New virus?

[TechMC]

Hi Guys,

We have had a virus spreading on our network this morning that is undetectable by Symantec Anti-virus. We found out the following:

It adds a registry key in currentversion/run – wmplayer.exe

Adds a file wmplayer.exe in c:\windows\prefetch

Starts a process called wmplayer.exe

It opens random ports and listens for incoming connections

It sends out SYN packets to random ips on 10.0.x.x hoping for an acknowledgement (I think this is how it spreads)

It makes connections to websites, and opens sexeplorer/T.htm

It spread to a few machines before we can do anything...

Anyone have any idea which virus this is?

 

[tazuk]

Possibly this ADODB stream exploit:

http://www.sophos.com/virusinfo/analyses/trojpsymeat.html

TazUk

Blue-screening PCs since 1998

 

[amen1973]

It looks like you may have a strain of Agobot aka Gaobot.
Take a look at these sites and see if any of them might be of help. There are so many different variants of this virus it is hard to pinpoint which exact strain it is.If not let us know.

http://www.sophos.com/virusinfo/analyses/w32agobotjh.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.ef.html

http://www.sophos.com/virusinfo/analyses/w32agobotbm.html

You may also want to try out this tool from symantec but I know it does not get rid of all the strains of gaobot

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html

If none of the above work try this

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_RBOT.ML

I hope this helps
Art

 

[jbrackett]

Looks like W32/Wallon.worm.a.

This worm spreads by sending a hyperlink via email to addresses harvested from the Windows Address Book (WAB). The worm contains its own SMTP engine and uses the default SMTP server specified in the Internet Account Manager.

Sent messages attempt to trick users in to following the hyperlink, which ultimately results in an infection. Through a series of redirected pages, the users is taken to a site that contain Internet Explorer exploit code, (this page exploits MS04-013 and is detected as Exploit-MhtRedir.gen ). This exploit downloads a CHM file, which contains another Internet Explorer exploit (targeting MS04-004 and is detected as VBS/Psyme ), which downloads a file and overwrites the existing wmplayer.exe file.

* %ProgramFiles%\Windows Media Player\wmplayer.exe

This file downloads and installs the Wallon worm.


More info at

http://vil.nai.com/vil/content/v_125096.htm

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}