Virus Information

This is an internet worm that spreads trough e-mail and file sharing programs and has backdoor capabilities. It also tries to infect computers in the local network already infected by the former variant of the worm, by using the backdoor already installed on port 3127. The e-mail arrives in the following format: From: A random text or an address with one of the following domains:

aol.com
msn.com
yahoo.com
hotmail.com

Subject: Randomly chosen from the following list:

Mail Transaction Failed
Unable to deliver the message
Status
Delivery Error
Mail Delivery System
hello
Error
Server Report
Returned mail

Body text: A random text or one of the following:

test
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
sendmail daemon reported: Error #804 occurred during SMTP session. Partial message has been received.
The message contains Unicode characters and has been sent as a binary attachment.
The message contains MIME-encoded graphics and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.

Attachment: A file with document icon and executable extension (pif, cmd, bat, scr, exe) with one of the following names:

body
doc
text
document
data
file
readme
message

The virus terminates the process TASKMON.EXE if it is running. It uses a mutex called sync-v1.01__ipcmtx0 to avoid multiple running instances. It 80% of cases it opens Notepad with a file with random data: and in 20% of cases it shows a fake error message: The backdoor is installed in the Windows System folder with the name CTFMON.DLL listening to one of the following ports: 1080, 3128, 80, 8080, 10080. After 1st of March 2004, the worm stops spreading, but the backdoor remains installed and listening. A copy of the virus named EXPLORER.EXE is created in the Windows System folder and the registry entry is created, so that Windows will load the worm each time: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run with the value: Explorer = %SYSDIR%\EXPLORER.EXE Also, the worm creates another registry key for the backdoor to load with Windows each time: HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 with the value: (default) = %SYSDIR%\CTFMON.DLL On Windows NT, 2000, XP or 2003, the hosts file (%SYSDIR%\drivers\etc\hosts) is modified so as the user wont be able to connect to the following hosts:

engine.awaps.net
awaps.net
www.awaps.net
ad.doubleclick.net
spd.atdmt.com
atdmt.com
click.atdmt.com
clicks.atdmt.com
media.fastclick.net
fastclick.net
www.fastclick.net
ad.fastclick.net
ads.fastclick.net
banner.fastclick.net
banners.fastclick.net
www.sophos.com
sophos.com
ftp.sophos.com
f-secure.com
www.f-secure.com
ftp.f-secure.com
securityresponse.symantec.com
www.symantec.com
symantec.com
service1.symantec.com
liveupdate.symantec.com
update.symantec.com
updates.symantec.com
support.microsoft.com
downloads.microsoft.com
download.microsoft.com
windowsupdate.microsoft.com
office.microsoft.com
msdn.microsoft.com
go.microsoft.com
nai.com
www.nai.com
vil.nai.com
secure.nai.com
www.networkassociates.com
networkassociates.com
avp.ru
www.avp.ru
www.kaspersky.ru
www.viruslist.ru
viruslist.ru
avp.ch
www.avp.ch
www.avp.com
avp.com
us.mcafee.com
mcafee.com
www.mcafee.com

For disinfection, download and run our free eScan Anti-Virus Toolkit. The utility checks your computer, system registry, and running processes for malicious programs, illegal dialers, and sniffer tools. Note: This tool does not protect your PC in real time.

You can download the eScan Anti-Virus Toolkit utility from the MicroWorld Web site.

Alternatively, you can install MicroWorld’s Internet Security Suite which has real time detection capabilities.
You can download and install the product from our eScan download page.