Yeni Virüs - Worm/Avril.B - W32/Lirva.C

İsmi: Worm/Avril.B
Diğer isimleri: W32/Lirva.C
Tipi: Internet Solucanı
Boyutu: 34,815 KB
Platform: Windows

Worm/Avril.B, IDX, NCH, DBX, MBX, WAB, HTML, EML, HTM, TBB ve SHTML dosyalarını eposta adresleri için tarayıp bulduğu adreslere kendini göndererek ve mIRC ağı ile yayılan Worm/Avril.A'nın büyük ölçüde değiştirilmiş bir hali.

Bu varyant eposta ile aşağıdaki gibi geliyor:
Subject: Subject: <Aşağıdakilerden rastgele seçiliyor>

- Fw: Redirection error notification
- Re: Brigada Ocho Free membership
- Re: According to Purge's Statement
- Fw: Avril Lavigne - CHART ATTACK!
- Re: Reply on account for IIS-Security Breach (TFTP)
- Re: ACTR/ACCELS Transcriptions
- Re: IREX admits you to take in FSAU 2003
- Fwd: Re: Have U requested Avril Lavigne bio?
- Re: Reply on account for IFRAME-Security breach
- Fwd: Re: Reply on account for Incorrect MIME-header
- Re: Vote seniors masters - don't miss it!
- Fwd: RFC-0245 Specification requested...
- Fwd: RFC-0841 Specification requested...
- Fw: F. M. Dostoyevsky "Crime and Punishment"
- Re: Junior Achievement
- Re: Ha perduto qualque cosa signora?

Body:
Body1: AVRIL LAVIGNE - THE CHART ATTACK!

Vote fo4r Complicated!
Vote fo4r Sk8er Boi!
Vote fo4r I'm with you!
Chart attack active list:

Body2: Restricted area response team (RART)
--------------------------------------------------------------------------------
Attachment you sent to is intended to overwrite start address at 0000:HH4F
To prevent from the further buffer overflow attacks apply the MSO-patch

Body3: Network Associates weekly report:
Microsoft has identified a security vulnerability in Microsoft® IIS 4.0 and 5.0
that is eliminated by a previously-released patch.
Customers who have applied that patch are already protected against the vulnerability
and do not need to take additional action.
Microsoft strongly urges all customers using IIS 4.0 and 5.0 who have not already done so
to apply the patch immediately.

Patch is also provided to subscribed list of Microsoft® Tech Support:

Body4: AVRIL LAVIGNE - THE BEST

Avril Lavigne's popularity increases:>
SO: First, Vote on TRL for I'm With U!
Next, Update your pics database!
Chart attack active list .>.>

Attachment: <Aşağıdakilerden rastgele seçiliyor>

- Resume.exe
- ADialer.exe
- MSO-Patch-0071.exe
- MSO-Patch-0035.exe
- Two-Up-Secretly.exe
- Transcripts.exe
- Readme.exe
- AvrilSmiles.exe
- AvrilLavigne.exe
- Complicated.exe
- TrickerTape.exe
- Sophos.exe
- Cogito_Ergo_Sum.exe
- CERT-Vuln-Info.exe
- Sk8erBoi.exe
- IAmWiThYoU.exe
- Phantom.exe
- EntradoDePer.exe
- SiamoDiTe.exe
- BioData.exe
- ALavigne.exe

Solucanın kendini kopyaladığı klasörler:
- C:\Windows\temp\avril-ii.inf
- C:\Windows\temp\download.sys
- C:\Windows\System\<rastgele 11 karakter>.exe

Ayrıca c:\autoexec.bat dosyasına da aşağıdakileri ekliyor:
@win \RECYCLED\0cE26cHf.exe
@win \RECYCLED\Bbh1dFeD.exe
@win \RECYCLED\31c9a1Af.exe
@win \RECYCLED\25G0466A.exe

