Attention: New virus spread through KaZaA
Excerpts from the latest Symantec newsletter - attention KaZaA users! - R.White
symantec symantec security response
ISSN 1444-9994 June 2002 Newsletter
--------------------------------------------------------------------------
Peer-to-peer (P2P) networks look like the next target for worms, we've already seen worms exploit this type of architecture and we had more than 900 samples of W32.Benjamin.Worm in 7 days. This is a lot for a worm that does not replicate itself but requires users to manually retrieve it. Does this tell us that the average user of a consumer based P2P network will grab any file they can, with little consideration for security and privacy?
Oddly W32.Benjamin.Worm is number two in the Netherlands this month, just when we feature this country. Whilst Benjamin doesn't show up at all in the Asias top ten.
An SQL worm (Digispid.B.Worm) has reminded us all to change standard, 'out of the box' passwords as soon as we install software that use user account and passwords. This is one of the easiest expoits for a cracker or automated worm to use.
***
W32.Benjamin.Worm comes disguised as popular music, movie, or software files. It spreads across KaZaA file-sharing networks by tricking KaZaA users into downloading the program and opening it.
The size of the worm can vary because the worm pads copies of itself with garbage bytes. The worm creates the C:\%Windows%\Temp\Sys32 folder. It then changes the KaZaA download folder settings so that this new folder is accessible to other KazaA network users. This allows other KaZaA users to download files from that location.
The worm then copies itself into this folder using many different names that are chosen randomly from a list that the worm carries. Here are some examples:
Chterbahn Designer -full-downloader
Acrobat Capture 3.0 -full-downloader
Age of Empires-Games-full-downloader
American Pie 2 -divx-full-downloader
Baseball 2001-Games-full-downloader
Metallica - Blackened
ac dc - Fight For Your Right
The worm then displays a fake error message, finally, it waits in the background for other KaZaA users to download the worm file.
http://www.sarc.com/avcenter/venc/data/w32.benjamin.worm.html
Yana Liu and Douglas Knowles
Symantec Security Response, USA.