Original release date: February 12, 2001<BR>
Last revised: February 13, 2001 <BR>
Source: CERT/CC<BR>
<P>A complete revision history can be found at the end of this file.
<A NAME="affected">
<H3>Systems Affected</H3>
Users of Microsoft Outlook who have not applied previously available security updates.
<A NAME="overview">
<H2>Overview</H2>
<P>The "VBS/OnTheFly" malicious code is a VBScript program that spreads via
email. As of 7:00 pm EST(GMT-5) Feb 12, 2001, the CERT Coordination
Center had received reports from more than 100 individual sites. Several
of these sites have reported suffering
network degradation as a result of mail traffic
generated by the "VBS/OnTheFly" malicious code. </P>
<P>This malicious code can infect a
system if the enclosed email
attachment is run. Once the malicious code has executed on a system, it
will take the actions described in the <A HREF="#impact">Impact</A>
section. </P>
<A NAME="description">
<H2>I. Description</H2>
<P>When the malicious code executes, it attempts to send copies of itself,
using Microsoft Outlook, to all entries in each of the address books. The
sent mail has the following characteristics: </P>
<UL>
<LI><B>SUBJECT:</B> "<CODE>Here you have, ;o)</CODE>"
<P>
<LI><B>BODY:</B><br>
<pre>Hi:
Check This!
</pre>
<LI><B>ATTACHMENT:</B> <CODE>"AnnaKournikova.jpg.vbs"</CODE>
</UL>
<P>Users who receive copies of the malicious code via electronic mail will
probably recognize the sender. We encourage users to avoid
executing code, including VBScripts, received through electronic mail,
regardless of the sender's name, without prior knowledge of the
origin of the code or a valid digital signature.</P>
<P>It is possible for the recipients to be be tricked into opening this
malicious attachment since file will appear without the .VBS extension if
"Hide file extensions for known file types" is turned on in Windows.</P>
<A NAME="impact">
<H2>II. Impact</H2>
<P>When the attached VBS file is executed, the malicious code attempts to modify
the registry by creating the following key:
<DL><DD>
HKEY_CURRENT_USER\Software\OnTheFly="Worm made with Vbswg 1.50b"
</DL>
Next, the it will then place a copy of itself into the Windows directory.
<DL><DD>
C:\WINDOWS\AnnaKournikova.jpg.vbs
</DL>
Finally, the malicious code will attempt to send separate, infected email
messages to all recipients in the Windows Address Book. Once the
mail has been sent, the malicious code creates the following registry key to
prevent future mailings of the malicious code.
<DL><DD>
HKEY_CURRENT_USER\Software\OnTheFly\mailed=1
</DL>
The code's propagation can lead to congestion in mail
servers that may prevent them from functioning as expected.
<P> Beyond this effect, there does not appear to be a destructive payload
associated with this malicious code. However, historical data has shown that
the intruder community can quickly modify the code for more destructive
behavior.
<A NAME="solution">
<H2>III. Solution</H2>
<H3>Update Your Anti-Virus Product</H3>
<P>It is important for users to update their anti-virus software.
Some anti-virus software vendors have released updated information,
tools, or virus databases to help combat this malicious code. A
list of vendor-specific anti-virus information can be found in <A
HREF="#vendors">Appendix A</A>.
<H3>Apply the Microsoft Outlook E-mail Security Update</H3>
To protect against this malicious code, and others like it, users of Outlook 98 and 2000 may want to
install the Outlook E-mail Security update included in an Outlook SR-1.
More information about this update is available at
<P>
<BLOCKQUOTE>
<A HREF="http://office.microsoft.com/2000/downloaddetails/Out2ksec.htm">
http://office.microsoft.com/2000/downloaddetails/Out2ksec.htm</A>
</BLOCKQUOTE>
<P>
You may also find the following document on Outlook security useful
<P>
<BLOCKQUOTE>
<A HREF="http://www.microsoft.com/office/outlook/downloads/security.htm">
http://www.microsoft.com/office/outlook/downloads/security.htm</A>
</BLOCKQUOTE>
<P>
The Outlook E-mail security update provides features that can prevent
attachments containing executable content from being displayed to
users. Other types of attachments can be configured so that they
must be saved to disk before they can be opened (or executed). These
features may greatly reduce the chances that a user will incorrectly
execute a malicious attachment.
<H3>Filter the Virus in Email</H3>
<P>Sites can use email filtering techniques to delete messages
containing subject lines known to contain the malicious code, or can filter
attachments outright.
<H3>Exercise Caution When Opening Attachments</H3>
<P>Exercise caution when receiving email with attachments. Users should disable
auto-opening or previewing of email attachments in their mail
programs. Users should never open attachments from an untrusted
origin, or that appear suspicious in any way. Finally,
cryptographic checksums should also be used to validate the
integrity of the file.
