Full description

Alias:	Iworm_MTX, I-Worm.MTX, Matrix
Type:	Worm
Size:	18.483 Bytes
Origin:
Date:	11-09-2000
Damage:	Sent by email, Backdoor component.
VDF Version:	6.23.00.00
Danger:	Medium
Distribution:	Medium

DistributionThe worm detects when an email is composed an tries to attach a second email. This one contains no subject and body.

Attachment:
ALANIS_Screen_Saver.SCR
ANTI_CIH.EXE
AVP_updates.EXE
BILL_GATES_PIECE.JPG.pif
BLINK_182.MP3.pif
FEITICEIRA_NUA.JPG.pif
FREE_xxx_sites.TXT.pif
FUCKING_WITH_DOGS.SCR
Geocities_Free_Sites.TXT.pif
HANSON.SCR
INTERNET_SECURITY_FORUM.DOC.pif
IS_LINUS_GOOD_ENOUGH!.TXT.pif
I_am_sorry.DOC.pif
I_wanna_see_You.TXT.pif

Technical DetailsMTX has three components: virus, email worm and backdoor.

The Virus Component:
The virus is first decoded and then executed. It searches for active components of the following antivirus programs:
AntiViral Toolkit Pro
AVP Monitor
Vsstat
Webscanx
Avconsol
McAfee VirusScan
Vshwin32
Central do McAffee VirusScan
If it can find one of the above components, the virus is not activated!

Then, the virus decompresses its components and installs them in Windows directory. The following files are created:

IE_PACK.EXE - "clean" worm-code
WIN32.DLL - infected worm-code
MTX_.EXE - Backdoor code

The Worm Component:

The worm uses the file WSOCK32.DLL in Windows directory, adding parts of its code at the end of the file and a send command. Thus, the worm controls all emails sent from the infected system.
If WSOCK32.DLL is already in use and the worm can not add its code to it, then the worm creates a copy of this file, named WSOCK32.MTX, infects it and using an entry in WININIT.INI, replaces the original WSOCK32.DLL file with the infected WSOCK32.MTX:

NUL=C:\WINDOWS\SYSTEM\WSOCK32.DLLC:\%WinDIR%\%SystemDIR%\WSOCK32.DLL=
C:\WINDOWS\SYSTEM\WSOCK32.MTX

The Backdoor Component:

It enters a new registry key:
HKLM\Software\[MATRIX]
If the key is already made, the installation is skipped. If not, the backdoor is registered for the Auto Run Section: HKLM\Software\Microsoft\Windows\CurrentVersion\RunSystemBackup=%WinDir%\MTX_.EXE

說明撰寫者 Crony Walker 開啟 2004年6月15日星期二

返回 . . . .

我的帳戶