June 10, 2003 - Current Activity

The CERT/CC has received reports of a variant of the BugBear mass-emailing worm, referred to as "W32/BugBear.B", "W32/Kijmo" or "W32/Shamur". It arrives as an attachment with a .pif, .scr, or .exe extension. Upon opening the attachment, the worm attempts to mail itself to all e-mail addresses it finds in the current inbox and in files with a .dbx, .eml, .mbx, .mmf, .nch, .ocs, or .tbb file extension. Additionally, this worm has a built-in keylogger, a backdoor that listens on port 1080/tcp, and attempts to terminate numerous security product processes on the system.

The worm also attempts to propogate by copying itself to the following folders on the local machine as well as other machines that it has access to using a random file name:

The CERT/CC strongly encourages users to install anti-virus software, and keep its virus information files up-to-date.

Users may also wish to consider filtering email attachments with the extensions listed above and to monitor traffic destined for port 1080/tcp.

You may also wish to visit the CERT/CC's computer virus resources page.

The CERT/CC continues to receive reports of three variants of a mass-emailing worm, referred to as "W32/Sobig", or sometimes "Win32/Mankx" or "Win32/Palyh". It arrives as an attachment with a .pif extension in an email message spoofed to appear as though it was from "support@microsoft.com" or "bill@microsoft.com", or possibly other addresses. Upon opening the attachment, the worm attempts to mail itself to all e-mail addresses it finds in files with a .wab, .dbx, .htm, .html, .eml, or .txt file extension.

The worm also attempts to propogate by copying itself to the following folders on other machines that it has access to:

The CERT/CC strongly encourages users to install anti-virus software, and keep its virus information files up-to-date.

Users may also wish to consider filtering email attachments with the extensions listed above.

You may also wish to visit the CERT/CC's computer virus resources page.

Buffer Overflow Vulnerability in Core Windows DLL
added March 19

A buffer overflow vulnerability exists in ntdll.dll. This vulnerability may allow a remote attacker to execute arbitrary code on the victim machine.

An exploit is publicly available for this vulnerability which increases the urgency that system administrators apply a patch. The CERT/CC strongly encourages sites Windows to read CERT Advisory CA-2003-09, examine their systems for signs of compromise and apply the appropriate patch as soon as possible.

The CERT/CC has received reports of propagation of a worm known as W32.Deloder as well as other malicious code which exploit network shares with null or weak Administrator passwords on Windows 2000/XP systems. This malicious code propagates via port 445/tcp and often installs backdoor applications on compromised systems. Additional details can be found in CERT Advisory CA-2003-08.