[OT] WARNING: Dumaru.J Virus arrives in e-mail as .zip file

[Steven Burn]

Following quoted from:

The Register
http://www.theregister.co.uk/content/56/35105.html

The voodoo that Dumaru doesn't do too well.
By Mike Kemp
Posted: 26/01/2004 at 11:55 GMT

This weekend saw another iteration of email worm Dumaru. Unlike other email
worm variants, Dumaru.J spreads itself by way of a zip attachment (rather
than the typical executable). Of course, should users open the zipped file,
and click the file 'myphoto.jpg.56 (spaces). exe' Dumaru does its typically
annoying thing.

Dumaru is sent as an attached zip in an email with the subject line of
'Important information for you. Read it immediately!'. I f Dumaru.J is
executed, it attempts to create a copy of itself in the Windows System
directory as both l32x.exe and vxd32v.exe. Dumaru then attempts to save the
file rundllx.sys in the Windows directory. Dumaru.J also attempts to save a
copy of itself in the Windows Startup directory as dllxw.exe. Dumaru.J
creates the file zip.tmp in the Windows Temp directory as a copy of the worm
it e-mails to target addresses. The Windows registry
is modified to run the Trojan upon Windows start up:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
load32=C:\WINDOWS SYSTEM DIRECTORY\l32x.exe

Dumaru.J may also attempt to create the following registry key:

HKLM\Software\SARS

Once installed on an infected machine, Dumaru scans the hard drive for email
addresses to which it sends itself via its own SMTP engine on port 25.

Perhaps the most worrying feature of the worm though, is that it opens and
listens on TCP port 10,000 for remote commands, allowing unfettered system
access.

Although AV vendors rate Dumaru as a low to mid priority threat the fact
that it is transmitted as a zip file which many corporates allow, and when
installed the worm can be used for remote access are causes for conceqrn.

As always, the advice is to update AV signatures. The initial infecting
account appears to be the charmingly-titled '(e-mail address removed)', so
it's probably worth blocking that too.®


--
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Disclaimer:
I know I'm probably wrong, I just like taking part ;o)

 

[PCR]

Thanks for the warning. Nothing is safe anymore, with this one & the one
Bear posted about.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
(e-mail address removed)
| Following quoted from:
|
| The Register
| http://www.theregister.co.uk/content/56/35105.html
|
| The voodoo that Dumaru doesn't do too well.
| By Mike Kemp
| Posted: 26/01/2004 at 11:55 GMT
|
| This weekend saw another iteration of email worm Dumaru. Unlike other
email
| worm variants, Dumaru.J spreads itself by way of a zip attachment
(rather
| than the typical executable). Of course, should users open the zipped
file,
| and click the file 'myphoto.jpg.56 (spaces). exe' Dumaru does its
typically
| annoying thing.
|
| Dumaru is sent as an attached zip in an email with the subject line of
| 'Important information for you. Read it immediately!'. I f Dumaru.J is
| executed, it attempts to create a copy of itself in the Windows System
| directory as both l32x.exe and vxd32v.exe. Dumaru then attempts to
save the
| file rundllx.sys in the Windows directory. Dumaru.J also attempts to
save a
| copy of itself in the Windows Startup directory as dllxw.exe. Dumaru.J
| creates the file zip.tmp in the Windows Temp directory as a copy of
the worm
| it e-mails to target addresses. The Windows registry
| is modified to run the Trojan upon Windows start up:
|
| HKLM\Software\Microsoft\Windows\CurrentVersion\Run
| load32=C:\WINDOWS SYSTEM DIRECTORY\l32x.exe
|
| Dumaru.J may also attempt to create the following registry key:
|
| HKLM\Software\SARS
|
| Once installed on an infected machine, Dumaru scans the hard drive for
email
| addresses to which it sends itself via its own SMTP engine on port 25.
|
| Perhaps the most worrying feature of the worm though, is that it opens
and
| listens on TCP port 10,000 for remote commands, allowing unfettered
system
| access.
|
| Although AV vendors rate Dumaru as a low to mid priority threat the
fact
| that it is transmitted as a zip file which many corporates allow, and
when
| installed the worm can be used for remote access are causes for
conceqrn.
|
| As always, the advice is to update AV signatures. The initial
infecting
| account appears to be the charmingly-titled
'(e-mail address removed)', so
| it's probably worth blocking that too.®
|
|
| --
| Regards
|
| Steven Burn
| Ur I.T. Mate Group
| www.it-mate.co.uk
|
| Keeping it FREE!
|
| Disclaimer:
| I know I'm probably wrong, I just like taking part ;o)
|
|
|