The CERT Coordination Center publishes incident notes to provide information about incidents to the Internet community. <h2>W32/Gibe Malicious Code</h2> Release Date: March 12, 2002<br/> Last Updated: March 13, 2002<p> A complete revision history can be found at the end of this file. <a name="systems"> <h4>Systems Affected Systems running Microsoft Windows <a name="overview"> <h3>Overview</h3> <p>The CERT/CC has received numerous reports of a piece of malicious code, written for the Windows platform, commonly known as W32/Gibe. W32/Gibe spreads via email disguised as a Microsoft security bulletin and patch. A user must execute the attached file in order to be infected. The payload is non-destructive, but a backdoor is installed that may allow an intruder access to the system.</p> <a name="description"> <h3>I. Description</h3> <p>W32/Gibe is a Windows binary executable written in Visual Basic that is spreading via email. The email appears to be from Microsoft; however, Microsoft does not distribute patches via email. The Microsoft software distribution policy can be viewed at <a href="http://www.microsoft.com/technet/security/policy/swdist.asp">http://www.microsoft.com/technet/security/policy/swdist.asp</a></p> <p>The email appears as the following:</p> <blockquote><font face="Courier, Arial, Geneva"> <hr/> <p> <b>From:</b> Microsoft Corporation Security Center <rdquest12@microsoft.com><br/> <b>To:</b> Microsoft Customer <'customer@yourdomain.com'><br/> <b>Subject:</b> Internet Security Update<br/> <b>Attachment:</b> q216309.exe<br/> </p> <p>Microsoft Customer,</p> <p><dd>this is the latest version of security update, the "7 Mar 2002 Cumulative Patch" update which eliminates all known security vulnerabilities affecting Internet Explorer and MS Outlook/Express as well as six new vulnerabilities, and is discussed in Microsoft Security Bulletin MS02-005. Install now to protect your computer from these vulnerabilities, the most serious of which could allow an attacker to run code on your computer.</dd></p> <p>Description of several well-know vulnerabilities:</p> <p>- "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment" vulnerability. If a malicious user sends an affected HTML e-mail or hosts an affected e-mail on a Web site, and a user opens the e-mail or visits the Web site, Internet Explorer automatically runs the executable on the user's computer.</p> <p>- A vulnerability that could allow an unauthorized user to learn the location of cached content on your computer. This could enable the unauthorized user to launch compiled HTML Help (.chm) files that contain shortcuts to executables, thereby enabling the unauthorized user to run the executables on your computer.</p> <p>- A new variant of the "Frame Domain Verification" vulnerability could enable a malicious Web site operator to open two browser windows, one in the Web site's domain and the other on your local file system, and to pass information from your computer to the Web site.</p> <p>- CLSID extension vulnerability. Attachments which end with a CLSID file extension do not show the actual full extension of the file when saved and viewed with Windows Explorer. This allows dangerous file types to look as though they are simple, harmless files - such as JPG or WAV files - that do not need to be blocked.<p> <p>System requirements:<br/> Versions of Windows no earlier than Windows 95.</p> <p>This update applies to:<br/> Versions of Internet Explorer no earlier than 4.01<br/> Versions of MS Outlook no earlier than 8.00<br/> Versions of MS Outlook Express no earlier than 4.01<br/> </p> <p>How to install<br/> Run attached file q216309.exe</p> <p>How to use<br/> You don't need to do anything after installing this item.</p> <p>For more information about these issues, read Microsoft Security Bulletin MS02-005, or visit link below.<br/> http://www.microsoft.com/windows/ie/downloads/critical/default.asp<br/> If you have some questions about this article contact us at rdquest12@microsoft.com<br/> </p> <p>Thank you for using Microsoft products.</p> <p>With friendly greetings,<br/> MS Internet Security Center.