Worm/Sober.D - Worm

See also

Full description

Alias:	I-Worm.Sober.D, W32.Sober.D@mm, Win32.Sober.D@mm
Type:	Worm
Size:	33,792 bytes
Origin:	unknown
Date:	03-08-2004
Damage:	Sends itself by email
VDF Version:	6.24.00.43
Danger:	Low
Distribution:	High

General DescriptionWorm/Sober.D is using its own smtp engine to send itself to the email addresses found on the infected system. The generated e-mail has the subject and body in German or English language, depending on e-mail address domain. The attachment consists of a file with the extensions .exe or .zip.

SymptomsWhen the worm is launched, a message window will be generated, having the string "%Filename%" in the titlebar, where %Filename% is the name of the infected file.

Distribution* Sends itself via email using its own smtp engine

Technical DetailsThe worm Sober.D was also developed like its predecessors in Visual Basic 6.0 (German version) and packed with UPX. Again the UPX headers were later altered, in order to make unpacking more difficult with conventional means.

The worm copies itself with a random name in %System%. This file name is randomlly built up from two of the following strings:

* sys
* host
* you
* more explorer
* win
* run
* log
* 32
* disc
* crypt
* data
* diag
* spool
* service
* smss32

Additionally the files temp32x.data and wintmpx33.dat will also be created in the %System% folder.

The worm will create the two following registry keys:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\spool]
"dirrun"="C:\\WINNT\\System32\\%Variable File Name%.exe"
* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce]
"winlog"="C:\\WINNT\\System32\\%Variable File Name%.exe %1"

Sober contains its own smtp engine for sending emails. The subject of the send email is selected depending on destination address from the following list:

* German:
Microsoft Alarm: Bitte Lesen! Message-ID: %variable Character%.qmail@microsoft.com>
* English:
Microsoft Alert: Please READ! Message ID: %variable Character%.qmail@microsoft.com>

The E-Mail Body:

* German:
Neue Virus-Variante W32.Mydoom verbreitet sich schnell.
Eine neue Mydoom-Variante verbreitet sich derzeit rasend schnell im Internet.
Wie seine Vorgänger verschickt sich der Wurm von infizierten Windows-Rechnern per E-Mail an weitere Adressen.
Zudem installiert er auf infizierten Systemen einen gefährlichen Trojaner!
Führende Virenspezialisten melden bereis ein vermehrtes Aufkommen des W32.Mydoom alias W32.Novarg.
Bitte daten Sie Ihr System mit dem Patch ab, um sich vor diesem Schädling zu sch?zen!

+++ ©2004 Microsoft Corporation. Alle Rechte vorbehalten.
+++ Microsoft Deutschland GmbH, Konrad-Zuse-Strasse
+++ 85716 Unterschleissheim, HRB 70438, DE 129 415 943

* English:
New MyDoom virus Variant Detected!
A new variant OF the W32.Mydoom (W32.Novarg) worm spread rapidly through the InterNet.
Anti-virus vendor cent ral COMMAND claims that 1 MyDoom virus the in 45 enamels contains.
The worm thus has A backdoor Trojan capability.
By default, the Trojan component listing on haven 13468.
Protection:
Please down load this digitally signed attachment.
This update of includes the functionality OF previously released patches.

+++ ©2004 Microsoft corporation. All rights reserved.
+++ One Microsoft Way, talking moon, Washington 98052
+++ Restricted Rights RK 48 CFR 52.227-19

Next the worm will attach itself to the generated email selecting a random name for the attachment, like:

* Patch
* Ms Security
* MS-UD
* Update
* sys patch
* MS-Q

The file attached will also have a random number combination in it's name. The file extension is selected also randomelly and is either zip or exe.

The worm collects e-mail addresses from the following file types:

* htt, rtf, doc, xls, ini, mdb, txt, htm, HTML, wab, pst, fdb, cfg, ldb, eml, ABC, ldif, nab, adp, mdw, mda, mde, ade, sln, dsw, dsp, vap, php, NSF, asp, shtml, shtm, dbx, hlp, mht, nfo

The collected e-mail addresses will be stored in the file mslogs32.dll which will be created in the Windows %System% folder.

Manual Remove Instructions- for Windows 2000/XP:

In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

c:\%windows%\%system%\%Zufallsname%.exe
c:\%windows%\%system%\temp32x.data
c:\%windows%\%system%\wintmpx33.dat c:\%windows%\%system%\mslogs32.dll

Start "regedit" after that and delete the following registry entries:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\spool]
"dirrun"="C:\\%windows%\\%system%\\<%random name%>.exe"

and

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce]
"winlog"="C:\\%windows%\\%system%\\<%random name% > %1"

Restart your computer.

- for Windows 9x/Me:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

c:\%windows%\%system%\%Zufallsname%.exe
c:\%windows%\%system%\temp32x.data
c:\%windows%\%system%\wintmpx33.dat c:\%windows%\%system%\mslogs32.dll

Start "regedit" after that and delete the following registry entries:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\spool]
"dirrun"="C:\\%windows%\\%system%\\<%random name%>.exe"

and

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce]
"winlog"="C:\\%windows%\\%system%\\<%random name% > %1"

Restart your computer.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back