Full Disclosure mailing list archives
No one else seeing the new MS05-039 worm yet?
From: Vic Vandal <vvandal () well com>
Date: Mon, 29 Aug 2005 22:10:05 -0700 (PDT)
This has been going around since early Monday afternoon. Symantec and other AV vendors have had code since then, and no details STILL. I guess one can call it the Katrina worm until something better comes along. Details: - Exploits MS05-039, but also MS04-011 and MS03-026. - Scans on port 5000 and 135. - On workstations opens up range of listening ports above 1024, visible with "netstat -a". - Creates 40K svc.exe and several randomly named LARGE .exe files in: C:\WINNT directory. - Sticks a long line of hosts resolving to broadcast address in: C:\WINNT\System32\Drivers\etc in hosts file. - Adds reg key(s) under: HKLM\Software\Microsoft\Windows\CurrentVersion\Run which are those random .exe file names mentioned above. - May create svc.exe and exe.tmp reg keys under: HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\(machine key)\ FilesNamedMRU (may be unrelated, not generally found on infected box). - Prevents killing processes via Task Manager (all processes backed by gray color, clicking individual processes does nothing). - One can use other utilities to kill running malware processes. - Symantec may report as Bobax.Z@mm and/or W32.HLLW.Nebiwo. Cleanup: - Backup registry. - Delete malware-related reg keys as noted. - Delete malware-related files. - Re-check registry, as executables may enter new values before all cleanup actions complete. - Edit hosts file, removing added data and saving afterward. - Empty Recycle Bin. - Patch infected machine. - Reboot. - Verify that symptoms are gone. I've not had time to decompile code to dig out other details, but cleanup routine seems sufficient for most part. Have had working routine since early afternoon, and expected details from vendors long before now. Peace, Vic _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- No one else seeing the new MS05-039 worm yet? Vic Vandal (Aug 29)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Vic Vandal (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Something Anonymous (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Willem Koenings (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? fd (Aug 30)
- <Possible follow-ups>
- Re: No one else seeing the new MS05-039 worm yet? Peter Ferrie (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)