12345

8/29/2011

[Warning] Microsoft Windows remote desktop worm "Morto" is spreading

1. Introduction

F-secure, one of security SW companies has reported a worm "Morto", which can be spread via remote desktop, on Aug 28, 2011.
Currently, this malicious worm can infect both Windows-based workstation and server. This has been reported generating a lot of network traffics through RDP(Remote Desktop Protocol) port.

* Windows Remote Desktop worm "Morto" spreading

http://www.f-secure.com/weblog/archives/00002227.html

2. Spreading path and symptoms of infection

This malicious worm can be spread through RDP, we mentioned above, and tries to access remote connection with using exposed or simply-combined administaration passwords. In this process, it can damage new system or can download additional malicious file and execute. Furthermore, it makes a lot of traffics on certain port (3389/TCP) on accessing network connection.

Once infected by "Morto", it will scan local network's RDP port for remote connection. And then, while victim computer is connected by remote system, remote PC will copy itself to victim's certain drive after file sharing function will be activated.

Following paths have been known as the destination of copied files.

C:\Windows\Temp\ntshrui.dll
C:\Windows\System32\Sens32.dll
C:\Windows\Offline Web Pages\Cache.txt

Generated "sens32.dll" file will be added registry value, and it will work on booting.

[HKLM\SYSTEM\CurrentControlSet\Services\6to4\Parameters]
- Value name : "ServiceDll"
- Value data : "%windir%\temp\ntshrui.dll"

[HKLM\SYSTEM\CurrentControlSet\Services\6to4]
- Value name : "Description"
- Value data : "0"

[HKLM\SYSTEM\CurrentControlSet\Services\Sens]
- Value name : "DependOnService"
- Value data : "0"

[HKLM\SYSTEM\CurrentControlSet\Services\Sens\Parameters]
- Value name : "ServiceDll"
- Value data : "%windir%\system32\sens32.dll"

Infected PC will be remain on subnet network, and tries to login other systems with using following general passwords.

admin
password
server
test
user
pass
letmein
1234qwer
1q2w3e
1qaz2wsx
aaa
abc123
abcd1234
admin123
111
123
369
1111
12345
111111
123123
123321
123456
654321
666666
888888
1234567
12345678
123456789
1234567890

3. How to prevent

To use PC safely from security threats of these malicious worms, we recommend following "Security management tips" for general users.

Security management tips

1. Maintains latest security patch on OS and applications.
2. Makes password complex on logging Windows.
3. Stops un-using sharing folder.
4. Uses personal or business firewall.
5. Sets normal or higher internet browser's security preference.
6. Uses Anti-Virus SW and keeps latest security patch.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with “nProtect Anti-Virus/Spyware” for detecting such as malicious file stated above and runs responding system against various security threats.

Diagnosis name

- Worm/W32.Morto.7184

37 comments:

  1. شركة نقل اثاث من الرياض الى الاردن شركة نقل اثاث من الرياض الى الاردن
    شركة نقل اثاث من الرياض الى الاردن شركة نقل اثاث من الرياض الى الاردن
    شركة نقل اثاث من الرياض الى عمان شركة نقل اثاث من الرياض الى عمان
    شركة نقل اثاث بالرياض شركة نقل اثاث بالرياض
    افضل شركة نقل اثاث بالرياض افضل شركة نقل اثاث بالرياض
    شركة كشف تسربات المياه بالرياض شركة كشف تسربات المياه بالرياض
    دريم هاوس دريم هاوس

    ReplyDelete
  2. Thank you for posting such a great article! I found your website perfect for my needs
    other info

    ReplyDelete
  3. when i visiting this site I found cool and interesting here keep sharing kindly check it out xmodgame apk

    ReplyDelete
  4. For all the info about the education in iceland you need to check out this blog post. I think that you need to do it as soon as possible

    ReplyDelete
  5. if you have an arlo camera and you want to update your arlo camera features then visit this website to know more about arlo camera:- Arlo Netgear

    ReplyDelete
  6. Arlo Support for Arlo Camera Setup Issues, Log In, Connection Issues, Multiple Devices Setup, Login Issues etc. Quick Fix for common issues. Call now at +1-844-456-4180 Toll Free Number for Arlo Support
    https://arlologin-page.com/

    ReplyDelete
  7. Thank you for sharing a valuable piece of content. I know Netgear support phone number call at +1-844-456-4180. No queue Direct Human contact No Waiting and it's Free!
    https://netgearsupport.support/

    ReplyDelete
  8. This comment has been removed by the author.

    ReplyDelete
  9. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  10. gamekiller download
    gamekiller apk download
    gamekiller android
    But one thing that acts as an impasse condition in mobile gaming is many annoying features that comes with mobile Android gaming.

    ReplyDelete
  11. In case you are struggling to set your academic standards high and constantly failing due to the pressure of complicated essays during the semesters, try our services for excellent outcomes. Our in-house experts offering cheap essay writing service in UK are dedicated to bringing forth customized solutions covering each of the following aspects of essay writing.
    We know essay writing is a dreadful task for many. Thousands of students call us and say ‘write my essay for me.’ No matter what your topic or deadline is, we are here to help you. Get in touch with us and say write my essay for me as soon as possible.

