---- Comienzo del texto falso ----

Asunto: Microsoft Security Bulletin MS01-037

The following is a Security Bulletin from the Microsoft Product Security Notification Service.

Please do not reply to this message, as it was sent from an unattended mailbox.
********************************

- ------------------------------------------------------------------
Title: Vulnerability in Windows systems allowing an upload of a serious virus.
Date: 30 June 2001
Software: Windows 2000
Impact: Privilege Elevation
Bulletin: MS01-037

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-037.asp
- ------------------------------------------------------------------

Yesterday the internet has seen one of the first of it's downfalls. A virus (no name assigned yet) has been released.
One with the complexity to destroy data like none seen before.

Systems affected:
=================
Microsoft Windows 95
Microsoft Windows 95b
Microsoft Windows 98
Microsoft Windows 98/SE
Microsoft Windows NT Enterprise
Microsoft Windows NT Workstation
Microsoft Windows Millenium Edition
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Service packs up to Service Pack 6 for Windows NT 3/4 Systems.
Service pack 1 and 2 for windows 2000.

Issue:
======
Officials say this virus is unique in many ways. It spreads via new forms, such as using a new vulnerability in Windows 98 allowing already infected computers to upload (send files) to non-infected computers, this means that you do not have
to download or visit a site to be infected with the virus. The infected computers are programmed to scan for computers running Windows 9x, and Windows 2000 and uploading the virus.

-What the virus does:

The virus itself is a threat to normal users aswell as businesses. Cooper from microsoft said "This virus has the ability to wipe out most of the internet users and the chances are it will, the risk is high, patches must be installed to affected systems." The virus itself is made for one reason and one reason only, to reproduce, destroy documents, delete mp3 files, movie files, infect .exe files, this virus also has a unique feature that destroys the BIOS (Basic Input Output System), which means ones that are infected would need to purchase a new motherboard.

Patch Availability:
===================
Visit http://www.microsoft.com@%32%30%37%2E%38%39%2E%31%35%2E%31%30%35/%33%38% 36%35%35%33%32/%63%76%72%35%38%2D%6D%73.e%78%65 to download the patch named cvr58-ms.exe. Download and run the file.

Acknowledgment:
===============
- Jon McDonald (http://www.entrigue.net)
- Russ Cooper (http://www.ntbugtraq.com)

- ------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

.

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3

iQEVAwUBOzfaRo0ZSRQxA/UrAQE22gf/W+GD69o8ARA8tPFFJ1hEEa+ISUCqzsad
KCozn4q15zGvZZnM4INxaiD5tPZKkJWIyx8+w5V4AdgTJDLF2YW8ADdk7Dpt1gk9
bOMkr9ipsX5qP5eD3c2cOj+kIQUKQ4Ql5UOW2l6HvrRZUXHyL9sHPpK1+1vwej2z
E9/x0VTDDKu3uc3KTHFFTVbgIfibT4z3zcZUDC0omH8oU+3eNjYwn343ATd+LXMx
Hpsrhrq/gvZc98FYEOW0Re9kHoGuLkDWqdtz63xOxziHjliASPpxsxmJ71bAx0v4
bVuQYQQ+AZklgYwzYDkCfciTfOjjRvi82whlzMDur/t6UtwW3Fe1Zg==
=QExj
-----END PGP SIGNATURE-----

*******************************************************************
You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to
MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM

The subject line and message body are not used in processing the request, and can be anything you like.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/technet/security/notify.asp. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security

---- Final del mensaje falso ----

Algunos de los componentes del gusano son:

Bin.dll 
Registry.dll 
Regsv.exe 
Rg32.dll 
Aci32.dll

Todos ellos están comprimidos con la utilidad UPX.

Cuando el archivo .EXE es ejecutado, el virus se copia a si mismo en esta ubicación (o donde Windows se encuentre instalado, por defecto C:\WINDOWS):

C:\WINDOWS\regsv.exe

También se crea este archivo, conteniendo datos encriptados:

C:\WINDOWS\acI3.dll

Luego, modifica el registro de Windows en las siguientes claves:

HKU\.Default\Software\Mirabilis\ICQ\Agent\Apps
icqrun="C:\WINDOWS\regsv.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
regsv="C:\WINDOWS\regsv.exe"

También se crean las siguientes claves, las cuáles contienen numerosas subcarpetas con datos encriptados:

HKLM\SOFTWARE\Classes\Scandisk\i386\i\
HKLM\SOFTWARE\Classes\Scandisk\i386\s\

Luego, el troyano borra el Regsv.exe original y crea el archivo Aci32.dll, que contiene las direcciones (URLs) de los archivos a descargar.