** dosya isimleri rastgele seçiliyor.

Makine her açıldığında otomatik olarak çalışması için registry'ye aşağıdaki anahtarları ekliyor:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
" Avril Lavigne - Muse"="C:\\WINDOWS\\SYSTEM\\<11 rastgele karakter>.exe"

- HKEY_LOCAL_MACHINE\Software\OvG\Avril Lavigne
@="Done"
" PSW-Trojan"="1"

Solucan Aşağıdaki programları arıyor ve bulduklarını kapatıyor:
- _Avp32.exe
- _avpcc.exe
- _avpm.exe
- Ackwin32.exe
- Anti-trojan.exe
- Apvxdwin.exe
- Autodown.exe
- Avconsol.exe
- Ave32.exe
- Avgctrl.exe
- Avkserv.exe
- Avp.exe
- Avp32.exe
- Avpcc.exe
- Avpdos32.exe
- Avpm.exe
- Avpmon.exe
- Avpnt.exe
- Avptc32.exe
- Avpupd.exe
- Avsched32.exe
- Avwin95.exe
- Avwupd32.exe
- Blackd.exe
- Blackice.exe
- Cfiadmin.exe
- Cfiaudit.exe
- Cfind.exe
- Claw95.exe
- Claw95ct.exe
- Cleaner.exe
- Cleaner3.exe
- Dv95.exe
- Dv95_o.exe
- Dvp95.exe
- Ecengine.exe
- Efinet32.exe
- Esafe.exe
- Espwatch.exe
- F-agnt95.exe
- Findviru.exe
- Fprot.exe
- F-prot.exe
- F-prot95.exe
- Fp-win.exe
- Frw.exe
- F-stopw.exe
- Iamapp.exe
- Iamserv.exe
- Ibmasn.exe
- Ibmavsp.exe
- Icload95.exe
- Icloadnt.exe
- Icmoon.exe
- Icssuppnt.exe
- Icsupp95.exe
- Iface.exe
- Iomon98.exe
- Jed.exe
- Kpf.exe
- Kpfw32.exe
- Lockdown2000.exe
- Lookout.exe
- Luall.exe
- Moolive.exe
- Mpftray.exe
- N32scan.exe
- Navapw32.exe
- Navlu32.exe
- Navnt.exe
- Navsched.exe
- Navw.exe
- Navw32.exe
- Navwnt.exe
- Nisum.exe
- Nmain.exe
- Normist.exe
- Nupgrade.exe
- Nvc95.exe
- Outpost.exe
- Padmin.exe
- Pavcl.exe
- Pccwin98.exe
- Pcfwallicon.exe
- Persfw.exe
- Rav7.exe
- Rav7win.exe
- Rescue.exe
- Safeweb.exe
- Scan32.exe
- Scan95.exe
- Scanpm.exe
- Scrscan.exe
- Serv95.exe
- Smc.exe
- Sphinx.exe
- Sweep95.exe
- Tbscan.exe
- Tca.exe
- Tds2-98.exe
- Tds2-nt.exe
- Vet95.exe
- Vettray.exe
- Vsecomr.exe
- Vshwin32.exe
- Vsscan40.exe
- Vsstat.exe
- Webscan.exe
- Webscanx.exe
- Wfindv32.exe
- Zonealarm.exe

Ayrıca isminde aşağıdakilerden birini içeren bir işlem bulursa sonlandırıyor:
- Norton
- AVP
- Anti
- Virus
- McAfee
- anti
- virus

Her ayın 7, 11 ve 24'ünde solucan ekranın ortasında renkli bir elips görüntülüyor ve sonrasında www.avril-lavigne.com web sitesini açmaya çalışıyor.

Makine her açıldığında virüsün 4 kopyası daha c:\recycled\<11 rastgele karakter>.exe olarak yaratılıyor ve c:\autoexec.bat'a 4 yeni kayıt daha giriliyor.

Ref: CentralCommand.com