W32/Mytob.hg@MM

This detection is for a mass-mailing worm that combines W32/Mydoom@MM functionality with W32/Sdbot.worm functionality. Its behavior is largely similar to other W32/Mytob variants.

This variant also drops NTRootKit-P Trojan to hide the running process.

Mail Propagation

The virus arrives in an e-mail message as follows:

From: (Spoofed email sender - may be chosen from the following list)

The apparent sender address should not be assumed to be an indication of infection. Additionally, one may receive alert messages from a mail server warning of a hoax infection.

• support
• administrator  
• mail   
• service
• admin
• info   
• register   
• webmaster

Subject: (Varies, such as)

• Warning Message: Your services near to be closed.
• Members Support
• Important Notification
• Your Account is Suspended
• *DETECTED* Online User Violation
• YOUR NEW ACCOUNT PASSWORD IS APPROVED

Body: (Varies, such as)

Names used in To: Field

• bobsherman
• wab2
• user1
• sam
• frank
• wab1
• debby
• wab3

Mail Attachment Names

• account-details.zip
• account-report.zip
• important-details.zip
• readme.zip
• umkbgmz.zip
• account-password.zip

Other than the common W32/Mytob.gen@MM symptoms, this variant will make following system changes.

System Changes

Files Added

• %WINDIR% \system32\rofl.sys
• %WINDIR% \skype32.exe

Registry

The following registry keys are created:

• hkey_local_machine\software\policies\microsoft\windows
  \windowsupdate\donotallowxpsp2="1"
  
• hkey_local_machine\software\microsoft\security center
  \updatesdisablenotify="1"
  \firewalldisablenotify="1"
  \antivirusoverride="1"
  \firewalloverride="1"
  \antivirusdisablenotify="1"
  
• hkey_local_machine\software\policies\microsoft\windowsfirewall
  \standardprofile\enablefirewall="0"
  
• hkey_local_machine\system\currentcontrolset\services\skype
  \displayname="Skype Messenger"
  \type="32"
  \imagepath=""%WINDIR% \skype32.exe""
  \errorcontrol="0"
  \start="2"
  \security\security="(binary registry data)
  \objectname="LocalSystem"
  
• hkey_local_machine\system\currentcontrolset\services\rofl
  \imagepath="\??\%WINDIR% \system32\rofl.sys"
  \displayname="rofl"
  \description="Skype Messenger Service"
  \errorcontrol="1"
  \security\security="(binary registry data)
  \failureactions="(binary registry data)
  type="1"
  start="3"
  
• hkey_local_machine\system\currentcontrolset\services\messenger
  \start="4"
  
• hkey_local_machine\software\microsoft\windows\currentversion
  \shell extensions\installed time="%time%"
  
• hkey_local_machine\software\microsoft\windows\currentversion
  \windowsupdate\auto update\auoptions="1"
  
• hkey_current_user\software\microsoft\windows\currentversion
  \internet settings\zonemap\\intranetname="1"
  
• hkey_local_machine\system\currentcontrolset\services
  \remoteregistry\start="4"
  
• hkey_local_machine\system\currentcontrolset\control\lsa
  \restrictanonymous="1"
  
• hkey_local_machine\system\currentcontrolset\services\lanmanserver
  \parameters\autoshareserver="0"
  
• hkey_current_user\software\microsoft\windows\currentversion
  \internet settings\zonemap\\uncasintranet="1"
  
• hkey_local_machine\software\microsoft\ole\enabledcom="78"
  
• hkey_local_machine\system\currentcontrolset\services\lanmanserver
  \parameters\autosharewks="0"
  
• hkey_local_machine\system\currentcontrolset\control
  \waittokillservicetimeout="7000"
  
• hkey_current_user\software\microsoft\windows\currentversion
  \internet settings\zonemap\\proxybypass="1"
  
• hkey_local_machine\system\currentcontrolset\services\tlntsvr
  \start="4"
  
• hkey_local_machine\software\microsoft\windows\currentversion
  \shell extensions\record="data"
  
• hkey_local_machine\system\currentcontrolset\services
  \lanmanworkstation\parameters\autoshareserver="0"
  
• hkey_local_machine\system\currentcontrolset\enum\root
  \legacy_skype\0000\control\activeservice="Skype"
  
• hkey_local_machine\software\microsoft\windows\currentversion
  \shell extensions\meltme="%original path of binary%"

The Sdbot functionality in the worm is designed to contact the following IRC server, join a specified channel, and wait for further instructions:

• tx.hax[hidden].info    (channel names: #dfnctsc and #dfnctsc-s)
  

This virus propagates using an identical strategy as most other Mytob variants through harvesting e-mail addresses from selected files on the compromised system, and generating new e-mail addresses. Details of this behavior is depicted in the VIL description for W32/Mytob.gen@MM .

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.