F-Secure Virus Descriptions : Mcon
|
|
|
VBS/Mcon is a worm that spreads via open network shares and mIRC.
When the worm is executed, it first checks if the "Fonts"
subdirectory in the Windows installation directory contains the
worm. If the file is not found, the worm copies itself there
using a filename "ttfloader.vbs". Then the worm executes the copy
from the "Fonts" directory and deletes the original file.
If the original file was not named "ttfloader.vbs" or was not
executed from the Windows' Startup directory the worm shows a
message box with the following text:
FILE I/O ERROR
Next the worm will add itself to the registry, so it will be
executed each time when the system is restarted.
Depending an a random number, the worm may change the Internet
Explorer page to www.zonelabs.com.
The worm goes trough all drives in the system and if the drive is
a local fixed disk, it copies itself to the root of the drive and
to the following directories:
pub
ftproot
wwwroot
or if the name of the directory contains any of the following strings:
my
download
upload
share
game
warez
The worm copies itself using a random file name taken from user's
Recent directory, with a number of spaces and a ".vbs" extension
appended to it. An attempt is made to hide the file by changing the
file attributes as well.
It also removes following directories, if found:
chode
foreskin
dickhair
If the drive is a network or removable drive, then VBS/Mcon.A copies
itself to the root of the drive, and any directory that contains one
of the following strings:
my
share
download
downloads
Also, if Windows' Startup directory is found, the worm copies itself
there as "ttfloader.vbs".
The worm deletes following files regardless of the drive type:
mscfg.exe
ashield.pif
netstat.pif
network.vbs
mscfg.vbs
winsock.vbs
a24.vbs
If VBS/Mcon.A founds a mIRC installation directory, the worm
copies itself to the Windows' Fonts directory using name
"sndload.vbs" and replaces the "script.ini" file with its own.
Next the worm chooses a random IP addess within some limits and
uses the ping utility to check if a machine responds at that
address. If the machine exist, it attempts to connect to each
share on the remove machine.
If the connection is established, the worm will go through all
directories in the shared drive copying itself there in the same
way it does with removable and network drives above.
VBS/Mcon.B is modified variant of VBS/Mcon.A. The filename, that the
worm uses in Windows' Fonts directory is changed to "ttfloads.vbs".
Additionally this variant copies itself to the Windows' System
directory as "ttfload.dll".
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure; January 2001]
|
