The Saros worm was found on 5th of August 2004. This very simple worm will copy itself to predetermined locations and attempt to spread through diverse media such as P2P networks and IRC.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Given the clumsiness of the code and the nature of the messages within the worm, the author is, most likely a very young person with very limited knowledge.
Once executed the worm copies itself into the hardcoded path:
\WINDOWS\system32\NonYou.exe
Additionally, it will try to copy itself to the following fixed paths. If such path does not exist or has a slightly different name, the worm will fail to copy itself to such location. The list of all the locations the worm tries to drop itself to are:
\WINDOWS\system32\Love-ScreenSaver.scr \WINDOWS\system32\MSOutlookInternetUpdate.exe \progra~1\Kazaa\My Shared Folder\Rosy.exe \progra~1\Kazaa\My Shared Folder\Pipponoto.exe \progra~1\Kazaa\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe \progra~1\Kazaa\My Shared Folder\The Rasmus - In The Shadows.mp3.exe \progra~1\Kazaa\My Shared Folder\50 Cent - In da Club.mp3.exe \progra~1\Kazaa\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Kazaa\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Kazaa\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Kazaa\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe \progra~1\Kazaa\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Kazaa\My Shared Folder\Lionel Richie - Just For You.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Rosy.exe \progra~1\Kazaa Lite\My Shared Folder\Pipponoto.exe \progra~1\Kazaa Lite\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\The Rasmus - In The Shadows.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\50 Cent - In da Club.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Kazaa Lite\My Shared Folder\Lionel Richie - Just For You.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Rosy.exe \progra~1\Kazaa Lite K++\My Shared Folder\Pipponoto.exe \progra~1\Kazaa Lite K++\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\The Rasmus - In The Shadows.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\50 Cent - In da Club.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Haiducii - Dragostea din tei.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Kazaa Lite K++\My Shared Folder\Lionel Richie - Just For You.mp3.exe \progra~1\ICQ\Shared Folder\Rosy.exe \progra~1\ICQ\Shared Folder\Pipponoto.exe \progra~1\ICQ\Shared Folder\Anastacia - Left Outside Alone.mp3.exe \progra~1\ICQ\Shared Folder\The Rasmus - In The Shadows.mp3.exe \progra~1\ICQ\Shared Folder\50 Cent - In da Club.mp3.exe \progra~1\ICQ\Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\ICQ\Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\ICQ\Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\ICQ\Shared Folder\Raf - In tutti i miei giorni.mp3.exe \progra~1\ICQ\Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\ICQ\Shared Folder\Lionel Richie - Just For You.mp3.exe \progra~1\Grokster\My Grokster\Rosy.exe \progra~1\Grokster\My Grokster\Pipponoto.exe \progra~1\Grokster\My Grokster\Anastacia - Left Outside Alone.mp3.exe \progra~1\Grokster\My Grokster\The Rasmus - In The Shadows.mp3.exe \progra~1\Grokster\My Grokster\50 Cent - In da Club.mp3.exe \progra~1\Grokster\My Grokster\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Grokster\My Grokster\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Grokster\My Grokster\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Grokster\My Grokster\Raf - In tutti i miei giorni.mp3.exe \progra~1\Grokster\My Grokster\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Grokster\My Grokster\Lionel Richie - Just For You.mp3.exe \progra~1\Bearshare\Shared\Rosy.exe \progra~1\Bearshare\Shared\Pipponoto.exe \progra~1\Bearshare\Shared\Anastacia - Left Outside Alone.mp3.exe \progra~1\Bearshare\Shared\The Rasmus - In The Shadows.mp3.exe \progra~1\Bearshare\Shared\50 Cent - In da Club.mp3.exe \progra~1\Bearshare\Shared\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Bearshare\Shared\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Bearshare\Shared\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Bearshare\Shared\Raf - In tutti i miei giorni.mp3.exe \progra~1\Bearshare\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Bearshare\Shared\Lionel Richie - Just For You.mp3.exe \progra~1\eDonkey2000\Incoming\Rosy.exe \progra~1\eDonkey2000\Incoming\Pipponoto.exe \progra~1\eDonkey2000\Incoming\Anastacia - Left Outside Alone.mp3.exe \progra~1\eDonkey2000\Incoming\The Rasmus - In The Shadows.mp3.exe \progra~1\eDonkey2000\Incoming\50 Cent - In da Club.mp3.exe \progra~1\eDonkey2000\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\eDonkey2000\Incoming\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\eDonkey2000\Incoming\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\eDonkey2000\Incoming\Raf - In tutti i miei giorni.mp3.exe \progra~1\eDonkey2000\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\eDonkey2000\Incoming\Lionel Richie - Just For You.mp3.exe \progra~1\eMule\Incoming\Rosy.exe \progra~1\eMule\Incoming\Pipponoto.exe \progra~1\eMule\Incoming\Anastacia - Left Outside Alone.mp3.exe \progra~1\eMule\Incoming\The Rasmus - In The Shadows.mp3.exe \progra~1\eMule\Incoming\50 Cent - In da Club.mp3.exe \progra~1\eMule\Incoming\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\eMule\Incoming\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\eMule\Incoming\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\eMule\Incoming\Raf - In tutti i miei giorni.mp3.exe \progra~1\eMule\Incoming\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\eMule\Incoming\Lionel Richie - Just For You.mp3.exe \progra~1\Morpheus\My Shared Folder\Rosy.exe \progra~1\Morpheus\My Shared Folder\Pipponoto.exe \progra~1\Morpheus\My Shared Folder\Anastacia - Left Outside Alone.mp3.exe \progra~1\Morpheus\My Shared Folder\The Rasmus - In The Shadows.mp3.exe \progra~1\Morpheus\My Shared Folder\50 Cent - In da Club.mp3.exe \progra~1\Morpheus\My Shared Folder\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Morpheus\My Shared Folder\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Morpheus\My Shared Folder\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Morpheus\My Shared Folder\Raf - In tutti i miei giorni.mp3.exe \progra~1\Morpheus\My Shared Folder\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Morpheus\My Shared Folder\Lionel Richie - Just For You.mp3.exe \progra~1\LimeWire\Shared\Rosy.exe \progra~1\LimeWire\Shared\Pipponoto.exe \progra~1\LimeWire\Shared\Anastacia - Left Outside Alone.mp3.exe \progra~1\LimeWire\Shared\The Rasmus - In The Shadows.mp3.exe \progra~1\LimeWire\Shared\50 Cent - In da Club.mp3.exe \progra~1\LimeWire\Shared\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\LimeWire\Shared\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\LimeWire\Shared\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\LimeWire\Shared\Raf - In tutti i miei giorni.mp3.exe \progra~1\LimeWire\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\LimeWire\Shared\Lionel Richie - Just For You.mp3.exe \progra~1\Tesla\Files\Rosy.exe \progra~1\Tesla\Files\Pipponoto.exe \progra~1\Tesla\Files\Anastacia - Left Outside Alone.mp3.exe \progra~1\Tesla\Files\The Rasmus - In The Shadows.mp3.exe \progra~1\Tesla\Files\50 Cent - In da Club.mp3.exe \progra~1\Tesla\Files\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\Tesla\Files\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\Tesla\Files\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\Tesla\Files\Raf - In tutti i miei giorni.mp3.exe \progra~1\Tesla\Files\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\Tesla\Files\Lionel Richie - Just For You.mp3.exe \progra~1\WinMX\Shared\Rosy.exe \progra~1\WinMX\Shared\Pipponoto.exe \progra~1\WinMX\Shared\Anastacia - Left Outside Alone.mp3.exe \progra~1\WinMX\Shared\The Rasmus - In The Shadows.mp3.exe \progra~1\WinMX\Shared\50 Cent - In da Club.mp3.exe \progra~1\WinMX\Shared\Vanessa Carltron - Ordinary Day.mp3.exe \progra~1\WinMX\Shared\Haiducii - Dragostea Din Tei.mp3.exe \progra~1\WinMX\Shared\Black Eyed Peas - Hey Mama.mp3.exe \progra~1\WinMX\Shared\Raf - In tutti i miei giorni.mp3.exe \progra~1\WinMX\Shared\Vasco Rossi - Buoni e cattivi.mp3.exe \progra~1\WinMX\Shared\Lionel Richie - Just For You.mp3.exe
It will create a HTA file in:
\WINDOWS\system32\About.hta
whose contents are:
GEDZAC Labs 2004 Have a nice Program for You NonYou Coded by Sarosoft Dedicated to my Love Rosy
Afterwards it will present the user with a dialog titled:
Microsoft Windows Update
With the following text:
Click Yes For Update Microsoft Outlook via email
It will then drop a VBS file to:
\WINDOWS\system32\nstdnrdll32.vbs
And executes it. This script will add the following registry keys:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce] "wincomp32" = "\WINDOWS\system32\nstdnrdll32.vbs" [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "nldr32" = "\WINDOWS\system32\NonYou.exe"
So the components are run when Windows starts.
If the day of the month is 11th or 23rd it will set the start page to the author group's webpage and will show the HTA file mentioned previously.
Any other day it will attempt to send emails with the worm's executable to the addresses listed in Outlook's address book.
The messages will have subject:
Microsoft Outlook News
And body:
Microsoft Outlook Update / Bug Fixed - Contact: support@microsoft.com
and the attached file will be:
\WINDOWS\system32\MSOutlookInternetUpdate.exe
Then it will load the following URL:
http://www.windowsupdate.com
If Mirc IRC client is installed the worm will attempt to send itself to the users in the channels which the infected user joins.