[virusinfo] W32/Sumom-A
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Mon, 07 Mar 2005 09:05:45 -0800
From; Sophos Alert System:
Name: W32/Sumom-A
Aliases: IM-Worm.Win32.Sumom.a, WORM_FATSO.A
Type: Win32 worm
Date: 7 March 2005
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the April 2005 (3.92) release of Sophos Anti-Virus.
Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.
Sophos has received several reports of this worm from the wild.
Information about W32/Sumom-A can be found at:
http://www.sophos.com/virusinfo/analyses/w32sumoma.html
W32/Sumom-A is an instant messenger and P2P worm.
W32/Sumom-A copies itself to the files FORMATSYS.EXE and SERBW.EXE in the
Windows system folder, MSMBW.EXE in the Windows folder, and to the filename
LSPT.EXE in the root folder.
W32/Sumom-A sets entries at the following locations in the registry so as to
run these copies of itself on system startup with the name "ltwob", "serpe" or
"avnort":
HKCU\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
W32/Sumom-A copies itself to the following filenames in the root folder which
it attempts to send via the Microsoft Windows Messenger to members of the
infected user's contact list:
Crazy frog gets killed by train!.pif
Annoying crazy frog getting killed.pif
See my lesbian friends.pif
LOL that ur pic!
My new photo!.pif
Me on holiday!.pif
The Cat And The Fan piccy.pif
How a Blonde Eats a Banana...pif
Mona Lisa Wants Her Smile Back.pif
Topless in Mini Skirt! lol.pif
Fat Elvis! lol.pif
Jennifer Lopez.scr
W32/Sumom-A copies itself to the file AUTORUN.EXE in the following folder:
Documents and Settings\\Local Settings\Application Data\
Microsoft\CDBurning\
W32/Sumom-A creates the file AUTORUN.INF in the same folder in order to run the
AUTORUN.EXE copy of itself on startup.
W32/Sumom-A also copies itself to the following folders:
My Shared Folder
Program Files\eMule\Incoming
Documents and Settings\<uasername>\Shared
copying itself to the following filenames so as to spread over P2P networks:
Messenger Plus! 3.50.exe
MSN all version polygamy.exe
MSN nudge bomb.exe
W32/Sumom-A also sets the following registry entries to hinder its removal:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
DisableSR =
"0"
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
DisableConfig =
"0"
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\
Hidden =
"2"
W32/Sumom-A terinates a large number processes related to anti-virus and
security progams, including REGEDIT.EXE, TASKMGR.EXE and MSCONFIG.EXE.
W32/Sumom-A attempt to download and, on certain days of the month, open a file
from http://frog.0catch.com to the file "British National Party.jpg". This file
is currently unavailable for download.
W32/Sumom-A drops and runs a file called Crazy-Frog.Html to the root folder
which tries to show a JPG picture file from http://frog.0catch.com and also to
contact a PHP script at http://udjc.com.
W32/Sumom-A attempts to overwrite the HOSTS file with the following lines,
preventing access to the websites:
64.233.167.104 www.symantec.com
64.233.167.104 www.sophos.com
64.233.167.104 www.mcafee.com
64.233.167.104 www.viruslist.com
64.233.167.104 www.f-secure.com
64.233.167.104 www.avp.com
64.233.167.104 www.kaspersky.com
64.233.167.104 www.networkassociates.com
64.233.167.104 www.ca.com
64.233.167.104 www.my-etrust.com
64.233.167.104 www.nai.com
64.233.167.104 www.trendmicro.com
64.233.167.104 www.grisoft.com
64.233.167.104 securityresponse.symantec.com
64.233.167.104 symantec.com
64.233.167.104 sophos.com
64.233.167.104 mcafee.com
64.233.167.104 liveupdate.symantecliveupdate.com
64.233.167.104 viruslist.com
64.233.167.104 f-secure.com
64.233.167.104 kaspersky.com
64.233.167.104 kaspersky-labs.com
64.233.167.104 avp.com
64.233.167.104 networkassociates.com
64.233.167.104 ca.com
64.233.167.104 mast.mcafee.com
64.233.167.104 my-etrust.com
64.233.167.104 download.mcafee.com
64.233.167.104 dispatch.mcafee.com
64.233.167.104 secure.nai.com
64.233.167.104 nai.com
64.233.167.104 update.symantec.com
64.233.167.104 updates.symantec.com
64.233.167.104 us.mcafee.com
64.233.167.104 liveupdate.symantec.com
64.233.167.104 customer.symantec.com
64.233.167.104 rads.mcafee.com
64.233.167.104 trendmicro.com
64.233.167.104 grisoft.com
64.233.167.104 sandbox.norman.no
64.233.167.104 www.pandasoftware.com
64.233.167.104 uk.trendmicro-europe.com
W32/Sumom-A attempts to terminate certain processes and delete certain files
relating to the W32/Assiral family of mass-mailing worms. W32/Sumom-A drops
and, on certain days of the month, opens a message to the author of the
W32/Assiral worm in a file called "Message to n00b LARISSA.txt" containing the
following text:
Hey LARISSA fuck off, you fucking n00b!.. Bla bla to your fucking
Saving the world from Bropia, the world n33ds saving from you!
'-S-K-Y-'-D-E-V-I-L-'
This IDE file also includes detection for:
W32/Rbot-WZ
http://www.sophos.com/virusinfo/analyses/w32rbotwz.html
Troj/Dowcen-A
http://www.sophos.com/virusinfo/analyses/trojdowcena.html
Troj/Dowins-A
http://www.sophos.com/virusinfo/analyses/trojdowinsa.html
Troj/Wallop-A
http://www.sophos.com/virusinfo/analyses/trojwallopa.html
Troj/LowZone-R
http://www.sophos.com/virusinfo/analyses/trojlowzoner.html
Troj/StartPa-PB
http://www.sophos.com/virusinfo/analyses/trojstartpapb.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/sumom-a.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Sumom-A
