RealTime IT News

As the Bridex Worm Turns

A low-impact e-mail worm targeting a known vulnerability in Microsoft Windows has been detected in the wild and online security firms are warning that the worm is capable of spreading a variant of the active Funlove virus.

Software consultants F-Secure said the Bridex (Braid, W32/Braid@mm, W32/Braid.A-mm, I- Worm.Bridex) worm arrives in e-mails without a subject line and with a README.EXE attachment.

When the worm's file is run, it copies itself as REGEDIT.EXE file to the Windows System folder and creates a startup key for this file in the System Registry, allowing the activation of the worm's file every time Windows starts, the company warned.

It then scans the victim's Microsoft Outlook address book and e-mails copies of itself to any addresses it finds. The Bridex worm, written in Visual Basic, targets the IFrame exploit to run itself automatically on some systems and creates an EML file on a desktop (like the Nimda worm does) and also drops a bit modified Funlove virus-worm to a system.

The IFrame vulnerability, which has since been patched by Microsoft, allows an attacker to execute script on any page that contains frame or iframe (inline frame) elements, ignoring any protocol or domain restriction set forth by IE.

F-Secure noted that when the FunLove virus-worm is dropped, the beginning of MSCONFIG.EXE file is replaced with FunLove dropper meaning the file can't be disinfected and should be deleted and restored from a backup.

"The Funlove virus-worm first infects all EXE files on a local hard disk and then starts to infect files on shared drives. This is a network virus-worm, so in case of infection, a network has to be taken down before all infected workstations are disinfected. However taking down a network is not necessary when FSAV 5.40 is installed on every workstation. This FSAV version can repell all attempts to infect a workstation from a network," the company said.

The company found that the Bridex worm also copies itself as EXPLORER.EXE to an infected computer's desktop. "When this file is started and the worm is already in memory, it sometimes attempts to open a connection to www.hotmail.com or to www.sex.com websites," it warned.

Disinfection of the worm requires deleting of all its files including EXPLORER.EXE and HELP.EML from a desktop and disinfecting all files from Funlove virus infection. Funlove's dropper BRIDE.EXE and corrupted MSCONFIG.EXE files should be also deleted, F-Secure added.