Wallon
Summary
We got several reports about Wallon worm on May 11th, 2004. The worm sends HTML-based messages via email. These messages contain links that use Yahoo redirection service to direct users' web browsers to the website where there's a script that downloads and runs additional worm's components.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Wallon is an email worm that does not send itself as an attachment. Instead it sends a link in a HTML message. The link is made to look like a link to Yahoo pages, and once user clicks on the link, it uses the Yahoo redirection service to open another web page that downloads "terra.html". The "terra.html" contains an encypted link to another "count.html" page. This page uses the object data vulnerability to downloand and run the "sys.chm" file. The "sys.chm" file uses the XMLHTTP/ADODB to download a binary file called "sys.exe". This file overwrites the Windows Media Player file "wmplayer.exe".
The downloaded "sys.exe" binary will be executed whenever a user opens Windows Media Player either directly or via a web page.
The SYS.EXE file is a downloader. It downloads a file called NOT.EXE and puts it as ALPHA.EXE into the root folder of C: drive. Then this file is activated. Additionally the downloader changes startup search pages of Internet Explorer to point to the following website: www.google.com.super-fast-search.apsua.com.
The main worm's file ALPHA.EXE is a PE executable about 150 kilobytes long packed with ASPack file compressor.
When the worm's file is run, it checks the value of the following Registry key:
[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main] "Wh" = ?
If the value is equal to 'Yes', the worm waits for 5 hours and then opens the pixpox.com website with the default web browser. Then the worm keeps opening that website every 10 minutes and does it 10 times.
If that Registry key doesn't exist, the worm creates it. Then it reads user's SMTP settings from the Registry, locates and opens a WAB (Windows Address Book) file and sends email messages to all found addresses. emails sent by the worm look like that:
The link contains the domain name of a recipient.
The worm doesn't send emails to addresses that contain any of the following substrings:
microsoft support software webmaster postmaster admin +
Additionally the worm sends an empty message to the 1@600pics.cjb.net address. This may be done to collect email addresses of people whose computers are infected by the worm.
If user's Address Book is empty, an error messagebox is shown. On our test system it looked like that:
