VBS.Winter.B

SUMMARY

VBS.Winter.B is a Visual Basic Script worm. Like many other worms, it uses Microsoft Outlook, mIRC, and Pirch to spread itself. The worm arrives as the file UndetectedWorm.vbs. Upon execution, the worm attempts to open a connection to a Web site. Any .vbs and .vbe files are overwritten with a copy of the worm.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low
• Payload Trigger: .vbs file is executed
• Payload: Opens a connection to http://users.tmok.com/~dr_bulge/smt1
• Large Scale E-mailing: Sends one email as a BCC to all entries in Microsoft Outlook address lists.
• Modifies Files: The worm overwrites all .vbs and .vbe files with a copy of itself. Modifies System registry. Overwrites script.ini and events.ini if appropriate software is installed.

Distribution

• Distribution Level: Low
• Subject of Email: I gIvE U thE nEw sh1t
• Name of Attachment: UndetectedWorm.vbs
• Size of Attachment: 6,764 bytes
• Shared Drives: Overwrites .vbs and .vbe files on all mapped network drives or floppy drives in which a disk is present.

TECHNICAL DETAILS

When executed, the VBS.Winter.B worm will perform the following actions:

• Copies itself to the Windows System directory as UndetectedWorm.vbs.
• Adds the value "UndetectedWorm" to the registry key HKLMSoftwareMicrosoftWindowsCurrentVersionRun to enable itself at startup.
• Searches for the mIRC program directory. If present, overwrites the script.ini file to spread itself when connected to mIRC.
• Searches for the Pirch program directory. If present, overwrites the events.ini file to spread itself when connected to Pirch.
• For each separate address list found in Microsoft Outlook, a single email is sent with each address entry added as a .bcc address. The email contains the UndetectedWorm.vbs file.
• Searches for .vbs and .vbe files on mapped drives, shared drives, and disk drives in which disks are present. Overwrites these files with a copy of itself.
• The worm attempts to connect to the Web site http://users.tmok.com/~dr_bulge/smt1
  

The worm also keeps a record of its infection by creating the registry key HKCUSoftwareUndetected. In this key, it stores information after it has attempted to mail itself using Outlook. It also records whether it has affected the mIRC or Pirch programs. These actions are marked by the values mailed, mirqued, and pirched being created and set to 1. This allows the worm to perform a check for previous infections.