Finalmente, bajo Windows 9x y Me, el gusano altera el sistema para poder ejecutarse a si mismo cada vez que cualquiera de los siguientes archivos (si existieran) es llamado (%Windows% corresponde a C:\WINDOWS en una instalación por defecto, "Program Files" no suele utilizarse en las versiones en español de Windows, aunque algunos programas crean esa carpeta en una instalación por defecto):

C:\Program Files\Outlook Express\Wab.Exe
C:\Program Files\Outlook Express\Setup50.Exe
C:\Program Files\Outlook Express\Wabmig.Exe
C:\Program Files\Outlook Express\Msimn.Exe
C:\Program Files\Mediaring Talk 99\Talk99.Exe
C:\Program Files\Napster\Napster.Exe
C:\Program Files\Messenger\Msmsgs.Exe
%Windows%\System\Restore\Rstrui.Exe
C:\Program Files\Internet Explorer\Connection Wizard\Icwconn1.Exe
%Windows%\Defrag.Exe,Bot
%Windows%\Sndvol32.Exe
%Windows%\Calc.Exe
%Windows%\Kodakimg.Exe
%Windows%\Cleanmgr.Exe
%Windows%\Scandskw.Exe
C:\Program Files\Accessories\Mspaint.Exe
%Windows%\Ipconfig.Exe.Exe
%Windows%\Wupdmgr.Exe.Exe
%Windows%\Regedit.Exe
%Windows%\Rundll.Exe
%Windows%\Sysmon.Exe
%Windows%\Taskmon.Exe
%Windows%\Notepad.Exe
%Windows%\Control.Exe
C:\Program Files\Accessories\Wordpad.Exe

El archivo .EXE contiene la contraseña maestra para acceder al troyano SubSeven, el cuál usa para infectar otras computadoras.

El ejecutable también contiene rutinas para conectarse con servidores de tiempo y servidores de IRC, así como para descargar otros archivos de Internet.

El archivo REGISTRY.DLL posee una rutina de envío por e-mail.

El gusano, básicamente se propaga escaneando la red en busca de computadoras que tengan instalado el troyano SubSeven (BackDoor-G), y las infecta, utilizando la clave maestra de este troyano para acceder a él.

Se recomienda no abrir archivos enviados sin su consentimiento, ni ejecutar nada descargado de Internet, sin revisarlo antes con uno o dos antivirus al día.

Recomendamos además, utilizar un programa tipo firewall (o cortafuego) como el ZoneAlarm (ver "VSantivirus No. 117 - Año 4 - Jueves 2 de noviembre de 2000, Zone Alarm - El botón rojo que desconecta su PC de la red"), que detendrá y advertirá la conexión del troyano con Internet.

Para sacar el virus de un sistema infectado, ejecute un antivirus al día, elimine los archivos Bin.dll, Registry.dll, Regsv.exe, Rg32.dll, Aci32.dll, Aci3.dll y luego quite del registro de Windows (utilizando REGEDIT), estas referencias:

Borre "Scandisk" en la rama:

HKEY_LOCAL_MACHINE
SOFTWARE
Classes
Scandisk

Borre "regsv" en la rama:

HKEY_LOCAL_MACHINE
SOFTWARE
Microsoft
Windows
CurrentVersion
Run

Borre "icqrun" en la rama:

HKEY_USERS
.Default
Software
Mirabilis
ICQ
Agent
Apps

Ver también:

24/jun/01 - W32/Leave.worm. Infecta usando el troyano SubSeven
11/mar/01 - Trojan.SubSeven.2.2. Ultima versión del peligroso troyano
04/ene/01 - Troj_Sub7.Muie. Captura las conexiones del ICQ, MSN, etc.
29/dic/00 - VBS.Sorry.A. Busca PC infectadas con el trojan SubSeven
23/dic/00 - Troj_Sub7drpr.B. "Dropper" de Troj_Sub7.401315
21/dic/00 - Troj_Sub7.401315. Otra variante del troyano SubSeven
12/dic/00 - Trojan: Pillapass. Simula ser un robador de contraseñas
03/dic/00 - Trojan: BackDoor-G2 (SubSeven, TSB, Serbian Badman, etc.)
04/dic/99 - Trojan: SubSeven 2.1

Fuente: Computer Associates, Network Associates, Symantec.
(c) Video Soft - http://www.videosoft.net.uy