12345

8/29/2011

[Warning] Microsoft Windows remote desktop worm "Morto" is spreading

1. Introduction

F-secure, one of security SW companies has reported a worm "Morto", which can be spread via remote desktop, on Aug 28, 2011.
Currently, this malicious worm can infect both Windows-based workstation and server. This has been reported generating a lot of network traffics through RDP(Remote Desktop Protocol) port.

* Windows Remote Desktop worm "Morto" spreading

http://www.f-secure.com/weblog/archives/00002227.html

2. Spreading path and symptoms of infection

This malicious worm can be spread through RDP, we mentioned above, and tries to access remote connection with using exposed or simply-combined administaration passwords. In this process, it can damage new system or can download additional malicious file and execute. Furthermore, it makes a lot of traffics on certain port (3389/TCP) on accessing network connection.

Once infected by "Morto", it will scan local network's RDP port for remote connection. And then, while victim computer is connected by remote system, remote PC will copy itself to victim's certain drive after file sharing function will be activated.

Following paths have been known as the destination of copied files.

C:\Windows\Temp\ntshrui.dll
C:\Windows\System32\Sens32.dll
C:\Windows\Offline Web Pages\Cache.txt

Generated "sens32.dll" file will be added registry value, and it will work on booting.

[HKLM\SYSTEM\CurrentControlSet\Services\6to4\Parameters]
- Value name : "ServiceDll"
- Value data : "%windir%\temp\ntshrui.dll"

[HKLM\SYSTEM\CurrentControlSet\Services\6to4]
- Value name : "Description"
- Value data : "0"

[HKLM\SYSTEM\CurrentControlSet\Services\Sens]
- Value name : "DependOnService"
- Value data : "0"

[HKLM\SYSTEM\CurrentControlSet\Services\Sens\Parameters]
- Value name : "ServiceDll"
- Value data : "%windir%\system32\sens32.dll"

Infected PC will be remain on subnet network, and tries to login other systems with using following general passwords.

admin
password
server
test
user
pass
letmein
1234qwer
1q2w3e
1qaz2wsx
aaa
abc123
abcd1234
admin123
111
123
369
1111
12345
111111
123123
123321
123456
654321
666666
888888
1234567
12345678
123456789
1234567890

3. How to prevent

To use PC safely from security threats of these malicious worms, we recommend following "Security management tips" for general users.

Security management tips

1. Maintains latest security patch on OS and applications.
2. Makes password complex on logging Windows.
3. Stops un-using sharing folder.
4. Uses personal or business firewall.
5. Sets normal or higher internet browser's security preference.
6. Uses Anti-Virus SW and keeps latest security patch.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with “nProtect Anti-Virus/Spyware” for detecting such as malicious file stated above and runs responding system against various security threats.

Diagnosis name

- Worm/W32.Morto.7184

45 comments:

  1. شركة نقل اثاث من الرياض الى الاردن شركة نقل اثاث من الرياض الى الاردن
    شركة نقل اثاث من الرياض الى الاردن شركة نقل اثاث من الرياض الى الاردن
    شركة نقل اثاث من الرياض الى عمان شركة نقل اثاث من الرياض الى عمان
    شركة نقل اثاث بالرياض شركة نقل اثاث بالرياض
    افضل شركة نقل اثاث بالرياض افضل شركة نقل اثاث بالرياض
    شركة كشف تسربات المياه بالرياض شركة كشف تسربات المياه بالرياض
    دريم هاوس دريم هاوس

    ReplyDelete
  2. Thank you for posting such a great article! I found your website perfect for my needs
    other info

    ReplyDelete
  3. when i visiting this site I found cool and interesting here keep sharing kindly check it out xmodgame apk

    ReplyDelete
  4. For all the info about the education in iceland you need to check out this blog post. I think that you need to do it as soon as possible

    ReplyDelete
  5. if you have an arlo camera and you want to update your arlo camera features then visit this website to know more about arlo camera:- Arlo Netgear

    ReplyDelete
  6. Arlo Support for Arlo Camera Setup Issues, Log In, Connection Issues, Multiple Devices Setup, Login Issues etc. Quick Fix for common issues. Call now at +1-844-456-4180 Toll Free Number for Arlo Support
    https://arlologin-page.com/

    ReplyDelete
  7. Thank you for sharing a valuable piece of content. I know Netgear support phone number call at +1-844-456-4180. No queue Direct Human contact No Waiting and it's Free!
    https://netgearsupport.support/

    ReplyDelete
  8. This comment has been removed by the author.

