NUEVA VERSION VIRUS SASSER.F , SE CONTROLA DESDE DATS 4359

Cerrado
Avatar de Usuario
msc hotline sat
Administrador
Administrador
Mensajes: 93124
Registrado: 09 Mar 2004, 20:39
Ubicación: BARCELONA (ESPAÑA)
Contactar:

NUEVA VERSION VIRUS SASSER.F , SE CONTROLA DESDE DATS 4359

Mensaje por msc hotline sat » 11 May 2004, 13:49

McAfee informa de una nueva variante del Sasser, la F, que se controla a partir de los DATS 4359, que ya están disponibles



Se recomienda a los usuarios de McAfee actualizar a esta nueva version de hoy, que además de controlar este nueva variante, tambien controla la nueva variante AB del Bagle y la anterior variante E del Sasser



Descripcion de McAfee del Sasser.F:



__________________________________________



Virus Name Risk Assessment

W32/Sasser.worm.f Corporate User : Low

Home User : Low







Virus Information

Discovery Date: 05/11/2004

Origin: Unknown

Length: 74,752 bytes (packed)

Type: Virus

SubType: Internet Worm

Minimum DAT: 4359 (05/10/2004)

Updated DAT: 4359 (05/10/2004)

Minimum Engine: 4.2.40

Description Added: 05/10/2004

Description Modified: 05/11/2004 12:52 AM (PT)

Description Menu

Virus Characteristics

Symptoms

Method Of Infection

Removal Instructions

Variants / Aliases

Rate This page

Print This Page

Email This Page

Legend







Virus Characteristics:

This new variant is similar to W32/Sasser.worm.a. It has been repacked using PECompact and is proactively detected as Exploit-DcomRpc using engine 4.3.20 together with DATs 4288 and above. This detection requires the scanning of compressed executables to be enabled



This variant differs from W32/Sasser.worm.a in the filename and registry keys it uses:



Uses the filename napatch.exe (74,752)

This self-executing worm spread by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]



Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.



Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:



http://www.microsoft.com/en/us/default.aspxtechnet/security/bulletin/MS04-011.mspx



Top of Page



Symptoms

The virus copies itself to the Windows directory as NAPATCH.EXE and creates a registry run key to load itself at startup



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

CurrentVersion\Run "napatch.exe" = %WinDir%\napatch.exe

As the worm scans random IP addresses, it listens on successive TCP ports starting at 1047. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.



A file named winlog2 is created on the root of the C: drive. This file contains an IP address together with the number of machines infected.



Copies of the worm are created in the Windows System directory as #_up.exe.



Examples



C:\WINDOWS\System32\11583_up.exe

C:\WINDOWS\System32\16913_up.exe

C:\WINDOWS\System32\29739_up.exe

A side-effect of the worm is for LSASS.EXE to crash, by default such a system will reboot after the crash occurs. The following Window may be displayed:











Top of Page



Method Of Infection

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.



The propagation mechanism is akin to that for previous variants:



the worm scans random IP addresses for exploitable systems. When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.

It creates a remote shell on TCP port 9996.

Next it creates an FTP script named cmd.ftp on the remote host and executes it. Via the FTP script, the FTP.EXE application is used to retrieve the worm from the infected machine (port 9996) to the remote host. The worm is then executed.

the FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as mentioned above) from the infected host.

The infected host accepts this FTP traffic on TCP port 9996.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets. The worm scans public ranges like 10.0.0.0 and 192.168.0.0 only if they are part of the local subnet. The destination port is TCP 445.





__________________________________________



Con la nueva version 1.4 del ELISASSA.EXE que subiremos esta tarde a esta web, ya se elimina esta además de las anteriores versiones del W32/SASSER



saludos



ms, 11-05-2004

Cerrado

Volver a “ALERTAS VIRICAS y utilidades de eliminacion”