McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Downloader.BO.B.dr (Symantec)

• TrojanDropper.VBS.Inor (Kaspersky)

• VBS/Inor (Panda)

• VBS/Maz.Worm (CA)

• VBS_INOR (Trend)

Characteristics

-- Update Oct 31, 2003--
Another mass-spamming of this trojan occurred today.  Under the file name undelivered.hta, the trojan creates the file c:\mware.exe,  which is the W32/Mimail.c@MM worm.

-- Update May 23, 2003--
Another large spamming of this trojan was sent yesterday. The 4.2.40 engine and current DATs detect this threat. The message is as follows:

Subject: Undelivered Mail Returned to Sender
Body: There were errors processing you mail. Please, read detailed information in the attachment
Attachment: Error.hta

-- Update May 09, 2003--
The risk assessment of this threat was updated to Low-Profiled due to media attention at the following site: http://www.infoworld.com/article/03/05/09/HNmothersday_1.html

-- Update May 07, 2003--
Periodically new variants of this trojan are spammed to a large number of email addresses. The latest round occurred yesterday with a message using the following information:

Subject: Warning: could not send message!
Attachment: Error.hta

When the attachment is run the following window appears:

This variant is detected with the current DAT files.
---- End Update ----

This threat is detected as Downloader-BO.dr. This threat has been known to have been SPAMMED to many users. The message may arrive as follows:

From: MAILER-DAEMON@%recipient domain%
Subject: FAILED DELIVERY
Body :

Unfortunately, it was not possible to deliver one or more of your messages. For more information, please, take a look in the attachment.

or Body:

Your message, attached
did not reach the reciepent. %number% @%recipient domain% #5.5.0 smtp; 550 Requested action not taken: mailbox unavailable.

Attachment: mail.hta

The MAIL.HTA attachment displays a fake skin cream advert in HTML format.

This HTA file contains an embedded VBScript.
The script will drop the file C:\sys615.scr or c:\Progra~1\Outloo~1\outl32.scr and execute it. This .SCR file is detected as Downloader-BO with the 4233 DAT files or higher.

Symptoms

The presence of the file C:\sys615.scr or c:\Progra~1\Outloo~1\outl32.scr.

Method of Infection

This trojan dropper arrives as an HTML file with an .HTA extension. This HTML file contains a VBScript that writes out an executable to the local file system.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Downloader.BO.B.dr (Symantec)

• TrojanDropper.VBS.Inor (Kaspersky)

• VBS/Inor (Panda)

• VBS/Maz.Worm (CA)

• VBS_INOR (Trend)

Characteristics

Characteristics -

-- Update Oct 31, 2003--
Another mass-spamming of this trojan occurred today.  Under the file name undelivered.hta, the trojan creates the file c:\mware.exe,  which is the W32/Mimail.c@MM worm.

-- Update May 23, 2003--
Another large spamming of this trojan was sent yesterday. The 4.2.40 engine and current DATs detect this threat. The message is as follows:

Subject: Undelivered Mail Returned to Sender
Body: There were errors processing you mail. Please, read detailed information in the attachment
Attachment: Error.hta

-- Update May 09, 2003--
The risk assessment of this threat was updated to Low-Profiled due to media attention at the following site: http://www.infoworld.com/article/03/05/09/HNmothersday_1.html

-- Update May 07, 2003--
Periodically new variants of this trojan are spammed to a large number of email addresses. The latest round occurred yesterday with a message using the following information:

Subject: Warning: could not send message!
Attachment: Error.hta

When the attachment is run the following window appears:

This variant is detected with the current DAT files.
---- End Update ----

This threat is detected as Downloader-BO.dr. This threat has been known to have been SPAMMED to many users. The message may arrive as follows:

From: MAILER-DAEMON@%recipient domain%
Subject: FAILED DELIVERY
Body :

Unfortunately, it was not possible to deliver one or more of your messages. For more information, please, take a look in the attachment.

or Body:

Your message, attached
did not reach the reciepent. %number% @%recipient domain% #5.5.0 smtp; 550 Requested action not taken: mailbox unavailable.

Attachment: mail.hta

The MAIL.HTA attachment displays a fake skin cream advert in HTML format.

This HTA file contains an embedded VBScript.
The script will drop the file C:\sys615.scr or c:\Progra~1\Outloo~1\outl32.scr and execute it. This .SCR file is detected as Downloader-BO with the 4233 DAT files or higher.

Symptoms

Symptoms -

The presence of the file C:\sys615.scr or c:\Progra~1\Outloo~1\outl32.scr.

Method of Infection

Method of Infection -

This trojan dropper arrives as an HTML file with an .HTA extension. This HTML file contains a VBScript that writes out an executable to the local file system.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Variants

Variants -

N/A