    ReplyDelete
  9. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  10. gamekiller download
    gamekiller apk download
    gamekiller android
    But one thing that acts as an impasse condition in mobile gaming is many annoying features that comes with mobile Android gaming.

    ReplyDelete
  11. In case you are struggling to set your academic standards high and constantly failing due to the pressure of complicated essays during the semesters, try our services for excellent outcomes. Our in-house experts offering cheap essay writing service in UK are dedicated to bringing forth customized solutions covering each of the following aspects of essay writing.
    We know essay writing is a dreadful task for many. Thousands of students call us and say ‘write my essay for me.’ No matter what your topic or deadline is, we are here to help you. Get in touch with us and say write my essay for me as soon as possible.

    ReplyDelete
  12. Such a nice blog post on this topic. Our range of world-class premium features is the icing on the cake every student in the UK looks for. What makes our essay typer online tool stand out is not only its ability to provide unique solutions but also certain exclusive features for free.

    ReplyDelete
  13. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts.
    We have moral essay topics for graduates and postgraduates students at students assignment help that are suggested by eminent essay writers without taking any money.

    ReplyDelete
  14. Singaporeassignmenthelp.com is popular in Singaporean students for urgent assignment help at very nominal price. If you are looking for the best essay writing service for Singaporean students then our experts are available to guide you and offer you effective assignment services.

    ReplyDelete
  15. Get best online Assignment help from top rated assignment help expert. We have 10+ years of experience in the field of assignment help. NZ Assignment Help are providing all the assignment help services for all college and university students. Our Assignment helpers NZ are giving on-time delivery guarantee with 100% plagiarism free content for all the assignment help. We give special 10% discount for all local NZ Students.

    ReplyDelete
  16. Ireland assignment help can convert your dream into reality. Contact our assignment writers, and you score good grades. Our experts are experienced in assignment writing and provide academic writing services outstandingly. And you will get finest quality assignment help according to your requirements.

    ReplyDelete
  17. Looking for buying an assignment online? Uaeassignmenthelp.com is the best option in UAE. We give top quality content at reasonable price. We have 10+ years of experience in the field of assignment writing help. We are giving on-time delivery guarantee with 100% plagiarism free content. We are providing our services in Rakcity and Dubai. We have secured payment option so your money is safe with us.

    ReplyDelete
  18. Programming help is designed to provide effective assistance to all students who can’t tackle their coding world. Join the hub of professional academic writers through online programming help service and submit your assignment hassle-free. Programming assignment help

    ReplyDelete
  19. Hassle in writing your essay writing assignment in New Zealand. NZ Assignment is your first priority. Our writers are working from past 10 years and they are giving quick and reliable assignment help services for all local as well as international students studied in New Zealand. We have more than 10+ years of experience in assignment writing and they are providing best assignment help services in Lower-Hutt and Upper-Hutt and many more cities located in New Zealand.

    ReplyDelete
  20. Hp provides a number of models that offer various features to serve customers' purposes. One of such model is HP Envy 7640 Printer. If you are using this envy printer model and looking for a source to do its setup in an error-free manner, you can do it via 123.hp.com/setup 7640. At this place, you will find authoritative guidelines to do the setup and all the relevant files to download the driver of the HP printer. For technical assistance dial our toll-free number.

