Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Saros.A


Aliases:


Saros.A
I-Worm.Saros.a

Malware
Worm
W32

Summary

The Saros worm was found on 5th of August 2004. This very simple worm will copy itself to predetermined locations and attempt to spread through diverse media such as P2P networks and IRC.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Given the clumsiness of the code and the nature of the messages within the worm, the author is, most likely a very young person with very limited knowledge.

Once executed the worm copies itself into the hardcoded path:

\WINDOWS\system32\NonYou.exe


Additionally, it will try to copy itself to the following fixed paths. If such path does not exist or has a slightly different name, the worm will fail to copy itself to such location. The list of all the locations the worm tries to drop itself to are:

\WINDOWS\system32\Love-ScreenSaver.scr
 \WINDOWS\system32\MSOutlookInternetUpdate.exe
 \progra~1\Kazaa\My Shared Folder\Rosy.exe
 \progra~1\Kazaa\My Shared Folder\Pipponoto.exe
 \progra~1\Kazaa\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Kazaa\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Kazaa\My Shared Folder\50 Cent - In da Club.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Kazaa\My Shared Folder\Lionel Richie - Just For You.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Rosy.exe
 \progra~1\Kazaa Lite\My Shared Folder\Pipponoto.exe
 \progra~1\Kazaa Lite\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\50 Cent - In da Club.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Kazaa Lite\My Shared Folder\Lionel Richie - Just For You.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Rosy.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Pipponoto.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\50 Cent - In da Club.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea din tei.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Kazaa Lite K++\My Shared Folder\Lionel Richie - Just For You.mp3.exe
 \progra~1\ICQ\Shared Folder\Rosy.exe
 \progra~1\ICQ\Shared Folder\Pipponoto.exe
 \progra~1\ICQ\Shared Folder\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\ICQ\Shared Folder\The Rasmus - In The Shadows.mp3.exe
 \progra~1\ICQ\Shared Folder\50 Cent - In da Club.mp3.exe
 \progra~1\ICQ\Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\ICQ\Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\ICQ\Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\ICQ\Shared Folder\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\ICQ\Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\ICQ\Shared Folder\Lionel Richie - Just For You.mp3.exe
 \progra~1\Grokster\My Grokster\Rosy.exe
 \progra~1\Grokster\My Grokster\Pipponoto.exe
 \progra~1\Grokster\My Grokster\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Grokster\My Grokster\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Grokster\My Grokster\50 Cent - In da Club.mp3.exe
 \progra~1\Grokster\My Grokster\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Grokster\My Grokster\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Grokster\My Grokster\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Grokster\My Grokster\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Grokster\My Grokster\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Grokster\My Grokster\Lionel Richie - Just For You.mp3.exe
 \progra~1\Bearshare\Shared\Rosy.exe
 \progra~1\Bearshare\Shared\Pipponoto.exe
 \progra~1\Bearshare\Shared\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Bearshare\Shared\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Bearshare\Shared\50 Cent - In da Club.mp3.exe
 \progra~1\Bearshare\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Bearshare\Shared\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Bearshare\Shared\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Bearshare\Shared\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Bearshare\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Bearshare\Shared\Lionel Richie - Just For You.mp3.exe
 \progra~1\eDonkey2000\Incoming\Rosy.exe
 \progra~1\eDonkey2000\Incoming\Pipponoto.exe
 \progra~1\eDonkey2000\Incoming\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\eDonkey2000\Incoming\The Rasmus - In The Shadows.mp3.exe
 \progra~1\eDonkey2000\Incoming\50 Cent - In da Club.mp3.exe
 \progra~1\eDonkey2000\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\eDonkey2000\Incoming\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\eDonkey2000\Incoming\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\eDonkey2000\Incoming\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\eDonkey2000\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\eDonkey2000\Incoming\Lionel Richie - Just For You.mp3.exe
 \progra~1\eMule\Incoming\Rosy.exe
 \progra~1\eMule\Incoming\Pipponoto.exe
 \progra~1\eMule\Incoming\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\eMule\Incoming\The Rasmus - In The Shadows.mp3.exe
 \progra~1\eMule\Incoming\50 Cent - In da Club.mp3.exe
 \progra~1\eMule\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\eMule\Incoming\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\eMule\Incoming\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\eMule\Incoming\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\eMule\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\eMule\Incoming\Lionel Richie - Just For You.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Rosy.exe
 \progra~1\Morpheus\My Shared Folder\Pipponoto.exe
 \progra~1\Morpheus\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Morpheus\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Morpheus\My Shared Folder\50 Cent - In da Club.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Morpheus\My Shared Folder\Lionel Richie - Just For You.mp3.exe
 \progra~1\LimeWire\Shared\Rosy.exe
 \progra~1\LimeWire\Shared\Pipponoto.exe
 \progra~1\LimeWire\Shared\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\LimeWire\Shared\The Rasmus - In The Shadows.mp3.exe
 \progra~1\LimeWire\Shared\50 Cent - In da Club.mp3.exe
 \progra~1\LimeWire\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\LimeWire\Shared\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\LimeWire\Shared\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\LimeWire\Shared\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\LimeWire\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\LimeWire\Shared\Lionel Richie - Just For You.mp3.exe
 \progra~1\Tesla\Files\Rosy.exe
 \progra~1\Tesla\Files\Pipponoto.exe
 \progra~1\Tesla\Files\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\Tesla\Files\The Rasmus - In The Shadows.mp3.exe
 \progra~1\Tesla\Files\50 Cent - In da Club.mp3.exe
 \progra~1\Tesla\Files\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\Tesla\Files\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\Tesla\Files\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\Tesla\Files\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\Tesla\Files\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\Tesla\Files\Lionel Richie - Just For You.mp3.exe
 \progra~1\WinMX\Shared\Rosy.exe
 \progra~1\WinMX\Shared\Pipponoto.exe
 \progra~1\WinMX\Shared\Anastacia - Left Outside Alone.mp3.exe
 \progra~1\WinMX\Shared\The Rasmus - In The Shadows.mp3.exe
 \progra~1\WinMX\Shared\50 Cent - In da Club.mp3.exe
 \progra~1\WinMX\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
 \progra~1\WinMX\Shared\Haiducii - Dragostea Din Tei.mp3.exe
 \progra~1\WinMX\Shared\Black Eyed Peas - Hey Mama.mp3.exe
 \progra~1\WinMX\Shared\Raf - In tutti i miei giorni.mp3.exe
 \progra~1\WinMX\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
 \progra~1\WinMX\Shared\Lionel Richie - Just For You.mp3.exe


