-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                ESB-2001.545 -- UNIRAS ALERT Notice - 25/01
   Malicious software report - W32/Maldal.c@MM (alias W32/Reeezak.A-mm)
                             20 December 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
                        Denial of Service
                        Overwrite Arbitrary Files

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----


- - - -----------------------------------------------------------------------------------
   ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT 
- - - -----------------------------------------------------------------------------------
       UNIRAS (UK Govt CERT) ALERT Notice - 25/01 dated 19.12.01  Time 13:12
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- - - -----------------------------------------------------------------------------------
   UNIRAS material is also available from its website at www.uniras.gov.uk and
            Information about NISCC is available from www.niscc.gov.uk
- - - -----------------------------------------------------------------------------------

Title
=====
Malicious software report - W32/Maldal.c@MM (alias W32/Reeezak.A-mm)

UNIRAS Comment
==============
No reports have been received directly by UNIRAS. However, research of open source 
material indicates that one or more sites have been infected by this virus. A number
of infected EMails have originated from South Africa. It is currently assessed by 
NAI as a LOW threat.

Detail
====== 

W32/Maldal.c@MM was discovered on 19 December 2001, it's the third variant of the 
W32/Maldal@MM family. The mass-mailing worm arrives in an e-mail file attachment 
called "christmas.exe", the filesize is 37376 bytes. 

E-mail addresses used for the mass-mailing can also be retrieved from Messenger. 

The worm sends rtf based e-mail messages with: 

	-File Attachment: christmas.exe 
	-Subject : Happy New Year 
	-Body: Hii , I can't describe my feelings But all I can say is Happy new 
		year :-) bye 

Althoug the icon has a macromedia-flash style icon,the christmas.exe is written in 
Visual Basic. Running the file may result in multiple processes, multiple titlebars 
shown, which may be hard to combat as it tries to disable the keyboard functionality. 

The worm also changes the Internet Explorer startup page to a certain "zacker" htm 
website. This html page contains Javascript code that drops a VBScript virus. The 
HTM page is triggered upon with VBS/Rols.dr with Dat-4156 and above. The dropped 
VBSscript code may delete anti-virus and security software: 

Program Filesone Labs 
Program FilesAntiViral Toolkit Pro*.* 
Program FilesCommand SoftwareF-PROT95*.* 
eSafeProtect*.* 
PC-Cillin 95*.* 
PC-Cillin 97*.* 
Program FilesQuick Heal*.* 
Program FilesFWIN32*.* 
Program FilesFindVirus*.* 
ToolkitFindVirus*.* 
f-macro*.* 
Program FilesMcAfeeVirusScan95*.* 
Program FilesNorton AntiVirus*.* 
TBAVW95*.* 
VS95*.* 

escue*.* 
Program Filesone Labs*.* 

URL:
http://vil.nai.com/vil/virusSummary.asp?virus_k=99285
http://www.messagelabs.co.uk/viruseye/

- - - -----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via EMail to:

uniras@niscc.gov.uk
Tel: 020 7821 1330 Ext 4511
Fax: 020 7821 1686

- - - -----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of NAI and Messagelabs for the 
information contained in this ALERT. 
- - - -----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- - - -----------------------------------------------------------------------------------
<End of UNIRAS ALERT>

- -----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQCVAwUBPCCSxIpao72zK539AQEAdwQAjl1LnIq9HP8oDSupyL1SuyzhVU0Mzmkj
m20CIG0CmD366H0qTFsqhj4UKOOw4Cr3FzGgipMGNUXQHdLri6PUOsTsidUtIoKh
T8QkPCQSZvkB8dwNKff2souWCN1KBdVt5ARludj3aF0IqrWAamroCbFNcp0A76rt
ys1KgymvYaU=
=N59d
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPCHEvSh9+71yA2DNAQHf5wP8CGxjC2zhAE8EWm7y6ao9qPSqdxtCmrsH
BbvurBptinNS1GTfu4QBZdK6OPckZFpR2uY+IKaIUgAcqsHYQulyCfgnXYO6VdMs
dtRp4s484yZ9rJMOhSxDmLWvR3w4oax0iMCDrISgIlmskcKCAeQnq8Dx5X1rhKHB
YRLC7+Ws6Ho=
=VgAY
-----END PGP SIGNATURE-----