W32.Fully.3424

SUMMARY

W32.Fully.3424 is a Windows 32-bit virus that appears to have been written in assembly language. The virus contains several bugs and is unlikely to spread.

Behavior

Symptoms

Transmission

Protection

• Virus Definitions (LiveUpdate™ Weekly) February 27, 2002
• Virus Definitions (Intelligent Updater) February 27, 2002

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low
• Causes System Instability: May cause Windows to stop responding.

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

When W32.Fully.3424 is executed, it looks for Kernel32.dll in memory. Once the base for Kernel32.dll is found, the virus parses it to find functions that it wants to use.

Inside the virus, there are several encrypted strings. The encryption appears to be an attempt to conceal the code. The search for functions in Kernel32.dll proceeds as follows:

1. Find the list of function names that Kernel32.dll exports.
2. Encrypt the names.
3. Compare the encrypted strings to the strings that are already inside the virus.
4. If a string matches, store the address of that function in a table for later use.

Once the virus has the addresses of the functions that it needs, it searches the hard drive for executable files. The virus starts searching at C: for files that have the .exe extension. The virus tries to infect only the first two files that it finds. The infection routine for this virus contains several bugs, and the virus is therefore unlikely to replicate. The infection routine is as follows:

1. Attempt to open the first file that it finds.
2. Make sure that it is a Windows Portable Executable file (by looking for the PE signature within the file).
3. Verify that the file can be infected. This is done by checking several fields in the PE header and the section headers.
4. If the file can be infected, copy the viral body to the end of the file, and modify several fields in the header, including the entry point. The modification to the entry point field will cause the virus to be run directly when an infected file is executed.

After the virus has tried to infect the two files that it found, it displays the following message:

You will delete anything ?  This future are not avaible ! <Name of virus author>

Finally, after the virus displays the message, it jumps to a "random" location in memory. This jump appears to be an attempt to execute the original host. However, due to a bug in the viral code, this generally causes Windows to stop responding.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

To remove this Virus:

1. Obtain the most recent virus definitions. There are two ways to do this:
   • Run LiveUpdate. LiveUpdate is the easiest way to obtain virus definitions. These virus definitions have undergone full quality assurance testing by Symantec Security Response and are posted to the LiveUpdate servers one time each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up.
   • Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions have undergone full quality assurance testing by Symantec Security Response. They are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up.
     
     Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.
     
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Delete all files that are detected as W32.Fully.3424 . Replace deleted files from a clean backup or reinstall them.