Symantec Security Response - Backdoor.Litmus

[Bob Goodwin]

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.litmus.html

Title: Symantec Security Response - Backdoor.Litmus

© 1995-2002 Symantec Corporation. All rights reserved. Legal Notices Privacy Policy Backdoor.Litmus Discovered on: October 17, 2001 Last Updated on: April 15, 2002 at 05:12:02 PM PDT Backdoor.Litmus is a backdoor Trojan horse that can give a hacker access to the computer. Like many other backdoor Trojans, Backdoor.Litmus is controlled by the hacker using IRC channels. Type: Trojan Horse Virus Definitions (Intelligent Updater)* October 18, 2001 Virus Definitions (LiveUpdate™)** October 24, 2001 * Intelligent Updater virus definitions are released daily, but require manual download and installation. Click here to download manually. ** LiveUpdate virus definitions are usually released every Wednesday. Click here for instructions on using LiveUpdate. Wild: Number of infections: 0 - 49 Number of sites: 0 - 2 Geographical distribution: Low Threat containment: Easy Removal: Easy Threat Metrics Wild: Low Damage: Medium Distribution: Low Damage: Payload: Releases confidential info: Stored passwords can be retrieved by the hacker. Compromises security settings: Other malicious software can be installed on the compromisd system. When Backdoor.Litmus is run, it creates a copy of itself as %Windows%\Litmus\Msgsrv16.exe. NOTE: %Windows% is a variable. The worm locates the \Windows folder (by default this is C:\Windows or C:\Winnt) and copies itself to that location. Once a computer is compromised, the hacker can perform actions such as the following: Upload files Execute files Perform file management Use the compromised computer as a robot on IRC Steal passwords Remotely manage the installation of the backdoor Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices": Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, a telnet server, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates. If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied. Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services. Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised. Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files. Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media. Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched. 1. Obtain the most recent virus definitions. There are two ways to do this: Run LiveUpdate. LiveUpdate is the easiest way to obtain virus definitions. These virus definitions have undergone full quality assurance testing by Symantec Security Response and are posted to the LiveUpdate servers one time each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up. Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions have undergone full quality assurance testing by Symantec Security Response. They are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up. Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here. 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files. 3. Run a full system scan. 4. Delete all files that are detected as Backdoor.Litmus. NOTE: If the Trojan files are currently running (in use by Windows), Norton AntiVirus (NAV) may not be able to delete them. In this situation, you must restart in Safe mode and run the scan again. All Windows 32-bit operating systems except Windows NT can be restarted in Safe mode. Read the document for your operating system. How to start Windows XP in Safe Mode. How to start Windows 2000 in Safe mode. How to restart Windows 9x or Windows Me in Safe Mode. Additional information: Possible system changes If the Trojan was run and a hacker executed files on the computer, it may be difficult to determine exactly what was done, even after the Trojan was removed. If you are familiar with your operating system and how to use system-repair or system-checking tools, we suggest that you fully check the system for any of these modifications and undo them. Otherwise, consider reinstalling the Windows operating system. Write-up by: Andre Post