It will create a HTA file in:

\WINDOWS\system32\About.hta


whose contents are:

GEDZAC Labs
 2004
 Have a nice Program for You
 NonYou
 Coded by Sarosoft
 Dedicated to my Love Rosy


Afterwards it will present the user with a dialog titled:

Microsoft Windows Update


With the following text:

Click Yes For Update Microsoft Outlook via E-mail


It will then drop a VBS file to:

\WINDOWS\system32\nstdnrdll32.vbs


And executes it. This script will add the following registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce]
 "wincomp32" = "\WINDOWS\system32\nstdnrdll32.vbs"
 [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
 "nldr32" = "\WINDOWS\system32\NonYou.exe"


So the components are run when Windows starts.

If the day of the month is 11th or 23rd it will set the start page to the author group's webpage and will show the HTA file mentioned previously.

Any other day it will attempt to send emails with the worm's executable to the addresses listed in Outlook's address book.

The messages will have subject:

Microsoft Outlook News


And body:

Microsoft Outlook Update / Bug Fixed - Contact: support@microsoft.com


and the attached file will be:

\WINDOWS\system32\MSOutlookInternetUpdate.exe


Then it will load the following URL:

http://www.windowsupdate.com


If Mirc IRC client is installed the worm will attempt to send itself to the users in the channels which the infected user joins.



Detection

Detection for Saros.A worm is available since the following FSAV updates:

Detection Type: PC
Database: 2004-08-02_01



Technical Details: Tzvetan Chaliavski & Ero Carrera, August 5th, 2004



Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Disinfect your PC




F-Secure Anti-Virus will disinfect your PC and remove all harmful files