The Computer Guys

Miami to Fort Lauderdale Since 1994 - Thank You!

We Build the Best & Repair the Rest! ©

Top 10 malware reported to Sophos in October 2003

This section is for technical experts who want to know more.

W32/Dumaru-A is a virus that spreads using email and infects other executable using NTFS Alternate Data Stream.

The virus arrives in an email message with the following characteristics:

Sender: "Microsoft" <security@microsoft.com>

Subject line: Use this patch immediately !

Message text: Dear friend, use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!

Attached file: patch.exe

When the attachment is run W32/Dumaru-A copies itself into the Windows folder as dllreg.exe and into the Windows system folder as load32.exe and vxdmgr32.exe.

W32/Dumaru-A drops and runs <Windows>\windrv.exe. Windrv.exe is a backdoor Trojan detected by Sophos Anti-Virus as Troj/Narod-B.

The virus creates the registry value load32 of the registry key

\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the virus file <Windows system>\load32.exe is run on Windows startup.

W32/Dumaru-A also changes system files system.ini and win.ini. The shell entry of the boot section in System.ini is changed so that it contains the reference to the virus file vxdmgr32 in the Windows systrem folder.

The virus creates a run entry in the windows section of win.ini to reference the virus file dllreg.exe in the Windows folder.

W32/Dumaru-A has its own SMTP engine and attempts to collect email addresses by searching the content of files with the extensions WAB, HTM, HTML, DBX, ABD and TBB.

On systems with NTFS the virus attempts to infect all PE executable files by replacing the original file with a copy of itself and saving the original file in an alternate data stream STR.

Note: This IDE file also contains detection for Troj/Narod-B