Bangkok--6 Jul--Core & Peak
Another System Restart!
Make Sure WORM_RONTKBR Hasn’t Found Its Way into Your Computer
The family of WORM_RONTKBR.GEN(including WORM_RONTOKBRO and WORM_BRONTOK) discovered at the end of 2005 continues their spread this year. The scale of infection has expanded in Asia, while both the Damage potential and Distribution potential of these worms has been adjusted to High Risk by Trend Micro. This worm family is mainly spread through emails that contain blank subject lines, and using a fake Windows icon folder to trick users into activating the malware; once clicked, the My Documents folder is also opened in order to hide the malware’s execution. Trend Micro Senior Antivirus Researcher Jamz Yaneza explained, “The BRONTOK / RONTOKBR malware family is particularly hard to deal with. They immediately restart the computer system once any change to the registry are detected, preventing the normal operation of manual deletion commands, antivirus software and even personal firewalls. In addition, these worms also alter HOSTS files, preventing users from getting help from antivirus websites by redirecting them to other webpages.”
As the spam sent by the WORM_RONTKBR.GEN family includes Indonesian, and adopts social engineering by using current hot topics in Indonesia email subjects, curious users are prone to clicking on the attachments, leading to a large number of infections in Malaysia and Indonesia. Trend Micro calls on users to be cautious of any emails with blank subject lines, and not to open any related attachments.
Variants Possess Different Characteristics in Different Countries
According to Trend Micro’s World Virus Tracking Center, there are currently 26 variants of WORM_RONTOKBRO, accounting for 15,886 infections. Thailand, China, Taiwan and Japan are among the top ten regions, while the number of cases in Malaysia and Indonesia are quickly growing. Prevalent variants differ in various countries:
- Thirteen variants are being spread in China, with WORM_RONTOKBRO.D being the most serious. In addition to blank subject lines, this variant also includes no text in the email body, while the attached Kangen.exe file disguised as an IE icon. This worm uses the Microsoft Job Scheduler to automatically execute itself on a scheduled basis.
- There are currently 10 variants being spread in Taiwan, with the WORM_RONTOKBRO.B accounting for the greatest number of infections. This variant removes the Folder Options item from the IE toolbar, and causes the system to pause during startup; the user must press a key to resume, which causes the system to execute the malware upon each startup.
- The most common variant in Malaysia is the WORM_RONTOKBR.AT, which prevents the user from visiting 366 websites, most of which are sites related to antivirus software providers. This tricky variant prevents early detection.
- Thailand currently faces nine variants, and is the largest victim of the WORM_RONTOKBR.AT variant. Thailand also accounts for the most detections of the WORM_RONTKBR.GEN series.
Using Every Possible Means to Avoid Detection
Trend Micro explained that the WORM_RONTKBR.GEN family prevents normal operation of Registry Editor and Task Manager, while also suddenly restarting the system whenever certain strings are found in the IE title bar. In order to lower detection by content filters, these variants utilize their own Simple Mail Transfer Protocol (SMTP) engines to propagate themselves, thus avoiding having to rely on other email applications such as Outlook Express. In addition, they gather email addresses by searching affected systems for files with ASP, CSV, DOC, EML, HTM, PHP, TXT or WAB extensions. However, these crafty worms avoid any emails that include one of 65 text strings that are related to security providers, famous corporations or system administrators, in order to evade sending themselves to mailboxes with heightened security.
Trend Micro provides corporate users with the following strategies for avoiding email worm infections:
1. Install content filtering software at gateway level -WEB/SMTP/POP3, in order to prevent worms spreading via email.
2. Trend Micro IMSS5.x or ISVW6.0 users should set Intellitrap to ‘Enable Intellitrap.’
3. End users must keep their pattern files up-to-date.
4. Utilize DCS or Housecall online virus detection and realtime automatic removal.
Trend Micro: www.trendmicro.com
For more information, please contact;
Srisuput Siangyen,
Core & Peak Co., Ltd. Tel.02-439-4600 ext. 8300
Email: [email protected]