Content

W32/Buchon.gen@MM

Type
Virus
SubType
E-mail worm
Discovery Date
10/21/2004
Length
30,752 bytes
Minimum DAT
4401 (10/27/2004)
Updated DAT
4900 (11/20/2006)
Minimum Engine
5.1.00
Description Added
10/21/2004
Description Modified
01/18/2006 12:55 AM (PT)
Risk Assessment
Corporate User
Low-Profiled
Home User
Low-Profiled

Tab Navigation

Characteristics

-- Update October 22nd 2004 --

The risk assessment of this threat has been deemed Low-Profiled due to the following media attention:

http://www.zdnet.com.au/news/security/0,2000061744,39163849,00.htm

The worm is referred to as a new Netsky variant within this article. (Upon analysis the worm is not considered to be a member of the W32/Netsky family, though detection as W32/Netsky.ah@MM existed in the beta DATs briefly.)

--

When this worm is run, it does not configure itself to load at system startup.  It does not mail as a ZIP attachment, nor does it use varying message characteristics or spread over network shares.  There are at least 2 such variants that were discovered today, with minor differences between them.  Testing shows the variants to contain bugs, which may prevent them from functioning on many systems.

This mass-mailing virus attempts to send itself to email addresses found on the local system.  The virus is received in an email message as follows:

To: recipients_email_address
From : recipients_email_address
Subject : Mail Delivery failure - recipients_email_address
Body :

If the message will not displayed automatically,
you can check original in attached message.txt

Failed message also saved at:
www.%your_domain_name% .com/inbox/security/read.asp?sessionid-%random_number%
(check attached instructions)

+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com

Attachment : message txt                                length %random number%  bytes                                                                    mcafee.com

When the attachment is manually executed on a Windows based system, the virus will attempt to drop a downloader trojan component to:

  • c:\csrss.exe

The trojan creates the following run key:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Run "Key Logger" = c:\csrss.exe

When run, the trojan creates the following file:

  • c:\csrss.bin

The virus attempts to harvest email addresses from files containing the following extensions:

  • .dbx
  • .wab
  • .mbx
  • .eml
  • .mdb
  • .tbb
  • .dat

Or files containing the following filename:

  • inbox

Viral messages are sent to the addresses that are harvested, as mentioned above.
Top of Page

Symptoms

The worm drops a trojan that contains a payload to send http requests to random IP addresses on random TCP ports (between 28000 - 28500).

Method of Infection

This worm spread via email.  If an infectious attachment is received and manually executed, the worm may use the infected host to spread itself to other email addresses.

Removal

All Users :
AVERT considers this to be a low risk threat.

Detection is already included in the Daily DAT files (beta) .

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

  • W32/Netsky.ah@MM (briefly)

Characteristics

Characteristics -

-- Update October 22nd 2004 --

The risk assessment of this threat has been deemed Low-Profiled due to the following media attention:

http://www.zdnet.com.au/news/security/0,2000061744,39163849,00.htm

The worm is referred to as a new Netsky variant within this article. (Upon analysis the worm is not considered to be a member of the W32/Netsky family, though detection as W32/Netsky.ah@MM existed in the beta DATs briefly.)

--

When this worm is run, it does not configure itself to load at system startup.  It does not mail as a ZIP attachment, nor does it use varying message characteristics or spread over network shares.  There are at least 2 such variants that were discovered today, with minor differences between them.  Testing shows the variants to contain bugs, which may prevent them from functioning on many systems.

This mass-mailing virus attempts to send itself to email addresses found on the local system.  The virus is received in an email message as follows:

To: recipients_email_address
From : recipients_email_address
Subject : Mail Delivery failure - recipients_email_address
Body :

If the message will not displayed automatically,
you can check original in attached message.txt

Failed message also saved at:
www.%your_domain_name% .com/inbox/security/read.asp?sessionid-%random_number%
(check attached instructions)

+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com

Attachment : message txt                                length %random number%  bytes                                                                    mcafee.com

When the attachment is manually executed on a Windows based system, the virus will attempt to drop a downloader trojan component to:

  • c:\csrss.exe

The trojan creates the following run key:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Run "Key Logger" = c:\csrss.exe

When run, the trojan creates the following file:

  • c:\csrss.bin

The virus attempts to harvest email addresses from files containing the following extensions:

  • .dbx
  • .wab
  • .mbx
  • .eml
  • .mdb
  • .tbb
  • .dat

Or files containing the following filename:

  • inbox

Viral messages are sent to the addresses that are harvested, as mentioned above.
Top of Page

Symptoms

Symptoms -

The worm drops a trojan that contains a payload to send http requests to random IP addresses on random TCP ports (between 28000 - 28500).

Method of Infection

Method of Infection -

This worm spread via email.  If an infectious attachment is received and manually executed, the worm may use the infected host to spread itself to other email addresses.

Removal -

Removal -

All Users :
AVERT considers this to be a low risk threat.

Detection is already included in the Daily DAT files (beta) .

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A