W32.Spybot.ANDM

W32.Spybot.ANDM is a worm that spreads through mIRC and to network shares protected by weak passwords. It also spreads by exploiting system vulnerabilities. Notes: Virus definitions dated prior to January 3rd, 2007 rev. 53 may detect this as W32.Spybot.Worm Recent variants of the Spybot worm family exploit several known vulnerabilities, including a SAV 10/SCS 3 vulnerability (SYM06-010), reported in May 2006. A patch for this vulnerability was made available at that time. Symantec highly recommends that users of the affected products patch their systems as soon as they are able to help avoid the spread of this particular Sybot worm family. If systems are infected with any Spybot variant and this security patch has not been applied please read the document, Attempting to migrate from 10.x to a newer version fails after becoming infected with a worm which exploits SYM06-010. IPS signatures against all known and unknown exploits of SYM06-010 were released on May 26, 2006. Excessive network traffic caused by an infection may result in a significant degradation of network performance.

Type:	Worm
Infection Length:	168,960 bytes
Systems Affected:	Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Virus Definitions (LiveUpdate™ Plus) January 03, 2007 Virus Definitions (LiveUpdate™ Daily) January 03, 2007 Virus Definitions (LiveUpdate™ Weekly) January 03, 2007 Virus Definitions (Intelligent Updater) January 03, 2007

Wild Number of infections: 50 - 999 Number of sites: More than 10 Geographical distribution: Low Threat containment: Easy Removal: Moderate

Threat Metrics Wild: Medium Damage: Medium Distribution: Medium

Damage

• Payload Trigger: n/a
• Payload: Exploits remote vulnerabilities. Opens a back door allowing unauthorized remote access.
  • Large scale e-mailing: n/a
  • Deletes files: n/a
  • Modifies files: n/a
  • Degrades performance: Disables some system services.
  • Causes system instability: Modifies various network related registry keys.
  • Releases confidential info: Logs keystrokes entered when visiting specific websites.
  • Compromises security settings: n/a

Distribution

• Subject of email: n/a
• Name of attachment: n/a
• Size of attachment: n/a
• Time stamp of attachment: n/a
• Ports: n/a
• Shared drives: Spreads using weak passwords.
• Target of infection: n/a

When W32.Spybot.ANDM is executed, it performs the following actions:

1. Copies itself as any of the following files:
   
   
   • %System%\wnuserv.exe
   • %System%\ctfmom.exe
   • %System%\napi32.exe
   • %System%\soundman.exe
     
     Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
     
     
2. Creates a temporary batch file named c:\a.bat, which in turn creates a registry file in the temporary folder named 1.reg.
   
   
3. Adds the values:
   
   "Windows System Service" = "wnuserv.exe"
   "Windows System Service" = "wnuserv.exe"
   "Windows Update Firewall System" = "ctfmom.exe"
   "Windows Update Firewall System" = "ctfmom.exe"
   "Windows Logon Service" = "napi32.exe"
   "Windows Logon Service" = "napi32.exe"
   "Microsoft Sounds" = "soundman.exe"
   "Microsoft Sounds" = "soundman.exe"
   
   to the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
   
   so that it runs every time Windows starts.
   
   
4. Adds the value:
   
   "Windows System Service" = "wnuserv.exe"
   
   to the registry subkey:
   
   HKEY_CURRENT_USER\Software\Microsoft\OLE\Windows
   
   
5. Modifies the value:
   
   "TransportBindName" = ""
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
   
   
6. Modifies the value:
   
   "Start" = "4"
   
   in the registry subkeys:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc
   
   
7. Modifies the values:
   
   "EnableDCOM" = "N"
   "EnableRemoteConnect" = "N"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
   
   
8. Modifies the value:
   
   "restrictanonymous" = "1"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
   
   to prevent NULL session enumeration of the host.
   
