S
Steven Burn
The voodoo that Dumaru doesn't do too well.
By Mike Kemp
Posted: 26/01/2004 at 11:55 GMT
This weekend saw another iteration of email worm Dumaru. Unlike other email
worm variants, Dumaru.J spreads itself by way of a zip attachment (rather
than the typical executable). Of course, should users open the zipped file,
and click the file 'myphoto.jpg.56 (spaces). exe' Dumaru does its typically
annoying thing.
Dumaru is sent as an attached zip in an email with the subject line of
'Important information for you. Read it immediately!'. I f Dumaru.J is
executed, it attempts to create a copy of itself in the Windows System
directory as both l32x.exe and vxd32v.exe. Dumaru then attempts to save the
file rundllx.sys in the Windows directory. Dumaru.J also attempts to save a
copy of itself in the Windows Startup directory as dllxw.exe. Dumaru.J
creates the file zip.tmp in the Windows Temp directory as a copy of the worm
it e-mails to target addresses. The Windows registry
is modified to run the Trojan upon Windows start up:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
load32=C:\WINDOWS SYSTEM DIRECTORY\l32x.exe
Dumaru.J may also attempt to create the following registry key:
HKLM\Software\SARS
Once installed on an infected machine, Dumaru scans the hard drive for email
addresses to which it sends itself via its own SMTP engine on port 25.
Perhaps the most worrying feature of the worm though, is that it opens and
listens on TCP port 10,000 for remote commands, allowing unfettered system
access.
Although AV vendors rate Dumaru as a low to mid priority threat the fact
that it is transmitted as a zip file which many corporates allow, and when
installed the worm can be used for remote access are causes for conceqrn.
As always, the advice is to update AV signatures. The initial infecting
account appears to be the charmingly-titled '(e-mail address removed)', so
it's probably worth blocking that too.®
Copyright ©2004 The Register
Screenshots available at: http://www.theregister.co.uk/content/56/35105.html
--
Regards
Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk
Keeping it FREE!
Disclaimer:
I know I'm probably wrong, I just like taking part ;o)
By Mike Kemp
Posted: 26/01/2004 at 11:55 GMT
This weekend saw another iteration of email worm Dumaru. Unlike other email
worm variants, Dumaru.J spreads itself by way of a zip attachment (rather
than the typical executable). Of course, should users open the zipped file,
and click the file 'myphoto.jpg.56 (spaces). exe' Dumaru does its typically
annoying thing.
Dumaru is sent as an attached zip in an email with the subject line of
'Important information for you. Read it immediately!'. I f Dumaru.J is
executed, it attempts to create a copy of itself in the Windows System
directory as both l32x.exe and vxd32v.exe. Dumaru then attempts to save the
file rundllx.sys in the Windows directory. Dumaru.J also attempts to save a
copy of itself in the Windows Startup directory as dllxw.exe. Dumaru.J
creates the file zip.tmp in the Windows Temp directory as a copy of the worm
it e-mails to target addresses. The Windows registry
is modified to run the Trojan upon Windows start up:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
load32=C:\WINDOWS SYSTEM DIRECTORY\l32x.exe
Dumaru.J may also attempt to create the following registry key:
HKLM\Software\SARS
Once installed on an infected machine, Dumaru scans the hard drive for email
addresses to which it sends itself via its own SMTP engine on port 25.
Perhaps the most worrying feature of the worm though, is that it opens and
listens on TCP port 10,000 for remote commands, allowing unfettered system
access.
Although AV vendors rate Dumaru as a low to mid priority threat the fact
that it is transmitted as a zip file which many corporates allow, and when
installed the worm can be used for remote access are causes for conceqrn.
As always, the advice is to update AV signatures. The initial infecting
account appears to be the charmingly-titled '(e-mail address removed)', so
it's probably worth blocking that too.®
Copyright ©2004 The Register
Screenshots available at: http://www.theregister.co.uk/content/56/35105.html
--
Regards
Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk
Keeping it FREE!
Disclaimer:
I know I'm probably wrong, I just like taking part ;o)