Worm:W32/Navidad

The icon of the worm's executable file looks like:

The original worm sample that we received has a bug that makes an infected system inoperable after infection - no EXE files could be started.

Installation

When run, the NAVIDAD.EXE file installs itself as WINSVRC.VXD into \Windows\System directory and modifies several Registry keys. It changes the default EXE file startup key

• [HKEY_CLASSES_ROOT\exefile\shell\open\command]

to make sure it starts with every EXE file. The worm also makes sure it is always run on each Windows startup by creating another startup key in:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run].

The worm also creates 'Navidad' key in the following section:

• [HKEY_CURRENT_USER\Software]

But there's a bug in the worm's code - the Registry keys are created for WINSVRC.EXE file while the worm installs itself as WINSVRC.VXD file. As a result no EXE files can be started in a system after infection. Also the worm doesn't get activated on next Windows startup.

Activity

During installation the worm displays a fake error message:

After a user presses 'OK', an 'eye' icon appears in Windows taskbar:

This is the major sign that indicates Navidad worm infection in a system. When a user clicks on that icon the following dialog box with 'Nunca presionar este boton' text is displayed:

and when the only button in the above dialog box is clicked, another messagebox with 'Lamentablemente cayo en la tentacion y perdio si computadora' text appears:

When the worm is activated it connects to MAPI-compatible email browser using MAPI32.DLL library, enumerates all unread emails, gets email addresses from them and sends itself out to these addresses.

Variant:Navidad.b

This variant of Navidad worm is a patched version of the original Navidad. But unlike the original Navidad worm, it spreads itself as EMANUEL.EXE and installs itself as WINTASK.EXE to Windows System directory. It also modifies EXE file startup key (now correctly) to be run when any EXE program is launched by a user.

When run, Navidad.b displays a messagebox:

Then it installs itself to memory and shows an ICQ-like (green flower with yellow middle) icon in System tray:

When a cursor is placed on that icon, a message is displayed - "Come on lets party!!!". When a user clicks the icon, Navidad.b displays its original dialog with a button:

If a user clicks [X] to close the dialog, the worm displays the following messagebox and exits:

Otherwise, if a user clicks 'Nunca presionar este boton' button, the worm displays the following messagebox: