This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
The worm attempts to spread over network shares by copying itself to the WINDOWS directory of remotely accessible machines as MQBKUP.EXE, utilizing a WIN.INI run key to load the worm at startup.
When run on the victim machine, the worm copies itself as %WinDir%\mqbkup.exe. To avoid being run twice the worm creates a mutex "mkbkup61616" (if such mutex already exists the worm process exits). The following Registry key is set to hook system startup:
Run "mqbkup" = %WinDir%\mqbkup.exe
Significant NetBIOS traffic (UDP) is caused by this worm. One of the early indications of this worms activity was the increase in port 137 hits on firewalls. This traffic is caused by the worm issuing WINS queries across contiguous IP ranges. The spreading mechanism observed in testing is outlined below:
Please Note: if this patch is installed, but the share is not password protected, the worm will still spread to the machine.
The worm attempts to spread to all machines on the local subnet in the above manner, (working through the subnet increasing the last octet of the IP address for each WINS query).
Subsequently, in testing the worm was observed to follow the above mechanism for machines in the IP range A.B.(C+1).0 to A.B.(C+1).255 (where A.B.C.x is the local subnet).
Following that, the mechanism was repeated continually, with an apparently random starting IP address (for example 22.214.171.124 -> 126.96.36.199). Once the final octet is incremented to 255, a new initial starting IP is queried.
Existence of either of the following Registry key:
Considerable port 137 traffic (UDP) originating from infected machine(s).
This worm spreads via network shares.
PayloadThe worm attempts drops a trojan, C:\MSLICENF.COM (detected as QZap248 with the 4240 DAT files), which can overwrite the boot sector, delete the CMOS, and delete the contents of the hard disk. Reference to this file is placed in the AUTOEXEC.BAT file. It then restarts the computer by dropping the file BOOT.EXE (detected as Reboot-V the 4240 DAT files), and running it. Upon reboot, the .COM file is executed. The following message is displayed.
Illegal Microsoft Windows license detected!
You are in violation of the Digital Millennium Copyright Act!
Your unauthorized license has been revoked.
For more information, please call us at:
If you are outside the USA, please look up the correct contact
information on our website, at:
Business Software Alliance
Promoting a safe & legal online world.
Security Patch for 'Share Level Password' Vulnerability (MS00-072)
To protect against reinfection by W32/Opaserv.worm (and similar such network aware viruses) ensure you obtain and install this patch from Microsoft. It is relevant to the following operating systems:
To read more information concerning the exploit and download the relevant patch, click here.It is also recommend that Win9x/ME users unbind File and Print Sharing from the TCP/IP protocol.
Note: The virus alters the WIN.INI file on remote systems after it copies itself to that system. Therefore, VirusScan may detect and remove the virus before the WIN.INI change occurs. In the scenario users may see an error message that the file SCRSVR.EXE (or other file names) cannot be found when starting Windows. To fix this, follow these steps:
In the event that the destructive payload activated, you may need to replace your boot sector with a valid one, contact your computer manufacturer to restore CMOS settings, and restore data, erased from the disk, from backup.