McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• WORM_DABBER.A (Trend)

Characteristics

-- Update May 14, 2004 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at::
http://news.com.com/2100%2D7349_3%2D5212284.html
--

This self-executing worm spreads by exploiting systems that are already infected with the W32/Sasser.worm.a  virus.

The worm spreads with the file name: package.exe .  Unlike many recent worms, this virus does not spread via email.  No user intervention is required to become infected or propagate the virus further.  The worm works by instructing vulnerable systems to download and execute the viral code.

Symptoms

The virus copies itself to the Windows directory as package.exe and creates the following registry keys:

•  HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Run
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\RunServices

Note:  The keys above do not have any values added to them, and they may exist prior to infection.

The worm creates an entry to start itself by adding the following:

•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "sassfix" = package.exe

It also copies itself to the STARTUP folder:

• c:\Documents and Settings\All Users\Start Menu\Programs\Startup\package.exe
• \All Users\Main menu\Programs\StartUp\package.exe

The worm scans random subnets, hitting sequential IP addresses, as it listens on successive TCP ports.  It also acts as a tftp server and contains a backdoor, listening on TCP port 9898.

Method of Infection

The worm spreads via systems that have been previously infected by W32/Sasser.worm.a .  Dabber scans sequential IP address looking for Sasser infected systems by send SYN packets to TCP Port 5554.  When a system is found to be listening, it is instructed to download and execute the worm from the infected host via tftp.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• WORM_DABBER.A (Trend)

Characteristics

Characteristics -

-- Update May 14, 2004 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at::
http://news.com.com/2100%2D7349_3%2D5212284.html
--

This self-executing worm spreads by exploiting systems that are already infected with the W32/Sasser.worm.a  virus.

The worm spreads with the file name: package.exe .  Unlike many recent worms, this virus does not spread via email.  No user intervention is required to become infected or propagate the virus further.  The worm works by instructing vulnerable systems to download and execute the viral code.

Symptoms

Symptoms -

The virus copies itself to the Windows directory as package.exe and creates the following registry keys:

•  HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Run
•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\RunServices

Note:  The keys above do not have any values added to them, and they may exist prior to infection.

The worm creates an entry to start itself by adding the following:

•  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "sassfix" = package.exe

It also copies itself to the STARTUP folder:

• c:\Documents and Settings\All Users\Start Menu\Programs\Startup\package.exe
• \All Users\Main menu\Programs\StartUp\package.exe

The worm scans random subnets, hitting sequential IP addresses, as it listens on successive TCP ports.  It also acts as a tftp server and contains a backdoor, listening on TCP port 9898.

Method of Infection

Method of Infection -

The worm spreads via systems that have been previously infected by W32/Sasser.worm.a .  Dabber scans sequential IP address looking for Sasser infected systems by send SYN packets to TCP Port 5554.  When a system is found to be listening, it is instructed to download and execute the worm from the infected host via tftp.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A