W32.HLLW.Nettrash

1. Copies itself to C:\Windows, both as the original file name and a hidden, read-only file named Login.scr. The path to the C:\Windows folder is hard-coded and does not depend on system variables.
   
   
2. Registers itself to run as a process named "User32."
   
   
3. Adds the values:
   
   "User32" = <path to original filename>
   
   <original file name> = <path to original filename>
   
   (For example, "NetTrash" = "C:\mydir\nettrash.exe")
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   so that the Trojan runs when you start Windows.
   
   
4. Copies itself to C:\Windows\Start menu\Programs\startup. This path is hard-coded and does not depend on system variables.
   
   
5. Adds the line:
   
   run=<original file name of Trojan>
   
   to the [windows] section of the C:\Windows\Win.ini file.
   
   If the Windows installation folder is not C:\Windows, the existing Win.ini file is not modified.
   
   
6. Prepends the original file name to the default key of the registry value:
   
   HKEY_CLASSES_ROOT\exefile\shell\open\command
   
   so that any time you run a file that has an .exe extension, the Trojan is executed first.
   
   For example, "Default"="NetTrash.exe "%1" %* "
   
   

   ---

   Note: The Trojan only modifies this value if it was able to copy itself to the C:\Windows folder. If C:\Windows does not exist on your system, this value is not modified.

   ---

   
   
7. Copies itself to C:\Program Files\KaZaA\My Shared Folder (if the folder exists) as:
   • Bin Laden funny flash.exe
   • Black Jack.exe
   • counter strike keygen.exe
   • Dcom microsoft patch.exe
   • full casino games.exe
   • half life keygen.exe
   • hl + cs key generator.exe
   • Madona sex game.exe
   • Msblast Fix.exe
   • Msblast Remover.exe
   • msn bomber.exe
   • pockemon sex.exe
     
     
8. Searches for C:\mIRC or C:\mIRC32 and adds a hidden Script.ini, which attempts to exploit random users on the mIRC server, befown.dynu.com, by sending them the Trojan file.
   
   
9. Attempts to create email messages as follows:
   
   Subject: One of the following:
   angry at me??
   We need to talk...!
   What's the problem?
   How are you??
   You need help?
   What's happening???
   RE: Why you not replying??
   Need help!
   Check this out!
   Why are you so
   Funny for you...
   
   Message: One of the following:
   
   I tried to reach you at MSN Messenger but you weren't online! I got something important to tell you!
   
   You said you needed help huh? Well attached file (You'll find what I wanted to tell you there!) Ok. Reply as soon as possible!
   Bye!
   
   Where have you been all the time??? I tried to call you but you weren't home! Anyway, see the attached file! It's important! I got the solution for your problem! Just open the attached file and see what's in it ;)
   
   I need your help! I'm in a very difficault position right now. I can't decide how good the file is from rate 0 To 5! I need your opinion on it, so check it out (It's attached to this message!) and tell me what you think from rate 0 To 5!
   
   Why are you so angry at me? What have I done to you?? I only want you to check this file out; It describes my opinion about you. Please check it, you won 't be dissapointed ;) Hope to hear from you soon :)
   
   Attachment: One of the following:
   Funny
   Nice_pic
   arabic sex
   Nice Song
   Interesting
   ReadMe
   Information
   
   The attached file will have the extension of .com, .jpg, .mpg, .txt, .doc, .mp3, .asp, .htm, or .php.
   
   
10. After creating the mail message, the worm component attempts to mail itself to everyone in the Microsoft Outlook address book.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.
• Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available.
• Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.
• Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.
• If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.
• If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device's visibility is set to "Hidden" so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to "Unauthorized", requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources.
• For further information on the terms used in this document, please refer to the Security Response glossary.