Security

Ask something
Discussion Locked

New Virus

0 helpful
1 reply

by javery

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Has anybody heard of iworm.blebla.3? Do you know of any repairs? It's a variation on the Verona/Romeo and Juliet virus. It will add .exe to files and may or may not overwrite the files.

1 reply

by kdecosta

This Internet worm uses four different vulnerabilities in an attempt to run its code:
"IFRAME ExecCommand" Vulnerability
"Cache Bypass" Vulnerability
"scriptlet.typelib/Eyedog" Vulnerability
"HTML Help File Code Execution" Vulnerability

This Internet worm is contained within an HTML coded email message which also has two file attachments. The HTML code contains the "IFRAME ExecCommand" Vulnerability coupled with the "Cache Bypass" Vulnerability, allowing the two file attachments MYROMEO.EXE and MYJULIET.CHM to be saved to the local machine into the TEMP folder without notification to the user.

The file MYJULIET.CHM is executed from the TEMP folder - it contains the "scriptlet.typelib/Eyedog" Vulnerability. This compiled HTML file contains only a couple of lines instructing to run a signed control for compiled HTML help files (HH.EXE)in order to run MYROMEO.EXE via this vulnerability.

MYROMEO reads addresses from the Windows Address Book (.WAB file) and sends itselfto users listed there by using one of several available SMTP servers.

The SMTP IP addresses are chosen from the following list:

194.153.216.60
195.117.152.91
195.116.62.86
195.117.99.98
212.244.199.2
213.25.111.2

Aliases
CHM_BLEBLA.A
I-Worm.Blebla
Romeo and Juliet
TROJ_BLEBLA.A
W32.Blebla.worm (NAV)
W32/BleBla@MM
W32/Verona

This discussion is closed to new replies.