W32/Discoball.worm

This page shows details and results of our analysis on the malware W32/Discoball.worm

Download Current DAT: 6615

Threat Detail

Malware Type: Virus

Malware Sub-type: Worm

Discovery Date: 2003-02-06

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Minimum DAT

4247 (2003-02-12)

Updated DAT

4247 (2003-02-12)

Minimum Engine

5.1.00

File Length

206,336 bytes

Description Added

2003-02-07

Description Modified

2003-02-10

Malware Proliferation

Characteristics

This worm spreads via network shares. When run, it copies itself to the WINDOWS and WINDOWS SYSTEM directories:

%WinDir%\MDBOLE.EXE
%SysDir%\SEG32.EXE
%SysDir%\WINS.EXE

Also dropped is a file named INT13EXT.VXD (6,772 bytes) in the SYSTEM directory. Several registry keys are created:

HKEY_LOCAL_MACHINE\Software\K32 "T" = REG_DWORD:A0, BB, 0D, 00
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run "(Default)" = C:\WINDOWS\SYSTEM\WINS.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunOnce "(Default)" = C:\WINDOWS\SYSTEM\WINS.EXE
HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\
RunServices "(Default)" = C:\WINDOWS\SYSTEM\WINS.EXE
HKEY_CLASSES_ROOT\exefile\shell\open\
command "(Default)" = C:\WINDOWS\SYSTEM\seg32.exe "%1" %*

The worm attempts to send an email message, using its own SMTP engine. First it attempts to connect to the POP server pop.pochtamt.ru and authenticate with specified credentials. If successful, the SMTP server smtp.pochtamt.ru is used to send a message:

From: rundll32@pochtamt.ru
Subject: INFO
To: rundll32@pochtamt.ru

The purpose of this message seems to simply be for the author to track the number of infected systems.

The worm connects to all available visible shares, as well as 3 hidden shares:

C$
D$
IPC$

If a directory named WINDOWS or WINNT is found on the share, the following files are written in that directory:

Mdbole.cfg
Mdbole.exe

The remote WIN.INI file is modified to run the worm at startup.

[windows] run=MDBOLE.EXE
[boot] shell=Explorer.exe MDBOLE.EXE

Symptoms

Presence of the following files:

%WinDir%\MDBOLE.EXE
%SysDir%\SEG32.EXE
%SysDir%\WINS.EXE
%SysDir%\INT13EXT.VXD

Method of Infection

This worm spreads via network shares.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations