in Visual Basic 6, uses Microsoft Outlook to send itself to all addresses in the Outlook Address book and addresses on the MSN Messenger contact list. It arrives in an email containing the following information:

MyLife virus screen shot

When executed, the worm propagates itself to all addresses found in the Outlook Address book and addresses on the MSN Messenger contact list, using Microsoft Outlook. The worm copies itself to the System folder, modifying the Registry to run this copy at subsequent startup.

Upon restarting the machine, the worm does not propagate again, and the above image is not displayed. When the worm is run from the SYSTEM directory and the hour is 8am, the worm deletes the following files:

* *.* from C:\ D:\ E:\ and F:\
* *.SYS, *.VXD, *.OCX and *.NLS from C:\WINDOWS\SYSTEM

See your antivirus update site for removal instructions.

Hybris

March 13, 2002 This old favorite is causing trouble again. Hybris arrives in an email with the following characteristics:

From: Hahaha [hahaha@sexyfun.net]
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Body: Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at morning, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter...
Attachment: sexy virgin.scr or joke.exe or midgets.scr or dwarf4you.exe

When first executed, this worm tries to infect the WSOCK32.DLL file in the WINDOWS\SYSTEM directory. First it tries to infect the WSOCK32.DLL file directly. If it fails because the file is already in use, then it creates an infected copy on the WSOCK32.DLL in a new file. This new file goes by an extensionless filename made up of 8 random characters. A line is then created in the WININIT.INI file to rename this newly created file to WSOCK32.DLL, thus overwriting the original WSOCK32.DLL file. This change takes place the next time the system is booted. A registry value under Software\Microsoft\Windows\CurrentVersion\RunOnce\(default) is also created to run the worm at the next bootup, in case the previous attempts to infect WSOCK32.DLL fail.

The modified WSOCK32.DLL file watches all Internet activity and attempts to mail a copy of the worm, in the form of a .EXE or .SCR file, to any valid e-mail address sent over the Internet connection, whether part of a e-mail message, web page, or newsgroup posting. W32/Hybris.gen@M is sent unknowingly by the infected user.

For removal instructions, please see:
http://www.symantec.com/avcenter/venc/data/w95.hybris.worm.html or http://securityresponse.symantec.com/avcenter/venc/data/w95.hybris.gen.html

W32/Gibe@MM

March 7, 2002 (Symantec)

W32.Gibe@mm is a worm that uses Microsoft Outlook and its own SMTP engine to spread. This worm arrives in an email message--which is disguised as a Microsoft Internet Security Update--as the attachment Q216309.exe:

From: Microsoft Corporation Security Center
Subject: Internet Security Update
Message:
Microsoft Customer,
this is the latest version of security update, the update which eliminates all known security vulnerabilities affecting Internet Explorer and MS Outlook/Express as well as six new vulnerabilities
.
.
.
How to install
Run attached file q216309.exe
How to use
You don't need to do anything after installing this item.
.
.
.
Attachment: Q216309.exe

The attached file, Q216309.exe, is written in Visual Basic; it contains other worm components inside itself. To remove the virus, delete files that are detected as W32.Gibe@mm, delete the 02_N803.dat file, and remove the key and values that the worm added to the registry. See the website of your antivirus software for details.

W32/MyParty-A

January 28, 2002 (Sophos)

W32/MyParty-A is a Windows 32 email-aware worm which arrives as an email with the following characteristics:

Subject: new photos from my party!

Message text:

Hello!

My party... It was absolutely amazing! I have attached my web page with new photos! If you can please make color prints of my photos. Thanks!

Attached filename: www.myparty.yahoo.com

Some people may be fooled into believing the attached file is a link to a website. If the attached file is executed between 25 January and 29 January 2002 (inclusive) the worm sends a copy of itself to everybody in the Windows Address book (except the current user) using a built in SMTP engine. The worm also sends an email to napster@gala.net to track its spread. In addition the worm drops a copy of the Trojan Troj/Msstake-A in the user's startup directory. The Trojan is contained in a file named msstask.exe.

Check with your virus protection software website for removal instructions.

JS.Gigger.A

January 11, 2002 (Symantec)

JS.Gigger.A@mm is a worm written in JavaScript. It uses Microsoft Outlook and mIRC to spread. It attempts to delete all files on the computer and to format drive C if the computer is successfully restarted.

JS.Gigger.A@mm arrives as an email message that has the following characteristics:

Subject: Outlook Express Update
Message: MSNSofware Co.
Attachement: Mmsn_offline.htm

See: Symantec website for removal instructions.

Maldal

December 20, 2001 (Trend Micro)

This destructive, memory-resident worm is a Visual Basic-compiled Windows executable. It propagates via email using Microsoft Outlook. It arrives in an email with the details:

Subject: Happy New Year
Message Body: Hii
I can’t describe my feelings
But all i can say is
Happy New Year :)
Bye
Attachment: CHRISTMAS.EXE

Its destructive payload deletes files in the Windows system directory.

See the Trend Micro web site for removal instructions.

WORM_SHOHO.A

F-Secure Security Information Center - December 20, 2001

The Welya worm utilises it's own SMTP engine so it does not depend on Outlook for e-mail sending. The recipient addresses are collected from different files in the system, e.g: *.wab files (Windows Address Book), *.mbx (Mailbox). See TrendMicro's web site for removal instructions

Gokar

December 15, 2001

Gokar is a yet another Windows executable worm propagated by Microsoft Outlook and mIRC. Although it apparently is not actively distructive, it installs a backdoor in the infected system through the mIRC application.

Manual Removal Instructions

To manually clean infected systems:

Delete the %Windows%\KAREN.EXE file. %Windows% is variable. It is the directory where your Windows folder is located. This is usually at C:\Windows so that the file to be deleted is found at C:\Windows\KAREN.EXE.
Click Start > Run, type Regedit then hit the Enter key:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run>Karen
Look for the following and delete it: C:\MIRC\SCRIPT.INI
Close the Registry.
Restore the file C:\INETPUB\WWWROOT\DEFAULT.HTM from backup.
Delete the file C:\INETPUB\WWWROOT\REDESI.HTM.
Delete the file C:\INETPUB\WWWROOT\WEB.EXE.

Goner/Pentagone

Internet Security Systems Security Alert
December 4, 2001

Goner is a new virulent e- mail worm that is currently propagating rapidly. The worm is disguised as an .SCR screensaver file and is propagated via email and the ICQ chat network. Goner is mildly destructive and generates a large amount of network traffic, which may overload network devices and email gateways. Goner also attempts to disable personal firewall and antivirus software. Users who rely on these products may or may not be protected. In addition, the Goner worm contains a powerful distributed denial of service (DDoS) component, which may enable attackers to control infected systems over the IRC (Internet Relay Chat) network to initiate flooding attacks on targets.

Description:
The Goner worm infects Microsoft Outlook and Microsoft Outlook Express users by delivering the worm executable in the form of an .SCR file attachment. The filename is GONE.SCR. This file needs to be manually executed by the user to spread. The body and subject each infected email is identical. Upon infection, the Goner worm will send a copy of itself to every contact in the user's address book.

Microsoft Outlook 2002 will block potentially harmful attachments by default. Outlook 2002 will also prompt users with the following information in a dialog box if the worm is executed:

A program is trying to access e-mail addresses you have stored in Outlook. Do you want to allow this?

If this is unexpected, it may be a virus and you should choose "No".

The following is an example of infected email message:

Subject: Hi
How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!

Attachment: GONE.SCR

The worm also has the ability to propagate via ICQ if it is installed. Goner uses ICQ's ICQMAPI.DLL interface to send copies of itself to all contacts that are currently online. The contact must approve the file transfer to receive a copy of the worm. The contact must then execute the file in order to be infected. The worm also includes a backdoor to infect mIRC installations, so that they can be used to launch IRC-based distributed denial of service attacks.

The Goner worm copies itself to the infected user's hard drive, and then points a registry key to the file location to execute the worm each time the system reboots. The following registry key is created: \

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ Run\%System%\gone.scr = %System%\gone.scr

Goner also attempts to disable antivirus and personal firewall software. The list of antivirus and personal firewall executables appears to have been taken from a previous worm, known as I-Worm.fog. More information on the I-Worm.fog email worm is available at: http://www.avp.ch/avpve/worms/email/fog.stm

Recommendations:
All users and system administrators should update their antivirus software and initiate a virus scan.

