Mutant son of MyDoom plans three-pronged attack
Virus writers have used code from the infamous Mydoom
worm to create a potentially dangerous new Internet worm which uses multiple
methods to spread.
Plexus-A
spreads using three different methods: infected email attachments, file-sharing
networks and Windows vulnerabilities (the LSASS vulnerability used by Sasser
and the RPC DCOM flaw used by Blaster). The as yet unknown virus authors used
MyDoom source code as the basis for creating Plexus, according to an analysis
of the worm by Russian AV firm Kaspersky Labs.
David Emm, senior technology consultant at Kaspersky Labs,
said that the multiple spreading methods is helping Plexus to infect more
machines. No worm since Nimda has used as many methods to spread, according to
Emm. Kaspersky rates Plexus as a moderate risk. It is spreading - but nothing
like as fast as Sasser or Blaster - and the main concern about the worm stems
from the fact it creates a backdoor for hackers on infected machines. These
compromised machines could be used for spam runs or as a platform for DDoS
attacks. However the motives of the virus authors behind the worm remain
unclear.
Plexus-A chooses from five different email message headers
in an attempt to bamboozle users. Each message has a different header, body and
attachment name. The only characteristic which does not change is the file
size: 16208 bytes when compressed with FSG and 57856 when uncompressed. Mac and
Linux users are - as usual - immune but Plexus is a menace for Windows users.
Upon
execution Plexus-A copies itself to the Windows system registry under the name
upu.exe, which runs every time a machine is rebooted after infection. Plexus
sends copies of itself to email addresses harvested from the hard drives of
infected machines.
The worm is among the first to specifically target users
of Kaspersky Labs' AV software. Plexus' payload includes attempts to prevent
downloads of Kaspersky Anti-Virus database updates. Plexus also scans the Net
for systems vulnerable to the flaws it exploits. The worm opens a backdoor onto
infected machines on port 1250, making it possible for files to be remotely
uploaded to and from the victim machine. The open port leaves the victim
machine vulnerable to further attacks, Kaspersky Labs warns.
Users are advised patch Windows boxes, update anti-virus
signature files and use firewalls to shelter against Plexus and similar
irritants that are doubtless just around the corner. Is there no end to this
viral madness?
|
