McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• BSD.Worm.Scalper (Softwin)

• ELF.Scalper.A (CA VET)

• ELF.Scalper.B (CA VET)

• ELF/FreeApworm

• ELF/Scalper-A (Sophos)

• ELF/Scalper.A.Worm (InnoculateIT)

• ELF/Scalper.B.Worm (InnoculateIT)

• ELF_SCALPER.A (Trend)

• FreeBSD.Ehcapa.51199 (DrWeb)

• FreeBSD.Ehcapa.51626 (DrWeb)

• FreeBSD.Scalper.51199 (DrWeb)

• FreeBSD.Scalper.51626 (DrWeb)

• FreeBSD.Scalper.Worm (NAV)

• FreeBSD/Scalper.A (ESET)

• FreeBSD/Scalper.B (ESET)

• FreeBSD/Scapler.worm (GeCAD)

• I-Worm.FreeBSD.Scalper.A (ViRobot)

• I-Worm.FreeBSD.Scalper.B (ViRobot)

• Linux.Scapler.Worm (NAV)

• Linux/Ehcapa.worm

• Unix.Scalper.A (VirusBuster)

• Unix.Scalper.B (VirusBuster)

• Unix.Worm.Scalper.A (Softwin)

• Unix.Worm.Scalper.B (Softwin)

• Unix/Scalper (GRISoft)

• Unix/Scalper.A (F-Prot, Panda)

• Unix/Scalper.B (Panda)

• Unix/Scalper.worm.gen

Characteristics

This worm spreads over Apache web servers on FreeBSD by using the Chunked Encoding exploit.

It first sends an ordinary request to the server. If it gets a reply back saying that the server is Apache it will send the exploit regardless of the target server being vulnerable or not.

The worm appears to give an attacker remote control abilities, including DDoS capability. Each worm installation keeps in memory a list of all the IPs infected from it so that all infected servers are connected in a tree like fashion. Commands sent to one node propagate to its children and include:

• execution of arbitrary commands,
• udp, tcp, mail, dns, http, raw floods to specific hosts,
• retrieve the emails from the entire file system,
• attack a specific server,
• update the children node list to extend the tree structure to a generic graph,
• self update. When an update is issued from the parent worm, the new binary is uploaded into the file /tmp/init and started. After that the parent process kills itself.

There are two variants, 51,199 bytes and 51,626 bytes long (the available sources suggest there may be four different variants compiled for different situations).

Symptoms

Excess Internet activity.
Presence of *.a and *.uua files

Method of Infection

This worm uses an exploit in the FreeBSD Apache server.

Removal

Detection is included in the specified DAT release.

In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.

Delete files identified by the scanner, replace them with clean ones from backup or re-install them using the original packages. Reboot the system.

Administrators should regularly check for availability of important security updates/patches.

Recommended links:

Caldera

Debian

FreeBSD

Redhat

Sun

SuSe

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• BSD.Worm.Scalper (Softwin)

• ELF.Scalper.A (CA VET)

• ELF.Scalper.B (CA VET)

• ELF/FreeApworm

• ELF/Scalper-A (Sophos)

• ELF/Scalper.A.Worm (InnoculateIT)

• ELF/Scalper.B.Worm (InnoculateIT)

• ELF_SCALPER.A (Trend)

• FreeBSD.Ehcapa.51199 (DrWeb)

• FreeBSD.Ehcapa.51626 (DrWeb)

• FreeBSD.Scalper.51199 (DrWeb)

• FreeBSD.Scalper.51626 (DrWeb)

• FreeBSD.Scalper.Worm (NAV)

• FreeBSD/Scalper.A (ESET)

• FreeBSD/Scalper.B (ESET)

• FreeBSD/Scapler.worm (GeCAD)

• I-Worm.FreeBSD.Scalper.A (ViRobot)

• I-Worm.FreeBSD.Scalper.B (ViRobot)

• Linux.Scapler.Worm (NAV)

• Linux/Ehcapa.worm

• Unix.Scalper.A (VirusBuster)

• Unix.Scalper.B (VirusBuster)

• Unix.Worm.Scalper.A (Softwin)

• Unix.Worm.Scalper.B (Softwin)

• Unix/Scalper (GRISoft)

• Unix/Scalper.A (F-Prot, Panda)

• Unix/Scalper.B (Panda)

• Unix/Scalper.worm.gen

Characteristics

Characteristics -

This worm spreads over Apache web servers on FreeBSD by using the Chunked Encoding exploit.

It first sends an ordinary request to the server. If it gets a reply back saying that the server is Apache it will send the exploit regardless of the target server being vulnerable or not.

The worm appears to give an attacker remote control abilities, including DDoS capability. Each worm installation keeps in memory a list of all the IPs infected from it so that all infected servers are connected in a tree like fashion. Commands sent to one node propagate to its children and include:

• execution of arbitrary commands,
• udp, tcp, mail, dns, http, raw floods to specific hosts,
• retrieve the emails from the entire file system,
• attack a specific server,
• update the children node list to extend the tree structure to a generic graph,
• self update. When an update is issued from the parent worm, the new binary is uploaded into the file /tmp/init and started. After that the parent process kills itself.

There are two variants, 51,199 bytes and 51,626 bytes long (the available sources suggest there may be four different variants compiled for different situations).

Symptoms

Symptoms -

Excess Internet activity.
Presence of *.a and *.uua files

Method of Infection

Method of Infection -

This worm uses an exploit in the FreeBSD Apache server.

Removal -

Removal -

Detection is included in the specified DAT release.

In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.

Delete files identified by the scanner, replace them with clean ones from backup or re-install them using the original packages. Reboot the system.

Administrators should regularly check for availability of important security updates/patches.

Recommended links:

Caldera

Debian

FreeBSD

Redhat

Sun

SuSe

Variants

Variants -

N/A