McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

W32/Gant.b@MM

This page shows details and results of our analysis on the malware W32/Gant.b@MM

Threat Detail

Malware Type: Virus

Malware Sub-type: N/A

Discovery Date: 2003-05-18

Next Steps:

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.


Minimum DAT

4266 (2003-05-21)

Updated DAT

4266 (2003-05-21)

 Minimum Engine

N/A

File Length

17.920 bytes (UPX)

Description Added

2003-05-19

Description Modified

2003-05-19

Malware Proliferation

Characteristics

This W32/Gant@MM variant had been proactively detected as variant of W32/Generic.a@MM using 4.2.40 engine and 4253 DATs or greater. The characteristics of this worm is very much similar to the first variant.

A fake error message is first displayed ("A required .DLL file, MSVBVM60.dll, was not found") when run. After clicking on "ok", the worm proceeds to mail itself to everyone in the Windows Address Book. It attempts to propagate via mass-mailing itself to recipients listed in the Outlook Address Book, and via P2P file-sharing networks after executing.

This worm also contains a destructive payload, which terminates the process of various anti-virus software and firewall services.

Email Propagation

The email may arrive in any of the below formats and filenames:

Subject: Modem booster
Attachment: ModemBooster.exe

Subject: Better than WinZip?
Attachment: FileCompress.exe

Subject: Warp ScreenSaver
Attachment: WarpScreen.scr

Subject: Program
Attachment: Winprg32.pif

Subject: Fire ScreenSaver
Attachment: FireScreen.scr

Subject:
Attachment: Msprg32.pif

P2P Propgation

The worm also attempts to spread through Kazaa by copying itself into the folders typically configured for sharing. It may use the following filenames:

  • Johnny English (Movie) - Full Downloader.pif
  • Gladiator (Movie) - Full Downloader.pif
  • SwordFish (Movie) - Full Downloader.pif
  • MSN Messenger Password Stealer.pif
  • Norton AntiVirus
  • Full.exe
  • Hotmail Password Cracker.pif
  • Jasc Paint Shop Pro 7 (Full).pif
  • ScreenSaver.scr
  • Microsoft Office

Backdoor Component

This worm also contains a backdoor component, which when run opens a list of ports on the victim's computer. The port range is between 1060-1079. An email containing information about the victim's computer will be sent to the following address:

To: msctrl32@hotmail.com
Subject: DUN information
Attachment: Inetdun32.txt OR Inetcon32.txt
Body: Captured DUN information (in attachments).

Symptoms

The worm drops copies of itself in the default %WINDIR% directory.

  • Keymapp32.exe
  • Msdnssrv.exe
(Where %WINDIR% is the default Windows System directory, for example C:\WINNT, C:\WINDOWS etc.)

The following registry keys are added to execute itself at startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"Msctrl32" = C:\winnt\Msctrl32.scr

Presence of the The following Registry keys:

  • HKEY_LoCAL_MACHINE\Software\Zed
  • HKEY_LoCAL_MACHINE\Software\Zed\Outsider

Method of Infection

Infection occurs upon executing the worm, which may arrive as an email attachment or via Kazaa.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

United States - English