Network administrators may choose to filter ICQ traffic during an infection to block further propagation. ICQ client to server communication is conducted over TCP port 5190. Network administrators may also block the worm's communication over IRC by blocking the host, "twisted.ma.us.dal.net".

Consider upgrading Microsoft Outlook email clients to Outlook 2002. Outlook 2002 has many security features that will block the propagation of Goner and many other worms.

To remove the Goner worm from your system:

Manual Cleaning on Windows 95/98/Me Systems:

Reboot the computer.
Before the startup logo appears, press F8.
Choose the "Command prompt only" option.
Go to the %System% directory. %System% is variable. It is usually located at C:\Windows\System.
At the command prompt, type the following command then hit the Enter key:
attrib –s –h –r gone.scr
Type the following command and then hit the Enter key to delete the Worm file:
del gone.scr
Restart the computer.
Double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run>%System%
Look for the following registry entry and then delete it:
gone.scr
Delete all files named REMOTE32.INI in your mIRC folders.
Either delete or restore from backup the file MIRC.INI.
Manual Cleaning on Windows NT/2000 Systems:

Kill all running instances of the worm in the task manager. Look for applications named "pentagone" and for processes named gone.scr. Kill these processes.
Scan your system with your antivirus software and delete all files detected as WORM_GONE.A. You can use Trend Micro's free online virus scanner.
Remove the registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\%System%\gone.scr
Delete all files named REMOTE32.INI in your mIRC folders.
Either delete or restore from backup the file MIRC.INI.

Valentine Storm Variant

FAKE PATCH EMAIL

FAKE HAL-PC.ORG SUPPORT EMAIL

W32.Nyxem.E.mm, aka W32.Blackmal.E@mm, Kama Sutra Worm

Windows Metafile (WMF) Image Vulnerability

W32.Sober.X@mm

W32.Mytob.MC@mm

W32.Mytob.LO@mm

W32.Zotob.A-E@mm

W32.Mytob.ES@mm

Trojan.Ascetic.C

W32.Mydoom.BO@mm

W32.Sober.O@mm

W32.Beagle.BG@mm & .BH@mm

TROJ_BAGLE.BE

W32.Erkez.D@mm

W32.Sober.i@mm

W32.Mydoom.AB@mm

W32.Mexer.E@mm

W32.Mydoom.m@mm

W32.BeagleAG@mm

Internet Explorer BHO Exploit

Download.ject

W32.Paps.A@mm

W32/Zafi.b@MM

W32.Netsup.A@mm

W32.Sober.G@mm

W32.Bobax.C

W32.Sasser.E.worm

W32/Sasser.worm

W32.Netsky.Y,Z@mm

W32.Sober.F@mm

W32.Witty.Worm

W32.Beagle.*@mm

W32/Bagle.J@mm

W32.Netsky.C,D,E@mm

W32.Netsky.B@mm

W32.Novarg.A@mm/I-WormMydoom

W32.Beagle.B@mm

W32.Mimail.L@mm

W32.Mimail.I@mm & J@mm

W32.Yaha.AF@mm

W32.Mimail.C@mm

Trojan.Qhosts

JS.Fortnight.D

Sober@mm

W32.Marque.Worm

W32.Wintoo.B.Worm

PWSteal.Firum

W32.HLLW.Gaobot.AZ

W32.Swen.A@mm

W32.Sobig.F@mm

W32.Welchia.Worm

W32/Blaster

W32/Mimail@MM

W32/Bugbear.b@MM

JS/Fortnight.b@M

PWSteal.Netsnake

W32.Bugbear@mm

I-Worm/Klez.E

MyLife

Hybris

W32/Gibe@MM

W32/MyParty-A

JS.Gigger.A

Maldal

WORM_SHOHO.A

Gokar

Goner/Pentagone

Badtrans.B

Magistr

NIMDA

Sircam

MS Security Alert worm

Malicious Virus Hoax

Homepage

Anti-Virus Web Sites