Classification

Category: Malware

Type: -

Aliases: Saros.A, I-Worm.Saros.a

Summary


The Saros worm was found on 5th of August 2004. This very simple worm will copy itself to predetermined locations and attempt to spread through diverse media such as P2P networks and IRC.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Given the clumsiness of the code and the nature of the messages within the worm, the author is, most likely a very young person with very limited knowledge.

Once executed the worm copies itself into the hardcoded path:

\WINDOWS\system32\NonYou.exe
 

Additionally, it will try to copy itself to the following fixed paths. If such path does not exist or has a slightly different name, the worm will fail to copy itself to such location. The list of all the locations the worm tries to drop itself to are:

\WINDOWS\system32\Love-ScreenSaver.scr
\WINDOWS\system32\MSOutlookInternetUpdate.exe
\progra~1\Kazaa\My Shared Folder\Rosy.exe
\progra~1\Kazaa\My Shared Folder\Pipponoto.exe
\progra~1\Kazaa\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Kazaa\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
\progra~1\Kazaa\My Shared Folder\50 Cent - In da Club.mp3.exe
\progra~1\Kazaa\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Kazaa\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Kazaa\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Kazaa\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Kazaa\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Kazaa\My Shared Folder\Lionel Richie - Just For You.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Rosy.exe
\progra~1\Kazaa Lite\My Shared Folder\Pipponoto.exe
\progra~1\Kazaa Lite\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\50 Cent - In da Club.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Kazaa Lite\My Shared Folder\Lionel Richie - Just For You.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Rosy.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Pipponoto.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\50 Cent - In da Club.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea din tei.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Kazaa Lite K++\My Shared Folder\Lionel Richie - Just For You.mp3.exe
\progra~1\ICQ\Shared Folder\Rosy.exe
\progra~1\ICQ\Shared Folder\Pipponoto.exe
\progra~1\ICQ\Shared Folder\Anastacia - Left Outside Alone.mp3.exe
\progra~1\ICQ\Shared Folder\The Rasmus - In The Shadows.mp3.exe
\progra~1\ICQ\Shared Folder\50 Cent - In da Club.mp3.exe
\progra~1\ICQ\Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\ICQ\Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\ICQ\Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\ICQ\Shared Folder\Raf - In tutti i miei giorni.mp3.exe
\progra~1\ICQ\Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\ICQ\Shared Folder\Lionel Richie - Just For You.mp3.exe
\progra~1\Grokster\My Grokster\Rosy.exe
\progra~1\Grokster\My Grokster\Pipponoto.exe
\progra~1\Grokster\My Grokster\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Grokster\My Grokster\The Rasmus - In The Shadows.mp3.exe
\progra~1\Grokster\My Grokster\50 Cent - In da Club.mp3.exe
\progra~1\Grokster\My Grokster\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Grokster\My Grokster\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Grokster\My Grokster\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Grokster\My Grokster\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Grokster\My Grokster\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Grokster\My Grokster\Lionel Richie - Just For You.mp3.exe
\progra~1\Bearshare\Shared\Rosy.exe
\progra~1\Bearshare\Shared\Pipponoto.exe
\progra~1\Bearshare\Shared\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Bearshare\Shared\The Rasmus - In The Shadows.mp3.exe
\progra~1\Bearshare\Shared\50 Cent - In da Club.mp3.exe
\progra~1\Bearshare\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Bearshare\Shared\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Bearshare\Shared\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Bearshare\Shared\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Bearshare\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Bearshare\Shared\Lionel Richie - Just For You.mp3.exe
\progra~1\eDonkey2000\Incoming\Rosy.exe
\progra~1\eDonkey2000\Incoming\Pipponoto.exe
\progra~1\eDonkey2000\Incoming\Anastacia - Left Outside Alone.mp3.exe
\progra~1\eDonkey2000\Incoming\The Rasmus - In The Shadows.mp3.exe
\progra~1\eDonkey2000\Incoming\50 Cent - In da Club.mp3.exe
\progra~1\eDonkey2000\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\eDonkey2000\Incoming\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\eDonkey2000\Incoming\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\eDonkey2000\Incoming\Raf - In tutti i miei giorni.mp3.exe
\progra~1\eDonkey2000\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\eDonkey2000\Incoming\Lionel Richie - Just For You.mp3.exe
\progra~1\eMule\Incoming\Rosy.exe
\progra~1\eMule\Incoming\Pipponoto.exe
\progra~1\eMule\Incoming\Anastacia - Left Outside Alone.mp3.exe
\progra~1\eMule\Incoming\The Rasmus - In The Shadows.mp3.exe
\progra~1\eMule\Incoming\50 Cent - In da Club.mp3.exe
\progra~1\eMule\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\eMule\Incoming\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\eMule\Incoming\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\eMule\Incoming\Raf - In tutti i miei giorni.mp3.exe
\progra~1\eMule\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\eMule\Incoming\Lionel Richie - Just For You.mp3.exe
\progra~1\Morpheus\My Shared Folder\Rosy.exe
\progra~1\Morpheus\My Shared Folder\Pipponoto.exe
\progra~1\Morpheus\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Morpheus\My Shared Folder\The Rasmus - In The Shadows.mp3.exe
\progra~1\Morpheus\My Shared Folder\50 Cent - In da Club.mp3.exe
\progra~1\Morpheus\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Morpheus\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Morpheus\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Morpheus\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Morpheus\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Morpheus\My Shared Folder\Lionel Richie - Just For You.mp3.exe
\progra~1\LimeWire\Shared\Rosy.exe
\progra~1\LimeWire\Shared\Pipponoto.exe
\progra~1\LimeWire\Shared\Anastacia - Left Outside Alone.mp3.exe
\progra~1\LimeWire\Shared\The Rasmus - In The Shadows.mp3.exe
\progra~1\LimeWire\Shared\50 Cent - In da Club.mp3.exe
\progra~1\LimeWire\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\LimeWire\Shared\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\LimeWire\Shared\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\LimeWire\Shared\Raf - In tutti i miei giorni.mp3.exe
\progra~1\LimeWire\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\LimeWire\Shared\Lionel Richie - Just For You.mp3.exe
\progra~1\Tesla\Files\Rosy.exe
\progra~1\Tesla\Files\Pipponoto.exe
\progra~1\Tesla\Files\Anastacia - Left Outside Alone.mp3.exe
\progra~1\Tesla\Files\The Rasmus - In The Shadows.mp3.exe
\progra~1\Tesla\Files\50 Cent - In da Club.mp3.exe
\progra~1\Tesla\Files\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\Tesla\Files\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\Tesla\Files\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\Tesla\Files\Raf - In tutti i miei giorni.mp3.exe
\progra~1\Tesla\Files\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\Tesla\Files\Lionel Richie - Just For You.mp3.exe
\progra~1\WinMX\Shared\Rosy.exe
\progra~1\WinMX\Shared\Pipponoto.exe
\progra~1\WinMX\Shared\Anastacia - Left Outside Alone.mp3.exe
\progra~1\WinMX\Shared\The Rasmus - In The Shadows.mp3.exe
\progra~1\WinMX\Shared\50 Cent - In da Club.mp3.exe
\progra~1\WinMX\Shared\Vanessa Carltron - Ordinary Day.mp3.exe
\progra~1\WinMX\Shared\Haiducii - Dragostea Din Tei.mp3.exe
\progra~1\WinMX\Shared\Black Eyed Peas - Hey Mama.mp3.exe
\progra~1\WinMX\Shared\Raf - In tutti i miei giorni.mp3.exe
\progra~1\WinMX\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe
\progra~1\WinMX\Shared\Lionel Richie - Just For You.mp3.exe
 

