New worm attacking MS05-039 vulnerability
McAfee
McAfee is reporting an outbreak of a new worm that affects Windows 2000 and pre Windows XP SP2 users.
Quote:
This worm exploits the MS05-039 vulnerability. There are at least 2 other W32/Sdbot based worms know to exist that also exploit this vulnerability. They may be seen with the filenames pnpsrv.exe or winpnp.exe.
See http://vil.nai.com/vil/content/v_135434.htm
This self-executing worm spreads by exploiting Windows2000 MS05-039 vulnerable systems in order to instruct those systems to download and execute the worm.
|
Quote:
The worm creates the file botzor.exe in the WINDOWS SYSTEM directory and registry run keys are created to load the worm at startup:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
Run "WINDOWS SYSTEM" = botzor.exe
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
RunServices "WINDOWS SYSTEM" = botzor.exe
An additional registry change is made:
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\
SharedAccess "Start" = 4 (default is 3)
The HOSTS file is appended to block access to anti-virus websites. Appended HOSTS files are proactively detected as QHosts-35.
The worm contains BOT functionality. It attempts to connect to diabl0.turkcoders.net on TCP port 8080 and join a specified channel to wait for further instructions. Commands include:
* sysinfo (RAM, OS, uptime)
* download (to download and run a file)
* remove (to remove the worm)
|
Another reason to make sure you patch fully before letting PCs onto the internet.
|
