New worm attacking MS05-039 vulnerability

[Paul K]

McAfee
McAfee is reporting an outbreak of a new worm that affects Windows 2000 and pre Windows XP SP2 users.

This worm exploits the MS05-039 vulnerability. There are at least 2 other W32/Sdbot based worms know to exist that also exploit this vulnerability. They may be seen with the filenames pnpsrv.exe or winpnp.exe.
See http://vil.nai.com/vil/content/v_135434.htm

This self-executing worm spreads by exploiting Windows2000 MS05-039 vulnerable systems in order to instruct those systems to download and execute the worm.

The worm creates the file botzor.exe in the WINDOWS SYSTEM directory and registry run keys are created to load the worm at startup:

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
Run "WINDOWS SYSTEM" = botzor.exe
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
RunServices "WINDOWS SYSTEM" = botzor.exe

An additional registry change is made:

* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\
SharedAccess "Start" = 4 (default is 3)

The HOSTS file is appended to block access to anti-virus websites. Appended HOSTS files are proactively detected as QHosts-35.

The worm contains BOT functionality. It attempts to connect to diabl0.turkcoders.net on TCP port 8080 and join a specified channel to wait for further instructions. Commands include:

* sysinfo (RAM, OS, uptime)
* download (to download and run a file)
* remove (to remove the worm)

Another reason to make sure you patch fully before letting PCs onto the internet.

[Gareth]

Good call, Paul .

Spent this morning re-checking we were fully patched at work... not that it would get through the firewall anyway, but policies dictate .

There's also a good piece about this at Sophos... http://www.sophos.com/virusinfo/articles/zotob.html