|
--- Update September 04, 2001 ---
AVERT has raised the risk assessment of this threat to Medium
on Watch due to numerous confirmed reports from the field.
This threat is detected heuristically as New Backdoor prior
to the 4157 DATs (with the 4100-4156 DATs).
This is the only known version of this worm to date. However,
users may notice a different size
README.EXE file attached to the message as described below. This
is due to the fact that W32/APost@MM sends whichever README.EXE
file is found in the WINDOWS directory, even if that file is not
the worm. One such file which has been seen is an old Quicktime
2.0 Windows Read Me document, packaged with the Common Ground
Mini Viewer (172,067 bytes). The samples received are clean of
infection. However, it is important to note that due to this anomaly,
other README.EXE files could be sent by this worm, which could
possibly be infected with a number of different viruses or trojans.
This worm arrives with an email message containing the following
information:
Subject: As per your request!
Body:
Please find attached file for your review.
I look forward to hear from you again very soon. Thank you.
Attachment: README.EXE (24,576 bytes long)
Running the attachment causes the worm to check for the presence
of README.EXE in the WINDOWS directory. If one does not exist,
the worm copies itself to that directory. Next, it copies whichever
README.EXE file is in the WINDOWS directory to the root of all
local drives and creates a registry run key to load that program
at startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\macrosoft=C:\WINDOWS\readme.exe
The worm sends a copy of itself to every entry in the user's
Microsoft Outlook Address Book and then displays a small dialog
box titled "Urgent!". This dialog box contains one single large
button labeled "Open".
If this button is pressed then the worm sends out further copies
of itself and then displays an error message box with the title
"WinZip SelfExtractor: Warning" and containing the error message
"CRC error: 34#".
After the error message box is acknowledged the worm terminates.
|
