Security Alert

This month, we cover two worms that have spread rapidly

through e-mail, and vulnerabilities and incompatibilities in Windows Me and

Windows 2000.

Widespread worms

W32.Prolin.Worm



Also known as Troj_Shockwave.A, Creative, and Troj_Prolin.A, this worm spreads
through Microsoft Outlook, and affects Win 9x and NT systems. It e-mails itself

to everyone in the Outlook address book. The subject of the e-mail is "A

great Shockwave Flash movie", and the worm is sent with this by way of an

attachment called Creative.exe. The message says, "Check out this new Flash

movie that I downloaded just now…It’s great Bye."

After this, the worm sends an e-mail to a Yahoo! mail

account. The subject line is "Job complete", and the message says,

"Got yet another idiot".

The worm gets executed when you double click the attachment.

After e-mailing itself and sending the above message, it creates a copy of

itself, named Creative.exe, in C:\Windows\Start menu\Programs\Startup, if

C:\Windows in your default Windows directory. So, the worm is executed every

time you start the computer and load Windows.

It then moves all your JPG, MP3, and ZIP files in the root

directory, and renames them by appending "change at least now to

Linux" to their file extension. It also drops a file called messageforu.txt

in the root directory, which contains a message signed by "The

Penguin" and a list of all the files moved by the worm. This list also

gives you the complete pathnames of the files before they were moved.

To remove the worm, scan your system with an updated version

of your anti-virus software, and delete all files that contain the worm’s

name. Use the list in the messageforu.txt file to restore the original

extensions of all files moved by the worm.

W32.Navidad



This worm spreads itself by using any MAPI-compliant e-mail client,

including Microsoft Outlook, but e-mail messages sent by the worm can be

received by any client. Navidad makes your system unusable by improperly

changing some registry keys. Systems at risk are Win 9x/NT/2000.

The worm arrives as an e-mail attachment called Navidad.exe.

When you execute the attachment, a dialog box titled ‘Error’ will appear

with the message "UI". When you click OK, a blue eye icon appears in

your systray and a copy of the worm is saved to the file winsvrc.vxd in the

Windows System directory.

When your mouse pointer is on the icon, it displays a dialog

box with the message, "We’re watching it". Clicking the icon

displays a dialog box with a button. The text on the button says, "Never

press this button". If you press it, an error box titled "Merry

Christmas" appears with a message that tells you that you’ve lost your

computer. However, this is just a hoax. To terminate the worm, you can close the

dialog box by pressing the ‘X’ instead of clicking the button. The message

"Good selection" will appear, click OK. This will make the worm exit–the

eye icon will disappear, and the program will terminate.

The worm also creates the following registry keys:

If you’re running Win 9x (and your Windows directory is

C:\Windows):

HKEY_USERS\DEFAULT\Software\ Navidad

HKEY_LOCAL_MACHINE\Software\



Microsoft\Windows\CurrentVersion\


Run\Win32BaseServiceMOD=C:\


WINDOWS\SYSTEM\winsvrc.exe

It also changes the value of two other registry keys.

If you’re running Win NT/2000 (and your Windows directory

is C:\WINNT):

HKEY_CURRENT_USER\Software\ Navidad

HKEY_LOCAL_MACHINE\Software\



Microsoft\Windows\CurrentVersion


\Run\Win32BaseServiceMO


D=C:\WINNT\System32\winsvrc.exe

Again, it changes the value of two other registry keys.

After this, it begins to mail itself to other people using

your MAPI-compliant mail client. It checks all the messages in your inbox and

replies to those that have one attachment. The reply has the same subject and

body text, but has an attachment called Navidad.exe, which contains the worm.

You won’t be able to exit your mail client or shut down your computer, except

by switching it off manually.

Because of the registry keys created and modified, you’ll

see an error message whenever you try to launch an EXE file. The system will

prompt you to locate a file called Winsvrc.exe, and you won’t be able to

launch any programs.

