Threat Encyclopedia

W32/SpyBot!worm

Analysis

• Copies itself to the Windows folder as the hidden file winstep32.exe. It sets the file time to be the same as the the program explorer.exe, found in the Windows folder. It then deletes the original file.
  
• Creates a mutex named Nan0t3k.
  
• Adds the value:

  Intel Proc = undefinedWINDOWSundefined\winstep32.exe, where undefinedWINDOWSundefined refers to the Windows folder

  to the registry subkeys
  

  HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

• Adds the value:

  EnableDCOM = "N"

  to the registry subkey
  

  HKLM\Software\Microsoft\OLE

• Adds the values:

  restrictanonymous = 1
  restrictanonymoussam = 1

  to the registry subkey
  

  HKLM\SYSTEM\CurrentControlSet\Control\Lsa

• Copies itself into the following folders:
  
  • Documents and Settings\All Users\Start Menu\Programs\Startup
  • Dokumente und Einstellungen\All Users\Start Menu\Programs\Startup
  • Documenti e Impostazioni\All Users\Start Menu\Programs\Startup
  • WINDOWS\Start Menu\Programs\Startup
  • WINNT\Profiles\All Users\Start Menu\Programs\Startup
  • WINDOWS\All Users\Start Menu\Programs\StartUp
  • Documents and Settings\All Users\Menu Start\Programma's\Opstarten
  
  
• Modifies the HOSTS file, blocking some antivirus websites.
  
• Attempts to terminate certain processes, such as:
  
  • AVSERVE.EXE
  • MSNSS.EXE
  • REGSVC32.EXE
  • REGSVS.EXE
  • WINBOT.EXE
  • WINDOW.EXE
  • WINLINK32.EXE
  • WUPDATED.EXE
  
  
• Connects to transistor.101main.com and the Internet Relay Chat (IRC) server hotsx0r.org and joins a channel. It then sends user information to the server and waits for remote malicious commands from the worm's author.
  
• Opens backdoors on TCP port 113 and a random port.
  
• Uses the Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) Vulnerability to spread.

Recommended Action

FortiGate systems:

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option

  Patch

• Download and install the patch for the Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability at http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx