FedCIRC Alert - ' Leave' Worm - Targets PCs For Use In Possible DDoS Attacks

A new virus that seeks out computers infected with a popular "backdoor" Trojan horse program could be used to download and store other malicious files, including those typically employed in distributed denial-of-service attacks, federal security experts warned Saturday.

The security alert - issued by FedCIRC, the FBI?s National Infrastructure Protection Center (NIPC), and several private anti-virus companies - concerns a virus called "W32-Leave.worm," which scours the Internet for systems infected with the notorious "SubSeven" Trojan..

SubSeven is a highly invasive remote administration program that includes a client and
sever application. Once installed on a victim's network, the server listens for
connections on a pre-set or user-determined TCP port. An attacker using a SubSeven client
to connect to a backdoor port can view a victim?s files, capture their keystrokes,
view their virtual desktop, open and close programs, and even shut down the infected
machine remotely.

The virus attacks networks running Windows 9x, 2000 and Windows ME, but affects each
version of the operating system differently. In Windows ME, for example, the worm will
launch itself whenever an infected computer runs any of a long list of programs, including
Microsoft Outlook, Wordpad, and Napster.

The virus appears to download components from Web sites using an encrypted URL list,
and contains code to accept commands from IRC (Internet Relay Chat). Once running, the
virus scans the Web for computers infected with SubSeven and automatically installs itself
on any infected machines.

According to a virus alert issued by Symantec, the worm only affects computers already
running the SubSeven virus, and does not appear to be spread via e-mail.

While Symantec has not yet received reports of the virus spreading to computers not
infected with the SubSeven virus, the worm appears aimed at those networks that do not run
anti-virus software, as nearly all virus protection software will detect SubSeven and its
many variations.

Aside from its utility as a highly sneaky eavesdropping tool, SubSeven is most often
used to launch so-called distributed denial-of-service attacks. In such attacks, several
? often dozens or hundreds ? of computers are used to flood a targeted Web site
with bogus requests for information. The result normally cripples or even crashes a site?s
servers.

"The FBI is very aware of anything out there that remotely smells like a
denial-of-service attack is brewing," said one Symantec engineer.

The NIPC alert is at http://www.nipc.gov/warnings/advisories/2001/01-014.htm
.

Symantec?s alert is at http://www.sarc.com/avcenter/venc/data/w32.leave.worm.html
.

Reported by Newsbytes, http://www.newsbytes.com
.