    ReplyDelete
  12. Such a nice blog post on this topic. Our range of world-class premium features is the icing on the cake every student in the UK looks for. What makes our essay typer online tool stand out is not only its ability to provide unique solutions but also certain exclusive features for free.

    ReplyDelete
  13. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts.
    We have moral essay topics for graduates and postgraduates students at students assignment help that are suggested by eminent essay writers without taking any money.

    ReplyDelete
  14. Singaporeassignmenthelp.com is popular in Singaporean students for urgent assignment help at very nominal price. If you are looking for the best essay writing service for Singaporean students then our experts are available to guide you and offer you effective assignment services.

    ReplyDelete
  15. Get best online Assignment help from top rated assignment help expert. We have 10+ years of experience in the field of assignment help. NZ Assignment Help are providing all the assignment help services for all college and university students. Our Assignment helpers NZ are giving on-time delivery guarantee with 100% plagiarism free content for all the assignment help. We give special 10% discount for all local NZ Students.

    ReplyDelete
  16. Ireland assignment help can convert your dream into reality. Contact our assignment writers, and you score good grades. Our experts are experienced in assignment writing and provide academic writing services outstandingly. And you will get finest quality assignment help according to your requirements.

    ReplyDelete
  17. Looking for buying an assignment online? Uaeassignmenthelp.com is the best option in UAE. We give top quality content at reasonable price. We have 10+ years of experience in the field of assignment writing help. We are giving on-time delivery guarantee with 100% plagiarism free content. We are providing our services in Rakcity and Dubai. We have secured payment option so your money is safe with us.

    ReplyDelete
  18. Programming help is designed to provide effective assistance to all students who can’t tackle their coding world. Join the hub of professional academic writers through online programming help service and submit your assignment hassle-free. Programming assignment help

    ReplyDelete
  19. Hassle in writing your essay writing assignment in New Zealand. NZ Assignment is your first priority. Our writers are working from past 10 years and they are giving quick and reliable assignment help services for all local as well as international students studied in New Zealand. We have more than 10+ years of experience in assignment writing and they are providing best assignment help services in Lower-Hutt and Upper-Hutt and many more cities located in New Zealand.

    ReplyDelete
  20. Hp provides a number of models that offer various features to serve customers' purposes. One of such model is HP Envy 7640 Printer. If you are using this envy printer model and looking for a source to do its setup in an error-free manner, you can do it via 123.hp.com/setup 7640. At this place, you will find authoritative guidelines to do the setup and all the relevant files to download the driver of the HP printer. For technical assistance dial our toll-free number.

    ReplyDelete
  21. Are you looking for best assignment help service provider in UAE? UAE Assignment Help is the best option for all the assignment help services. We are giving all the assignment help services under one roof. Our writers are highly professional and they are working from past 10 years in assignment writing. We have secured payment option for all the assignment help so your money is safe with us. We are providing our services in Dubai and Rak-city with 100% plagiarism free content and on-time delivery guarantee.

    ReplyDelete
  22. NZ Assignment Help is the most favorite assignment help service provider in New Zealand. We are giving quick and reliable assignment help services for all local as well as international students studied in Hamilton and Wellington. Our writers are working from past 10+ years and they are giving 100% unique content for your assignment. We have a large team of 250+ assignment writers and they have secured payment option for all the assignment help.

    ReplyDelete
  23. UAE Assignment Help provides best Research Paper Assignment Help for all the students pursuing ph.D. in Dubai and Sharjah. We are giving quick and reliable assignment help services with 100% accuracy. We are writing your content 100% written from scratch. Our team are woriking from past 10+ years in assignment writing and they are giving 100% plagiarism free content for all the assignment help.

    ReplyDelete
  24. Nice blog, it's truly a complete package of lots of information, although I have read hundreds of blogs on this topic, the way you present all the stuff here is truly commendable. In the end, I just want to say textsmashzone is the best place if you want bulk voice call services in Delhi. They are cheap, reliable and trustworthy bulk SMS service in Delhi as well as best Cheapest Transactional SMS Service Provider in Delhi.

    ReplyDelete
  25. This the best site for the Latest apks to download or to known the information about any apk.
    Ac market
    Ac market Apk
    FMWhatsApp
    teatv
    teatv Apk
    morpheus tv
    morpheus tv Apk

    ReplyDelete
  26. This would cost you a lot less than what you would be paying for an individual religion assignment help. So, you can ask your friends and team up to place the orders, if you are not having a bulk order of your own. Well, there is no doubt that Mechatronics is a demanding subject and you are assigned with a heap of assignments that are pretty time-consuming. So, by opting for mechatronics assignment help. apart from these permanent offers, there are few waivers that you get during a particular timeline. They are usually active during the final days of the semester for Robotics assignment help

    ReplyDelete