   
9. Modifies the value:
   
   "Enabled" = "0"
   
   in the registry subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT1.0\Server
   
   
10. Modifies the values:
    
    "AutoShareWks" = "0"
    "AutoShareServer" = "0"
    
    in the registry subkey:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
    
    
11. Modifies the values:
    
    "NameServer" = ""
    "ForwardBroadcasts" = "0"
    "IPEnableRouter" = "0"
    "Domain" = ""
    "SearchList" = ""
    "UseDomainNameDevolution" = "1"
    "EnableICMPRedirect" = "0"
    "DeadGWDetectDefault" = "1"
    "DontAddDefaultGatewayDefault" = "0"
    "EnableSecurityFilters" = "1"
    "AllowUnqualifiedQuery" = "0"
    "PrioritizeRecordData" = "1"
    "TCP1320Opts" = "3"
    "KeepAliveTime" = "23280"
    "BcastQueryTimeout" = "002ee"
    "BcastNameQueryCount" = "1"
    "CacheTimeout" = "0ea60"
    "Size/Small/Medium/Large" = "3"
    "LargeBufferSize" = "01000"
    "SynAckProtect" = "2"
    "PerformRouterDiscovery" = "0"
    "EnablePMTUBHDetect" = "0"
    "FastSendDatagramThreshold " = "400"
    "StandardAddressLength " = "18"
    "DefaultReceiveWindow " = "4000"
    "DefaultSendWindow" = "4000"
    "BufferMultiplier" = "200"
    "PriorityBoost" = "2"
    "IrpStackSize" = "4"
    "IgnorePushBitOnReceives" = "0"
    "DisableAddressSharing" = "0"
    "AllowUserRawAccess" = "0"
    "DisableRawSecurity" = "0"
    "DynamicBacklogGrowthDelta" = "32"
    "FastCopyReceiveThreshold" = "400"
    "LargeBufferListDepth" = "a"
    "MaxActiveTransmitFileCount" = "2"
    "MaxFastTransmit" = "40"
    "OverheadChargeGranularity" = "1"
    "SmallBufferListDepth" = "20"
    "SmallerBufferSize" = "80"
    "TransmitWorker" = "20"
    "DNSQueryTimeouts" = "31,00,00,00,32,00,00,00,32,00,00,00,34,00,00,00,38,00,00,00,30,00,00,00,00,00"
    "DefaultRegistrationTTL" = "14"
    "DisableReplaceAddressesInConflicts" = "0"
    "DisableReverseAddressRegistrations" = "1"
    "UpdateSecurityLevel " = "0"
    "DisjointNameSpace" = "1"
    "QueryIpMatching" = "0"
    "NoNameReleaseOnDemand" = "1"
    "EnableDeadGWDetect" = "0"
    "EnableFastRouteLookup" = "1"
    "MaxFreeTcbs" = "7d0"
    "MaxHashTableSize" = "800"
    "SackOpts" = "1"
    "Tcp1323Opts" = "3
    "TcpMaxDupAcks" = "1"
    "TcpRecvSegmentSize" = "585"
    "TcpSendSegmentSize" = "585"
    "TcpWindowSize" = "7d200"
    "DefaultTTL" = "30"
    "TcpMaxHalfOpen" = "4b"
    "TcpMaxHalfOpenRetried" = "50"
    "TcpTimedWaitDelay" = "0"
    "MaxNormLookupMemory" = "30d40"
    "FFPControlFlags" = "1"
    "FFPFastForwardingCacheSize" = "30d40"
    "MaxForwardBufferMemory" = "19df7"
    "MaxFreeTWTcbs" = "7d0"
    "GlobalMaxTcpWindowSize" = "7d200"
    "EnablePMTUDiscovery" = "1"
    "ForwardBufferMemory" = "19df7"
    
    in the registry subkey:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    
    
12. Modifies the values:
    
    "MaxConnectionsPer1_0Server" = "50"
    "MaxConnectionsPerServer" = "50"
    
    in the registry subkey:
    
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    
    
13. Starts to log keystrokes whenever the user attempts to access sites that contain the following strings:
    
    
    • e-gold
    • PayPal
    • StormPay
    • Vodafone
    • Poste Italiane
    • eBay
    • Yahoo!
    • Banca Sella
    • Email
    • Bank of America
    • exploit
    • Benvenuto a gmail
    • Msn
    • pagamento paga
      
      
14. Opens a back door and connects to an IRC server at any of the following hosts:
    
    
    • baba.bestunix.org
    • server.cisco-systems.jp
    • pepe83.rr.nu
    • pepe84.rr.nu
    • pepe85.rr.nu
      