It will create a HTA file in:

\WINDOWS\system32\About.hta
 

whose contents are:

GEDZAC Labs
2004
Have a nice Program for You
NonYou
Coded by Sarosoft
Dedicated to my Love Rosy
 

Afterwards it will present the user with a dialog titled:

Microsoft Windows Update
 

With the following text:

Click Yes For Update Microsoft Outlook via email
 

It will then drop a VBS file to:

\WINDOWS\system32\nstdnrdll32.vbs
 

And executes it. This script will add the following registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce]
"wincomp32" = "\WINDOWS\system32\nstdnrdll32.vbs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"nldr32" = "\WINDOWS\system32\NonYou.exe"
 

So the components are run when Windows starts.

If the day of the month is 11th or 23rd it will set the start page to the author group's webpage and will show the HTA file mentioned previously.

Any other day it will attempt to send emails with the worm's executable to the addresses listed in Outlook's address book.

The messages will have subject:

Microsoft Outlook News
 

And body:

Microsoft Outlook Update / Bug Fixed - Contact: support@microsoft.com
 

and the attached file will be:

\WINDOWS\system32\MSOutlookInternetUpdate.exe
 

Then it will load the following URL:

http://www.windowsupdate.com
 

If Mirc IRC client is installed the worm will attempt to send itself to the users in the channels which the infected user joins.