 |
Severity: High |
Sober.N Email Worm
Overview: Zone Labs is monitoring the rapidly increasing spread of the Sober.N email worm. Sober.N presents a significant risk to computer users. Therefore, this version has been classified "High Risk."
Date Published: May 3, 2005
Date Last Revised: August 18, 2005
Impact: Sober.N attempts to compromise system integrity in several ways.
- Acting as a backdoor on an infected system
- Spreading via email
- Collecting email addresses
- Downloading and executing arbitrary files
- Deleting files
Description: Sober.N spreads via e-mail attachments ending in .zip extension. Upon execution, the worm creates new files with the following names:
- %Windows%\csrss.exe
- %Windows%\smss.exe
- %Windows%\services.exe
For a full list of possible file names, please visit the Zone Labs Virus Information Center: http://vic.zonelabs.com/tmpl/body/CA/virusDetails.jsp?VId=42813.
The worm sets the following registry values to ensure that it runs on every system boot:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\_WinStart = "%Windows%\Connection Wizard\Status\services.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ WinStart = "%Windows%\Connection Wizard\Status\services .exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\ WinStart = "%Windows%\Connection Wizard\Status\services.exe %1"
Recommended Actions:
ZoneAlarm Family
ZoneAlarm products providing antivirus features recognize this worm as: Sober.N. The antivirus features within these products will recognize and quarantine this worm. Furthermore, ZoneAlarm Pro and ZoneAlarm Internet Security Suite prevent infection through Inbound MailSafe Protection. Program Control will alert the computer user if malicious code attempts to access the network.
Recommended Actions:
- Ensure Inbound MailSafe Protection is enabled and the .zip extension is set to quarantine during the initial outbreak and infection phase.
- Ensure Lock hosts file is enabled. To confirm, select Firewall | Main and click the Advanced button. Within the dialogue, confirm the "Lock hosts file" box is checked.
- Monitor Program Control alerts for processes named:
- csrss.exe
- smss.exe
- services.exe
- Update antivirus products to provide the most up-to-date protection
Related Resources:
Contact: Zone Labs customers who are concerned about information contained in this advisory or have additional technical questions may reach our Technical Support team at: http://www.zonelabs.com/support/. To report security issues with Zone Labs products contact security@zonelabs.com.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. Zone Labs and Zone Labs products, are registered trademarks of Zone Labs Incorporated. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.
Copyright: ©2004-2005 Zone Labs LLC All rights reserved. Zone Labs, TrueVector, ZoneAlarm, and Cooperative Enforcement are registered trademarks of Zone Labs LLC The Zone Labs logo, Check Point Integrity and IMsecure are trademarks of Zone Labs, Inc. Check Point Integrity protected under U.S. Patent No. 5,987,611. Reg. U.S. Pat. & TM Off. Cooperative Enforcement is a service mark of Zone Labs LLC All other trademarks are the property of their respective owners.
Any reproduction of this alert other than as an unmodified copy
of this file requires authorization from Zone Labs. Permission
to electronically redistribute this alert in its unmodified form
is granted. All other rights, including the use of other media,
are reserved by Zone Labs LLC.
|
