DokFLeed.Net --Security Portal

Name: W32.Hobble.C@mm
Aliases: W32/Hobbit.b@MM,W32/Hobbit.c@MM,W32/Hobbit.979c-mm, WORM_HOBBIT.B,I-Worm.Alcaul.ab,I-Worm.generic,Win.32.Hobbit.G
Variants:
Type: E-mail worm
Platforms: Windows 32-bit
Status: not known to be in the wild
Threat: V-CON 2 (low)

Due to increased media attention we are issuing this On-Line Alert.
The following has been derived from information provided by Symantec and Network Associates.
Virus Characteristics
W32.Hobble.C@mm is a worm that attempts to spread across the KaZaA file-sharing network. It has mass-mailing capabilities. It can send itself to email addresses that it retrieves from .htm and .html files that it finds in the Internet cache, and to all addresses in the Microsoft Outlook Address Book. The email messages have the following characteristics:
Message 1
This is sent to all addresses in the Microsoft Outlook Address Book.
Subject: Fwd: Scan your computer for this new virus threat...
Message Body: This is a fix and removal for the new internet worm known as BugBear.1 in ever 4 computers in infected with this virus. When run, it will scan your computer and notify you if you're infected or not, then clean if infected
Attachment: Anti-Bug.exe

Message 2
The second mass-mailing portion of the worm scans all .htm and .html files in the Internet Explorer cache and retrieves email addresses from mailto: links. The retrieved addresses are stored in a file named Email.txt, which the worm drops into the same folder. It then retrieves the user name, email address, and SMTP server and sends itself to the retrieved contacts in the following format:
Subject: AntiVirus Updates:
Message Body: A Removal to scan for the new BugBear Virus. Recommended by
Attachment 1: One of many with the .scr, .exe, .bat, or .pif file extension. Attachment 2: One of many with the .theme, .zip, or .bat file extension.

When the attachment is run, the worm copies itself to the %WinDir% directory as Shizzle.exe and Anti-Bug.exe. A registry run key is created to load the worm at startup:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion Run "WinSrv"=C:WINDOWSShizzle.exe
It also adds the value WinSrv %windir%Shizzle.exe to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
To replicate across the KaZaA file-sharing network, the worm copies itself as these file names:

WIN XPCrack.exe
All GamesHack.exe
ICQ Password Hack.exe
HotMailHack.exe
Unreal Tournament 3 FullDownloader.exe
WarCraft III Full.exe
Swat 3 Full Download.exe
Macromedia Flash MX.exe
Tacony.exe
HotMailHack.exe
Credit Cards.exe

into these folders (if they exist):

C:KaZaAMy Shared Folder
C:Program FilesKaZaAMy Shared Folder

The worm then displays following message: System Not Infected With Bugbear
The virus contains a payload to use PING to initiate a Denial of Service attack against www.dokfleed.net
Payload
Large scale e-mailing: Sends itself to all contacts in the Outlook Address Book, and to addresses it finds in .htm and .html files.
Initiates a Denial of Service attack against www.dokfleed.net

Preventative Measures
Block the following attachments at the Internet Gateway where possible:

Attachment: Anti-Bug.exe
Block the following file extentions at the Internet Gateway where possible:
.scr, .exe, .bat, or .pif, .theme, .zip, or .bat
Clean out the Internet Explorer cache.

Fixes Available
Network Associates: Minimum DAT: 4228 Release Date: 10/09/2002 Minimum Engine: 4.1.60
Symantec: Virus Definitions (Intelligent Updater) October 10, 2002 Virus Definitions (LiveUpdate) October 16, 2002
Trend: No information available at time of alert.