I-Worm.Dumaru.j
Danger : moderate risk
This worm is part of the Dumaru family, which spreads via the Internet
as files attached to infected messages. The worm includes a backdoor function
and a Trojan program which enables it to steal information. The worm is
a Windows PE EXE file, compressed using FSG. The compressed file is approximately
17KB in size, and the decompressed file approximately 43 KB in size.
Installation
When installing, the worm copies itself to the Windows system directory
under the names l32.exe and vxd32.exe, and to the startup directory under
the name dllxw.exe.
It registers itself in the system register as a key to enable autorun:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
load32 = %windir%\%system%\l32x.exe
On computers running under Windows 95,98 and ME, the worm changes a
section in the system.ini file
[boot]
shell=explorer.exe %System%\vxd32v.exe
Mailing of messages
The worm searches all directories on accessible local disks for files
with the extensions: .htm, .wab, .html, .dbx, .tbb, .abd, highlights lines
which are email addresses and then sends infected messages to these address.
To do this, the worm creates a Zip archive (zip.tmp) in the Windows temporary
directory, which will then be added to messages as an attachment.
The worm also creates a file called winload.log in the Windows directory,
and writes all email addresses found, to which infected messages have been
sent, to this file. Infected messages have the following characteristics:
Sender's address:
Elene F*****SUICIDE@HOTMAIL.COM
Message header:
Important information for you. Read it immediately !
Message body:
Hi !
Here is my photo, that you asked for yesterday.
Attachment:
myphoto.zip
In order to send messages, the worm uses its own SMTP engine, giving
the return address as address@dyandex.ru. All notifications sent by mail
scanners about the fact that the worm has been detected in messages will
therefore be sent to this address.
Other
The worm opens port 10000 to receive commands for administration of
the infected computer. The worm also has a keyboard logging function, and
is able to save all information entered via the keyboard to a separate
file.
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
270104/090904
