W97M.Timret

SUMMARY

W97M.Timret is a macro virus that infects documents when they are opened. It also attempts to send a copy of the infected document through mIRC.

Protection

• Virus Definitions (LiveUpdate™ Weekly) March 19, 2003
• Virus Definitions (Intelligent Updater) March 19, 2003

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low
• Degrades Performance: Payload can swap mouse buttons.

Distribution

• Distribution Level: Low
• Target of Infection: Word documents

TECHNICAL DETAILS

When a document that is infected with W97M.Timret is opened, W97M.Timret does the following:

1. Creates the files:
   • %System%Ant.dll (This is the source of the viral module.)
   • %System%Antform.dll (This is the source of the viral form.)
     
2. Uses these two files to infect clean documents; then it deletes both files.
   
3. Adds the values:
   
   anthill <Current Day>:<Current Month>
   counter 0
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESecurityNetwork
   
4. Changes the value that controls your Internet Explorer home page to:
   
   Start Page http:/ /www.ringo82.narod.ru
   
   in the registry key:
   
   HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain
   
5. Sets the computer name to "soldier".
   
6. Sets the Registered Organization to "ant-hill-7".
   
7. Sets the Registered Owner to "Mephist0pHELL".
   
8. Sets the Product Name to "base".
   
9. Depending on the number of opened viral files, the virus will perform one of the following actions:
   • Add the value:
     
     rundll32 user,swapmousebutton
     
     to registry key:
     
     HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
     RunOnce
     
     
   • Set the (Default) value of the registry subkey: DefaultIcon
     
     to:
     
     C:WindowsSystemShell32.dll,32
     
     under all of the following registry keys:
     
     HKEY_CLASSES_ROOThtmlfile
     HKEY_CLASSES_ROOT xtfile
     HKEY_CLASSES_ROOTsysfile
     HKEY_CLASSES_ROOTinifile
     HKEY_CLASSES_ROOTinffile
     HKEY_CLASSES_ROOTatfile
     HKEY_CLASSES_ROOTavifile
     HKEY_CLASSES_ROOTcomfile
     HKEY_CLASSES_ROOTcurfile
     HKEY_CLASSES_ROOTdllfile
     HKEY_CLASSES_ROOTdrvfile
     HKEY_CLASSES_ROOTfile
     HKEY_CLASSES_ROOTFolder
     HKEY_CLASSES_ROOTfonfile
     HKEY_CLASSES_ROOTgiffile
     HKEY_CLASSES_ROOTmpfile
     HKEY_CLASSES_ROOTjpgfile
     HKEY_CLASSES_ROOTJSFile
     HKEY_CLASSES_ROOT mpfile
     HKEY_CLASSES_ROOToldfile
     HKEY_CLASSES_ROOTdatfile
     HKEY_CLASSES_ROOTdocfile
     HKEY_CLASSES_ROOTDocShort
     HKEY_CLASSES_ROOTvxdfile
     HKEY_CLASSES_ROOTwrifile
     HKEY_CLASSES_ROOTlogfile
     HKEY_CLASSES_ROOTinfile
     HKEY_CLASSES_ROOTfrmfile
     HKEY_CLASSES_ROOTmp3file
     HKEY_CLASSES_ROOTwavfile
     
     
10. Searches for the file, Mirc*.exe. If it is found, the virus saves a copy of the infected file, using the filename, Passwords.doc, in the same folder as Mirc*.exe.
    
11. Sends the Passwords.doc to other users on the mIRC network.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Update the virus definitions.
2. Run a full system scan and repair all the files detected as W97M.Timret. Delete %System%Ant.dll and %System%Antform.dll.
3. Reverse all the changes made to the registry.

For specific details on each of these steps, read the following instructions.

1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

• Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).
  
  The Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.

2. Scanning for and repairing the infected files

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   • For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
   • For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan All Files."
2. Run a full system scan.
3. If any files are detected as infected with W97M.Timret, click Repair.
4. Delete %System%Ant.dll and %System%Antform.dll, if they exist.

3. Reversing the changes made to the registry

NOTE: The changes that this virus makes to the registry are extensive. The values that it changes will vary with the operating system and installation. Thus, we cannot provide specific information as to what to restore the values to. If possible, restore the registry from a recent backup.

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit
   
   Then click OK. (The Registry Editor opens.)
   
3. Restore the value of: Start Page
   
   in the registry key:
   
   HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain
   
4. Restore the value of: ComputerName
   
   in the registry key:
   
   HKEY_LOCAL_MACHINESystemCurrentControlSetControlComputerName
   
5. Restore the value of:
   
   RegisteredOrganization
   RegisteredOwner
   ProductName
   
   in the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
   
6. Restore the (Default) value of the subkey: DefaultIcon
   
   in these registry keys:
   
   HKEY_CLASSES_ROOThtmlfile
   HKEY_CLASSES_ROOT xtfile
   HKEY_CLASSES_ROOTsysfile
   HKEY_CLASSES_ROOTinifile
   HKEY_CLASSES_ROOTinffile
   HKEY_CLASSES_ROOTatfile
   HKEY_CLASSES_ROOTavifile
   HKEY_CLASSES_ROOTcomfile
   HKEY_CLASSES_ROOTcurfile
   HKEY_CLASSES_ROOTdllfile
   HKEY_CLASSES_ROOTdrvfile
   HKEY_CLASSES_ROOTfile
   HKEY_CLASSES_ROOTFolder
   HKEY_CLASSES_ROOTfonfile
   HKEY_CLASSES_ROOTgiffile
   HKEY_CLASSES_ROOTmpfile
   HKEY_CLASSES_ROOTjpgfile
   HKEY_CLASSES_ROOTJSFile
   HKEY_CLASSES_ROOT mpfile
   HKEY_CLASSES_ROOToldfile
   HKEY_CLASSES_ROOTdatfile
   HKEY_CLASSES_ROOTdocfile
   HKEY_CLASSES_ROOTDocShort
   HKEY_CLASSES_ROOTvxdfile
   HKEY_CLASSES_ROOTwrifile
   HKEY_CLASSES_ROOTlogfile
   HKEY_CLASSES_ROOTinfile
   HKEY_CLASSES_ROOTfrmfile
   HKEY_CLASSES_ROOTmp3file
   HKEY_CLASSES_ROOTwavfile
   
7. Delete the values:
   
   anthill
   counter
   
   from registry key:
   
   HKEY_LOCAL_MACHINESecurityNetwork
   
8. Exit the Registry Editor.