<br/> ----------------------------------------<br/> ----------------------------------------<br/> Microsoft is registered trademark of Microsoft Corporation.<br/> Windows and Outlook are trademarks of Microsoft Corporation.<br/> </p></p></p></font> <hr/> </blockquote> <p>The email message created by W32/Gibe tries to convince users that the attached file is patch supplied by Microsoft. The attached file is in fact a copy of the malicious code.</p> <p>The attached file has the following characteristics:</p> <blockquote><b>File name:</b> q216309.exe<br/> <b>MD5:</b> 739f917f746eb124514155cf36de5111<br/> <b>File size:</b> 122880</blockquote> <p>When the attached file containing the malicious code is executed, it appears as though it is installing a Microsoft Security Update. It displays several dialog boxes during this process. The malicious code continues to execute regardless of the user's responses to the displayed dialog boxes. (Clicking "Cancel" will not stop the malicious code from executing.)</p> <p>During execution, W32/Gibe creates the following files in the Windows root directory of the local system:</p> <ul> <li>Q216309.exe (a copy of the malicious code)</li> <li>Vtnmsccd.dll (a copy of the malicious code)</li> <li>BcTool.exe (mass-mailing component)</li> <li>WinNetW.exe (searches for email addresses)</li> <li>GFXacc.exe (backdoor trojan)</li> </ul> <p>The worm also creates the file 02_N803.dat in the Windows directory to store email addresses collected from the Microsoft Outlook address book and various other files on the local system.</p> <p>The following values are added to the registry to ensure that the backdoor and mass-mailing functions run each time the system restarts:</p> <blockquote>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\<br/> <dd>LoadDBackUp = C:\Windows\BcTool.exe<br/> <dd>3Dfx Acc = C:\Windows\GFXacc.exe </dd></dd></blockquote> <p>W32/Gibe also creates the registry key:</p> <blockquote>HKEY_LOCAL_MACHINE\Software\AVTech\<br/> <dd>Installed = ...by Begbie<br/> <dd>Default Address = (default email address)<br/> <dd>Default Server = (default SMTP server)<br/> </dd></dd></dd></blockquote> <p>If the user runs the attached file again, it displays a dialog box indicating that the patch has already been applied.</p> <a name="impact"> <h3>II. Impact</h3> <p>W32/Gibe installs a backdoor (GFXacc.exe), which listens on port 12378/tcp. This may allow an intruder to gain access to the system and execute arbitrary commands.</p> <p>In addition, W32/Gibe mass-mails copies of itself to addresses found on the victim host. The victim and targeted sites may experience an increased load on the mail server when the malicious code is propagating. <a name="solution"> <h3>III. Solution</h3> <h4>Remove infected files from the system</h4> <p>If the attached file has not been executed, it should be safe to simply delete the message and attachment from your email client. </p> <p>If the malicious code has run, it's possible to get rid of W32/Gibe by deleting all of its components from an infected system. It should be noted that this is an incomplete process; it will not remove the entries in the system registry. If possible, it is best to run an anti-virus product to repair the system and remove the associated files. <h4>Configure email clients to block executable attachments</h4> <p>Many email clients can be configured to prevent users from opening potentially malicious executable attachments while reading mail. </p> <h4>Run and maintain an anti-virus product</h4> <p>It is important for users to update their anti-virus software. Most anti-virus software vendors have released updated information, tools, or virus databases to help detect and recover from W32/Gibe. A list of vendor-specific anti-virus information can be found in <a href="#vendors">Appendix A</a>. <p> Many anti-virus packages support automatic updates of virus definitions. We recommend using these automatic updates when available. <h4>Exercise caution when opening attachments</h4> <p>Exercise caution when receiving email with attachments. Users should be suspicious of unexpected attachments regardless of their origin. In general, users should also always scan files received through email with an anti-virus product. <p> The following section of the "Home Network Security" document provides advice on handling email attachments securely: <blockquote> <a href="http://www.cert.org/tech_tips/home_networks.html#IV-A-4"> http://www.cert.org/tech_tips/home_networks.html#IV-A-4</a> </blockquote> <h4>Filter the email or use a firewall</h4> <p>Sites can use email filtering techniques to delete messages containing subject lines known to contain the malicious code, or they can filter all attachments. <a name="vendors"> <h3>Appendix A - Vendor Information</h3> <h4>Central Command, Inc.