If you’ve been infected, you can restore your system by

opening MS-DOS Prompt, going into the Windows directory, and copying regedit.exe

as regedit. com, so that you can open it on your system. You can then run

regedit from the Start menu and make the appropriate changes in your registry to

undo the damage. More details on this procedure are available at: www.

symantec.com/avcenter/venc/data/w32. navidad.html

Incompatibility between Windows Me and NAV 2001

Windows Me has a directory that can’t be scanned by

anti-virus software, and so is very vulnerable to viruses. This has been the

case when Norton AntiVirus 2001 is used with Windows Me.

This directory gets created due to the rollback facility in

the System Restore feature of Windows Me. The rollback facility lets you restore

your system to a previous state at a previous point of time. This comes in

handy, for example, when an application you’ve installed makes your system

unstable. To enable you to restore your system to a previous state, Windows Me

takes snapshots of your system at regular intervals and stores them in a

directory called C:\_RESTORE. The OS doesn’t allow anything from outside the

restore facility to change this information, because any such changes would mean

that it isn’t the exact snapshot of your system as it was in a previous state.

So, restoring it to the previous but altered state, may not solve your problem,

and may even make it worse. The downside is that if your system was infected by

a virus when the snapshot was taken, you stand the risk of being infected again,

even though you may have removed the virus subsequently.

Because of this, even when NAV 2001 is asked to scan the

whole hard drive, it leaves this directory alone. If you want to scan this

folder, you have to do so manually by pointing the anti-virus utility to

C:\_RESTORE. However, there are no guidelines available as to what to do if you

do find a virus in the folder. For more on how to remove viruses in this folder,

refer to http://support.microsoft.com/support/kb/articles/Q263/4/55.asp

Incompatibilities between Win Me and some display adapters

Windows Me doesn’t ship with the recent drivers for some

video cards, and this may cause your system to malfunction. Cards for which

problems may exist include Graphics Blaster Riva TNT, Diamond Speed Star PCI

Video Adapter with BIOS version 1.01, Diamond Viper PCI VGA Video Adapter,

Diamond Stealth Video Adapter BIOS version 1.03, and some older Trident cards.

If the OS is incompatible with your video card, your system may stop functioning

especially while you’re browsing, or you may get an error message related to

DirectX.

To check the drivers of your video card, go to

Start>Settings>Control Panel, and double click the System icon. Go to the

Device Manager tab, and click on Display Adapter to expand it. Right click your

adapter, go to Properties, and click the Drivers tab. Here, click the Driver

Details button to see the drivers. If you suspect any video card problems after

installing Windows Me, note the exact model of your video card and go to the

Technical Support site of your video card manufacturer. Here, go to the page

that deals with driver updates, and check the latest driver version for your

video card. If this is different from what you found on your system, or if there’s

a special Windows Me compatible version available, download it and follow the

instructions to update your driver.

Win 2k ActiveX vulnerability can cause IE and Outlook to crash

An unchecked buffer in an ActiveX control that ships with

Windows 2000 can cause IE, Outlook or Outlook Express to crash, and in some

cases, may allow a malicious user to gain access to your machine and run his own

code. Platforms affected are Windows 2000 Professional, Windows 2000 Server,

Windows 2000 Advanced Server, and Windows 2000 Datacenter Server.

To exploit this vulnerability, the ActiveX control has to be

called from a Web page or an HTML mail, using a specially-malformed parameter.

This will allow code to be executed on the machine via a buffer overrun. This is

an attack in which a malicious user exploits an unchecked buffer in a program,

and overwrites the program code with its own data. If the code is overwritten

with new executable code, the program’s operation will change and be

controlled by the malicious user. If it’s overwritten by other data, the

program will crash. The latter is the more likely scenario, and will cause IE,

Outlook Express, or Outlook to crash, while the OS continues to run.

Microsoft has issued a patch for this, which is available at:

www.microsoft.com/Downloads/Release.asp?ReleaseID=25532.

Compiled by Pragya Madan