Win32.Worm.McMaggot.A
( MyDoom )| Propagação: | medium | |
| Estrago: | medium | |
| Tamanho: | ~450KB | |
| Descoberto: | 2008 Dec 02 |
SINTOMAS:
with data "%WinDir%\system32\vxworks.exe"
"QnX" in HKCU\Software\Microsoft\Windows\CurrentVersion\Run
with data "%WinDir%\system32\qnx.exe"
"HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" with value "qnx.exe"
Disk:
file vxworks.exe and qnx.exe in %WinDir%\system32\
file drm.ocx in %WinDir%\ (file has attribute hidden)
Network:
network activity on port 25
DESCRIÇÃO TÉCNICA:
Will lower your system security by editing registry key:
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations"
value
"LowRiskFileTypes"='.zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.bat;.cmd;.pif;.scr;.mov;.mp3;.wav'
This worm should also set registry key:
"HKCU\Software\Microsoft\Internet Explorer\Download"
values:
CheckExeSignatures="no"
RunInvalidSignatures=0x1
but because of a bug in its code, won't do this correctly.
It Will add itself to the firewall's Authorized applications list.
"HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" will add "%WinDir%\system32\vxworks.exe", this way windows firewall will permit internet activity for this worm.
Spreading mechanism:
"Windows XP PRO Corp SP3 valid-key generator.exe"
"Kaspersky Internet Security 2009 keygen.exe"
"Tuneup Ultilities 2008.exe"
"Joannas Horde Leveling Guide TBC Woltk.exe"
"Wow WoLTk keygen generator-sfx.exe"
"FOOTBALL MANAGER 2009.exe"
"Winamp.Pro.v6.53.PowerPack.Portable [XmaS edition].exe"
"Half life 3 preview 10 minutes gameplay video.exe"
"Sophos antivirus updater bypass.exe"
"xbox360 flashing tools and guide including bricked drive fix.exe"
"Google Earth Pro 4.2. with Maps and crack.exe"
"Ultimate xxx password generator 2009.exe"
"Perfect keylogger family edition with crack.exe"
"Divx Pro 6.8.0.19 + keymaker.exe"
"G-Force Platinum v3.7.5.exe"
"Power ISO v4.2 + keygen axxo.exe"
"Super Utilities Pro 2009 11.0.exe"
"CleanMyPC Registry Cleaner v6.02.exe"
"Alcohol 120 v1.9.7.exe"
"Silkroad Online guides and wallpapers.exe"
"Download Boost 2.0.exe"
"Daemon Tools Pro 4.11.exe"
"Absolute Video Converter 6.2.exe"
"Microsoft Visual Studio 2008 KeyGen.exe"
"Smart Draw 2008 keygen.exe"
"Motorola, nokia, ericsson mobil phone tools.exe"
"Nero 8 Ultra Edition 8.0.3.0 Full Retail.exe"
"Myspace theme collection.exe"
"Internet Download Manager V5.exe"
"Opera 10 cracked.exe"
"Download Accelerator Plus v8.7.5.exe"
"LimeWire Pro v4.18.3.exe"
"Acker DVD Ripper 2009.exe"
"Ultimate ring tones package3 (Crazy In Love, U Got It Bad, 50 Cent - P.I.M.P, Jennifer Lopez Feat. Ll Cool J - All I Have, 50 Cent - 21 Question).exe"
"Ultimate ring tones package2 (Lil Wayne - Way Of Life,Khia - My Neck My Back Like My Pussy And My Crack,Mario - Let Me Love You,R. Kelly - The Worlds Greatest).exe"
"Ultimate ring tones package1 (Beethoven,Bach, Baris Manco,Lambada,Chopin, Greensleves).exe"
"Norton Anti-Virus 2009 Enterprise Crack.exe"
"BitDefender AntiVirus 2009 Keygen.exe"
"Ad-aware 2008.exe"
"Red Alert 3 keygen and trainer.exe"
"TCN ISO SigmaX2 firmware.bin.exe"
"TCN ISO cable modem hacking tools.exe"
"WinRAR v3.x keygen RaZoR.exe"
"VmWare keygen.exe"
"Adobe Photoshop CS4 crack.exe"
"Adobe Acrobat Reader keygen.exe"
"Password Cracker.exe"
"Windows 2008 Enterprise Server VMWare Virtual Machine.exe"
"Youtube Music Downloader 1.0.exe"
"K-Lite codec pack 4.0 gold.exe"
This worm is also a mass-mailer using its own SMTP engine, like many others. It sends itself to the harvested e-mail addresses.
Mails can arrive in various types:
Subject: "Mcdonalds wishes you Merry Christmas!"
Sender: "giveaway@mcdonalds.com"
Attachment: coupon.zip
or
Subject: "Coca Cola is proud to accounce our new Christmas Promotion."
Sender: "noreply@coca-cola.com"
Attachment: promotion.zip
or
Subject: "You've received A Hallmark E-Card!'"
Sender: "postcards@hallmark.com"
Attachment: postcard.zip
Screen captures below



Attachments are compressed files, containing the worm itself.
Instruções para remoção:
Please let BitDefender remove your infected files.ANALISADO POR:
Marius TIVADAR, virus researcher