</h4> <dl><dd><a href="http://support.centralcommand.com/cgi-bin/command.cfg/php/enduser/std_adp.php?p_sid=J2Rv5R9g&p_lva=&p_refno=020304-000001">http://support.centralcommand.com/cgi-bin/command.cfg/php/enduser/</a><br/> <a href="http://support.centralcommand.com/cgi-bin/command.cfg/php/enduser/std_adp.php?p_sid=J2Rv5R9g&p_lva=&p_refno=020304-000001">std_adp.php?p_sid=J2Rv5R9g&p_lva=&p_refno=020304-000001</a></dd></dl> <h4>Command Software Systems</h4> <dl><dd><a href="http://www.commandsoftware.com/virus/gibe.html">http://www.commandsoftware.com/virus/gibe.html</a></dd></dl> <h4>Computer Associates</h4> <dl><dd><a href="http://www3.ca.com/virus/virus.asp?ID=11468">http://www3.ca.com/virus/virus.asp?ID=11468</a></dd></dl> <h3>F-Secure Corp</h3> <dl><dd><a href="http://www.europe.f-secure.com/v-descs/gibe.shtml">http://www.europe.f-secure.com/v-descs/gibe.shtml</a></dd></dl> <h3>McAfee</h3> <dl><dd><a href="http://vil.mcafee.com/dispVirus.asp?virus_k=99377&">http://vil.mcafee.com/dispVirus.asp?virus_k=99377&</a></dd></dl> <h3>Microsoft</h3> <dl><dd><p>The Microsoft PSS Security Response Team Alert for this issue can be found at <a href="http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/gibe.asp">http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/gibe.asp</a> The alert also tells how to contact Microsoft for free support for this sort of issue.</p> <p>Outlook XP and Outlook 2000 and 98 with the Outlook Email Security Update are not vulnerable to this virus as they would automatically block the .exe attachment from being opened. More information on the Outlook Email Security Update can be found here: <a href="http://www.microsoft.com/office/ork/2000/journ/OutSecUpdate.htm">http://www.microsoft.com/office/ork/2000/journ/OutSecUpdate.htm</a></p></dd></dl> <h3>Norman Data Defense Systems</h3> <dl><dd><a href="http://www.norman.com/virus_info/w32_gibe_a_mm.shtml">http://www.norman.com/virus_info/w32_gibe_a_mm.shtml</a></dd></dl> <h3>Panda Software</h3> <dl><dd><a href="http://service.pandasoftware.es/servlet/panda.pandaInternet.EntradaDatosInternet?operacion=EV2FichaVirus&idVirusFicha=2627&pestanaFicha=1&idioma=2">http://service.pandasoftware.es/servlet/panda.pandaInternet.EntradaDatosInternet?</a><br/> <a href="http://service.pandasoftware.es/servlet/panda.pandaInternet.EntradaDatosInternet?operacion=EV2FichaVirus&idVirusFicha=2627&pestanaFicha=1&idioma=2">operacion=EV2FichaVirus&idVirusFicha=2627&pestanaFicha=1&idioma=2</a> </dd></dl> <h3>Proland Software</h3> <dl><dd><a href="http://www.pspl.com/virus_info/worms/gibe.htm">http://www.pspl.com/virus_info/worms/gibe.htm</a></dd></dl> <h3>Sophos</h3> <dl><dd><a href="http://www.sophos.com/virusinfo/analyses/w32gibea.html">http://www.sophos.com/virusinfo/analyses/w32gibea.html</a></dd></dl> <h3>Symantec</h3> <dl><dd><a href="http://securityresponse.symantec.com/avcenter/venc/data/pf/w32.gibe@mm.html">http://securityresponse.symantec.com/avcenter/venc/data/pf/w32.gibe@mm.html</a></dd></dl> <h3>Trend Micro</h3> <dl><dd><a href="http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GIBE.A">http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_GIBE.A</a></dd></dl> <p> You may wish to visit the CERT/CC's Computer Virus Resources Page located at: <a href="http://www.cert.org/other_sources/viruses.html"> <p> <blockquote> http://www.cert.org/other_sources/viruses.html</blockquote></p></a> <p> <b>Author(s)</b>: Brian B. King<br/> <!--#include virtual="/include/footer_nocopyright.html" --> <p>Copyright 2002 Carnegie Mellon University.</p> </p></p></a></p></p></p></p></p></p></a></p></a></a></a></h4></a></p> |