****
*
*
*
*







*
*
                                      
*
*
Windows Server



    

W32/Mariofev.worm    

*
*

*
*

W32/Mariofev.worm


Categories:


Tags:


Apr
28

W32/Mariofev.worm

This file is a worm which attempts to spread by copying itself over Network Shares.

It throws a LDP brute force password crack attempt on the logged-in user using common passwords

 

Registry

The following Value/Data pairs are observed:

● HKEY_LOCAL_MACHINE\SOFTWARE\[Numeric Value] [Random Number] [Random Data

● HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion "st" [Number of infection attempts

● HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion "mid" [Random Hex Number

● HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "oupInit_Dlls" "nvaux32"

- On the offending workstations/servers, the startup type and configuration of the "Automatic Updates" and "Background Intelligent Transfer Service" services are incorrect. (Automatic Updates should be set to Automatic, and BITS should be set to Manual on XP/2003)

 

Network

It attempts to make network connections to the following domain:

● hxxp://66.36.241.45/sdb/gate/[Removed

Impact created: • Accounts getting locked out repeatedly event 539 initiating from different work stations.• Bits and windows update Services are disabled.• Security websites not accessible.

Workaround: • Solution run the GMER tool which Identifies and cleans the tool• http://www.gmer.net/gmer.zip (Download the tool from this location)• Reboot the machine and machine will become normal.

Permanent Fix: • All the Antivirus vendors are working on to get a Signature for this Virus including Microsoft, Symantec, MacAfee, Trend etc.. This is an update from the PSS-Security team. Please ensure we have MS08-067 update installed after removing the malware.



No TrackBacks

TrackBack URL: http://www.skar.us/site/mt-tb.cgi/3382

Leave a comment








*
*

administrator
Author Bio          ★★★★★

Author Name:         administrator
Author Location:    India
Author Rank:          Writer
Author Status:        
The Green leave stands!!


*
*
*
*
****



*****



    Desktop
  • eBooks
  • Games
  • Softwares
  • Tools
  • Tweaks
  • Wallpapers
  • Warez
    PDA
  • Games
  • Tools
  • Wallpapers
    System Administration
  • dll Center
  • Scripts
  • Tools
  • .extensions database
  • Write-up
    more...
  • Download Database
  • Jobs
  • Lists
  • Polls
  • Glossary

01000011 01110010 01100001 01100011 01101011 01111010 01101000 01100001 01100011 01101011