Nasty New Year Virus

By Jim Freund | Dec 20, 2001 | Print this Page
http://www.enterprisenetworkingplanet.com/netsecur/article.php/10952_943961_3/Nasty-New-Year-Virus.htm

Every year seems to bring forth a virus related to New Year's, and each one seems to be different. The main danger we're looking at this time is the discrepancy of information from differing sources. If you look up "Happy New Year Virus" at your preferred search engine, you are likely to first see sources telling you that this is a hoax. In 1999, that was true. An e-mail was sent out with text similar to the following:

Warning on December 31, 1999 you may receive an email called, Happy New Year...do not open it, it contains a deadly virus...it will erase windows from your computer along with many other program files.Pass this on as soon as you can to get the WORD out!!!This is not a hoax....this was reported on CNN on Tuesday the 2nd November 1999!

Bereft of any attachments or a bona-fide e-mail following up on this, that was, of course, a hoax.

However, do not let this past history or the fact that you may read that it's harmless take away your vigilance. There's a new virus with the same header, and this one has definitely spiked its punch.

An e-mail message shows up as follows:


From: an associate
To: you
Subject: Happy New Year
                  or in many instances,
Subject: Hi

Message text:
Hi, I can't describe my feelings But all I can say is Happy new year:-)
Bye


Attachment: Christmas.exe

As always, the attachment is the zinger. In this case the attachment appears to be a Macromedia Flash file, and if launched, will display a small animated program featuring Santa and a reindeer. Christmas.exe is a Trojan most commonly known as Reeezak, but has also been cited as Zacker, Maldal and Keyluc.

The Payload
Now for the nasties. There appear to be number of variants of the worm itself. In all circumstances, Reeezak copies itself to the Windows directory under the name CHRISTMAS.EXE. Different variants will do some of the following:

A process called sm56hlpr is created, and the keyboard is blocked.

As is always the case with mass-mailing worms, Reeezak will attempt to propagate by mailing itself to all entries in the Outlook or Outlook Express address book.

These entries may be made to the Windows registry:

  HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run/ZaCker
This entry is assigned the CHRISTMAS.EXE value, pointing to the location of the file containing the worm. As a result, the malicious program will run each time Windows is launched.
  HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/ComputerName/
   ComputerName/ComputerName = "ZaCker"
Through this entry, the worm changes the name of the computer to ZaCker.
  HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main/
   Start page = http://geocites.com/jobreee/ZaCker.htm
This modifies the Internet Explorer start page, and will send your browser to a really nasty sitewhich will try to exploit a vulnerability in IE and run a Visual Basic Script on the infected computer that will attempt to delete significant portions of the Windows operating system.

If Reeezak is run on a Windows NT system, it will spawn a series of processes and title bars called Christmas until it uses up the computer's memory.

Some reports have been filed that the program will also try to exploit mIRC (as Goner did) and shared network drives, particularly peer-to-peer shared folders.

Eradication
To manually remove this worm, restart the computer in Safe mode. hen reverse the changes that the worm made to the registry, look for any files added to the WINDOWS and/or SYSTEM32 directories, restart the computer, reinstall your preferred anti-virus software, and run a complete scan and cleansing.

This is a new virus, and therefore you should make sure you're absolutely up-to-date with all signature files for your anti-virus software and security patches for Outlook. Educate your users about attachments and files spread through their shared folders, and that mIRC may become infected. Never allow Outlook or Outlook Express to automatically launch attachments.

--
Jim Freund is the Managing Editor of CrossNodes.