McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

Exploit-Wuloit

This page shows details and results of our analysis on the malware Exploit-Wuloit

Threat Detail

Malware Type: Malware

Malware Sub-type: Exploit

Discovery Date: 2003-09-16

Next Steps:

Overview


Minimum DAT

4295 (2003-09-24)

Updated DAT

4295 (2003-09-24)

 Minimum Engine

5.1.00

File Length

39065 , 42384

 Description Added

2003-09-16

Description Modified

2003-09-19

Malware Proliferation

Characteristics

Detection of Exploit-Wuloit was added to cover for a malicious file called wu262.exe . This file is a 32 bit PE file having a filesize of 39065 bytes, the .b variant has a filesize of 42384 bytes.

These Windows PE executables actually target Linux/Openbsd systems, making use of WU exploits. The .a variant targets RedHat Linux 6.x, the .b variant targets OpenBSD 3.0 wu 2-6-0/1/2.

By entering the target IP/hostname remote systems can be remotely exploited and thus be compromised. It tries to connect by ftpd.

Symptoms

-Presence of wu262.exe . This file is a 32 bit PE file having a filesize of 39065 bytes, the .b variant has a filesize of 42384 bytes.

-Compromised Linux/Openbsd systems

-It tries to connect by ftpd.

Method of Infection

-It tries to remotely connect to Linux/Openbsd systems to exploit/compromise them. It connects by ftpd.

-Note that the windows file wu262.exe actually needs a file called cygwin1.dll in order for it to work and fails to work properly if the file is missing.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

Variants

United States - English