      
15. The attacker may perform the following actions on the compromised computer:
    
    
    • Copy or delete files
    • Upload and download files
    • Steal CD keys from various games
    • Log keystrokes and capture webcam
    • Show status
    • Show IP address
    • Portscan the network for vulnerable computers
    • Scan vulnerabilities
    • Start ftp and tftp
    • Start Internet Explorer
    • End processes
    • Stop other worms
    • Stop security-related services
    • List processes
    • Use a network sniffer
      
      
16. Spreads by exploiting the following vulnerabilities:
    
    
    • The Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-026).
    • The Microsoft ASN.1 Library Multiple Stack-Based Buffer Overflow vulnerabilities (as described in Microsoft Security Bulletin MS04-007).
    • The Microsoft Windows Local Security Authority Service Remote Buffer Overflow (as described in Microsoft Security Bulletin MS04-011).
    • The RealVNC Remote Authentication Bypass Vulnerability (as described in CVE-2006-2369).
    • Symantec Client Security and Symantec AntiVirus Elevation of Privilege (as described in Symantec Advisory SYM06-010).
    • The Microsoft SQL Server 2000 or MSDE 2000 audit (as described in Microsoft Security Bulletin MS02-061) using UDP port 1433.
      
      
17. Attempts to spread through mIRC and to network shares protected by weak passwords.

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

Removal using the W32.Spybot.ANDM Removal Tool
Symantec Security Response has developed a removal tool to clean the infections of W32.Spybot.ANDM. Use this removal tool first, as it is the easiest way to remove this threat.

Manual Removal:
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.
5. Restore the default TCP/IP settings.
   

• How to disable or enable Windows Me System Restore
• How to turn off or turn on Windows XP System Restore

• Running LiveUpdate, which is the easiest way to obtain virus definitions:
  • If you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition 10.0, or newer products, LiveUpdate definitions are updated daily. These products include newer technology.
  • If you use Norton AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier products, LiveUpdate definitions are updated weekly. The exception is major outbreaks, when definitions are updated more often.
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to Virus Definitions (Intelligent Updater).
  
  The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater.

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   • For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.
   • For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.
2. Run a full system scan.
3. If any files are detected, follow the instructions displayed by your antivirus program.

1. Click Start > Run.
2. Type regedit
3. Click OK.
   
   Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.
   
   
4. Navigate to the subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
   
   
5. In the right pane, delete the value:
   
   "Windows System Service" = "wnuserv.exe"
   "Windows System Service" = "wnuserv.exe"
   "Windows Update Firewall System" = "ctfmom.exe"
   "Windows Update Firewall System" = "ctfmom.exe"
   "Windows Logon Service" = "napi32.exe"
   "Windows Logon Service" = "napi32.exe"
   "Microsoft Sounds" = "soundman.exe"
   "Microsoft Sounds" = "soundman.exe"
   
   
6. Navigate to the subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
   
   
7. In the right pane, reset the value to the default value:
   
   "TransportBindName" = "\Device\"
   
   
8. Navigate to the subkeys:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc
   
   
9. In the right pane, reset the value to the default value:
   
   "Start" = "4"
   
   
10. Navigate to the subkey:
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
    
    
11. In the right pane, reset the values to the default values:
    
    "EnableDCOM" = "N"
    "EnableRemoteConnect" = "N"
    
    
12. Navigate to the subkey:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
    
    
13. In the right pane, reset the value to the default value:
    
    "restrictanonymous" = "1"
    
    
14. Navigate to the subkey:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT1.0\Server
    
    
15. In the right pane, reset the value to the default value:
    
    "Enabled" = "0"
    
    
16. Navigate to the subkey:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
    
    
17. In the right pane, reset the values to the default values:
    
    "AutoShareWks" = "0"
    "AutoShareServer" = "0"
    
    
18. Navigate to the subkey:
    
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    
    
19. In the right pane, reset the values to the default values:
    
    "MaxConnectionsPer1_0Server" = "50"
    "MaxConnectionsPerServer" = "50"
    
    
20. Navigate to the subkey:
    
    HKEY_CURRENT_USER\Software\Microsoft\OLE\Windows
    
    
21. In the right pane, delete the value:
    
    "Windows System Service" = "wnuserv.exe"
    
    
22. Exit the Registry Editor.

Revision History:

January 12, 2006: Added information regarding Symantec vulnerability patch.

Write-up by: Jeong Mun