    ReplyDelete
  21. Are you looking for best assignment help service provider in UAE? UAE Assignment Help is the best option for all the assignment help services. We are giving all the assignment help services under one roof. Our writers are highly professional and they are working from past 10 years in assignment writing. We have secured payment option for all the assignment help so your money is safe with us. We are providing our services in Dubai and Rak-city with 100% plagiarism free content and on-time delivery guarantee.

    ReplyDelete
  22. NZ Assignment Help is the most favorite assignment help service provider in New Zealand. We are giving quick and reliable assignment help services for all local as well as international students studied in Hamilton and Wellington. Our writers are working from past 10+ years and they are giving 100% unique content for your assignment. We have a large team of 250+ assignment writers and they have secured payment option for all the assignment help.

    ReplyDelete
  23. UAE Assignment Help provides best Research Paper Assignment Help for all the students pursuing ph.D. in Dubai and Sharjah. We are giving quick and reliable assignment help services with 100% accuracy. We are writing your content 100% written from scratch. Our team are woriking from past 10+ years in assignment writing and they are giving 100% plagiarism free content for all the assignment help.

    ReplyDelete
  24. Nice blog, it's truly a complete package of lots of information, although I have read hundreds of blogs on this topic, the way you present all the stuff here is truly commendable. In the end, I just want to say textsmashzone is the best place if you want bulk voice call services in Delhi. They are cheap, reliable and trustworthy bulk SMS service in Delhi as well as best Cheapest Transactional SMS Service Provider in Delhi.

    ReplyDelete
  25. This the best site for the Latest apks to download or to known the information about any apk.
    Ac market
    Ac market Apk
    FMWhatsApp
    teatv
    teatv Apk
    morpheus tv
    morpheus tv Apk

    ReplyDelete
  26. This would cost you a lot less than what you would be paying for an individual religion assignment help. So, you can ask your friends and team up to place the orders, if you are not having a bulk order of your own. Well, there is no doubt that Mechatronics is a demanding subject and you are assigned with a heap of assignments that are pretty time-consuming. So, by opting for mechatronics assignment help. apart from these permanent offers, there are few waivers that you get during a particular timeline. They are usually active during the final days of the semester for Robotics assignment help

    ReplyDelete
  27. Have you ever asked someone ’Can you write my essay for me?’. With the guidance and support from Professional Essay Writer at total assignment help, you can submit the best essays which gets you the grade you want.

    ReplyDelete
  28. Hi, this is a wonderful piece of writing. I want to say that a nursing professional portfolio is a must-have document for every nurse. It contains everything a nurse needs in their career. The idea is to collect everything and have it in one place to easily trace them whenever you need them. There are nursing students who finding compiling the documents and putting them in one place difficult and opt to look for help in a platform like Nursing Professional Portfolio Writing Help . Luckily, we are always here to help.

    ReplyDelete
  29. The blog written is extremely impressive, with a great topic. However, a bit more research could have strengthened it even further. You can explore the services as offered by livewebtutors.com, a premium academic writing services platform offering the best of assignment help teamed with knowledge and experience

    ReplyDelete
  30. This comment has been removed by the author.

    ReplyDelete
  31. Many times students require essay help in order to submit their assignments on time. Total assignment help can provide you the essay help you need so you submit your essays before deadline and get the best grades as well.
    https://www.totalassignmenthelp.com/essay-help

    ReplyDelete
  32. When it comes to your career prospects and bright future, Assignment Help takes the onus on itself to promote your growth in the right direction. So, that way you wouldn’t have to think twice before trusting us with your academic papers. Place an order with us now and reap the rewards of brilliantly written academic papers today. Assignment help, one of the leading academic solution providers in Australia, understands the challenges and extends a helping hand to the aspiring engineers who are willing to land a job in Australia.
    Sydney Assignment Help

    ReplyDelete
  33. I was very puzzled while Writing Essay PapersWriting Essay Papers. Big thanks to Total Assignment Help for providing me with the quality content. I received my essay within the specified deadline and at pocket friendly cost.

    ReplyDelete