<H2>IV. General protection from email Trojan horses and viruses</H2>
Some previous examples of malicious files known to have propagated
through electronic mail include:
<BLOCKQUOTE>
Melissa macro virus - discussed in CA-99-04
<A HREF="http://www.cert.org/advisories/CA-1999-04.html">
http://www.cert.org/advisories/CA-1999-04.html</A>
<P>
False upgrade to Internet Explorer - discussed in CA-99-02
<A HREF="http://www.cert.org/advisories/CA-1999-02.html">
http://www.cert.org/advisories/CA-1999-02.html</A>
<P>
Happy99.exe Trojan Horse - discussed in IN-99-02
<A HREF="http://www.cert.org/incident_notes/IN-99-02.html">
http://www.cert.org/incident_notes/IN-99-02.html</A>
<P>
CIH/Chernobyl virus - discussed in IN-99-03
<A HREF="http://www.cert.org/incident_notes/IN-99-03.html">
http://www.cert.org/incident_notes/IN-99-03.htm</A>
</BLOCKQUOTE>
In each of the above cases, the effects of the malicious file are
activated only when the file in question is executed. Social
engineering is typically employed to trick a recipient into executing
the malicious file. Some of the social engineering techniques we have
seen used include
<UL>
<LI>Making false claims that a file attachment contains a software
patch or update
<LI>Implying or using entertaining content to entice a user into
executing a malicious file
<LI>Using email delivery techniques that cause the message to appear
to have come from a familiar or trusted source
<LI>Packaging malicious files in deceptively familiar ways (e.g., use
of familiar but deceptive program icons or file names)
</UL>
The best advice with regard to malicious files is to avoid executing them in
the first place. CERT advisory CA-1999-02.html and the following CERT tech tip
discuss malicious code and offers suggestions to avoid them.
<P> <BLOCKQUOTE>
<A HREF="http://www.cert.org/advisories/CA-1999-02.html">
http://www.cert.org/advisories/CA-1999-02.html</A> </BLOCKQUOTE>
<P>
<BLOCKQUOTE>
<A HREF="http://www.cert.org/tech_tips/virusprotection.html">
Tech tip: Protecting yourself from Email-borne Viruses and Other Malicious Code During Y2K and Beyond</A>
</BLOCKQUOTE>
<A NAME="vendors">
<H2>Appendix A. - Vendor Information</H2>
Appendix A. Anti-Virus Vendor Information
<H3>Aladdin Knowledge Systems</H3>
<BLOCKQUOTE>
<A HREF="http://www.aks.com/home/csrt/valerts.asp#AnnaK">
http://www.aks.com/home/csrt/valerts.asp#AnnaK</A>
</BLOCKQUOTE>
<H3>Command Software Systems, Inc.</H3>
<BLOCKQUOTE>
<A HREF="http://www.commandcom.com/virus/vbsvwg.html">
http://www.commandcom.com/virus/vbsvwg.html</A>
</BLOCKQUOTE>
<H3>Computer Associates</H3>
<BLOCKQUOTE>
<A HREF="http://ca.com/virusinfo/virusalert.htm#vbs_sstworm">
http://ca.com/virusinfo/virusalert.htm#vbs_sstworm</A>
</BLOCKQUOTE>
<H3>F-Secure</H3>
<BLOCKQUOTE>
<A HREF="http://www.f-secure.com/v-descs/onthefly.shtml">
http://www.f-secure.com/v-descs/onthefly.shtml</A>
</BLOCKQUOTE>
<H3>Finjan Software, Ltd.</H3>
<BLOCKQUOTE>
<A HREF="http://www.finjan.com/attack_release_detail.cfm?attack_release_id=47">
http://www.finjan.com/attack_release_detail.cfm?attack_release_id=47</A>
</BLOCKQUOTE>
<H3>McAfee</H3>
<BLOCKQUOTE>
<A HREF="http://www.mcafee.com/anti-virus/viruses/vbssst/default.asp">
http://www.mcafee.com/anti-virus/viruses/vbssst/default.asp</A>
</BLOCKQUOTE>
<H3>Dr. Solomon, NAI</H3>
<BLOCKQUOTE>
<A HREF="http://vil.nai.com/vil/virusSummary.asp?virus_k=99011">
http://vil.nai.com/vil/virusSummary.asp?virus_k=99011</A>
</BLOCKQUOTE>
<H3>Sophos</H3>
<BLOCKQUOTE>
<A HREF="http://www.sophos.com/virusinfo/analyses/vbsssta.html">
http://www.sophos.com/virusinfo/analyses/vbsssta.html</A>
</BLOCKQUOTE>
<H3>Symantec</H3>
<BLOCKQUOTE>
<A HREF="http://www.symantec.com/avcenter/venc/data/vbs.sst@mm.html">
http://www.symantec.com/avcenter/venc/data/vbs.sst@mm.html</A>
</BLOCKQUOTE>
<H3>Trend Micro</H3>
<BLOCKQUOTE>
<A HREF="http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VBS_KALAMAR.A">
http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VBS_KALAMAR.A</A>
</BLOCKQUOTE>
You may wish to visit the CERT/CC's Computer Virus Resources Page located at:
<A HREF="http://www.cert.org/other_sources/viruses.html">
<P>
<BLOCKQUOTE>
http://www.cert.org/other_sources/viruses.html</A>
</BLOCKQUOTE>
<HR NOSHADE>
<P>This document was written by Cory Cohen, Roman Danyliw, Ian Finlay,
John Shaffer, Shawn Hernan, Kevin Houle, Brian B. King, and Shawn Van
Ittersum.
<P></P>
<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 2001 Carnegie Mellon University.</P>
<P>Revision History
<PRE>
February 12, 2001: Initial release
February 13, 2001: Corrected registry key in Impact section
</PRE>
|