NWA-PCUG Newsletter Article
Synchronicity Strikes with a Worm
A Review by John Clark, WebMaster, December 2001
rcmahq@nwark.com
(click to email author)


{Synchronicity....the word was invented by Jung, and popularized by Arthur Koester and Means something like a coincidence that's too weird to be a coincidence, or that is a meaningful coincidence. ---Roger Downham}

The NWA-PCUG meeting on Saturday Nov 17 dealt with viri, and just about the same time that Dale Oliver was discussing the SirCan virus, I received two e-mail letters that contained two versions of this virus. A coincidence or synchronicity?

When I first saw them, I did not know what type they were, but following my standard rules pertaining to e-mail:

    Clark's rule #1 -- if I don't know you, your mail goes to my crap file.
    Clark's rule #2 -- If I do know you but don't trust computational skills, same thing happens if you have an attachment.

I then use a word processor to look at your e-mail. A simple one like Notepad -- definitely not one that will automagically open your attachments.

Looking at these two messages I could see that:

  • Both came from the same person -- Earlyne Thomas {efat@caribsurf.com}

  • Both had the same message:
  • Hi! How are you=3F
  • I send you this file in order to have your advice
  • See you later=2E Thanks

The =3F and =2E are hex codes for a '?' and a ','.

Both were set up for Outlook Express, but they had two different dangerous files to be executed:

attachment; filename="~$aucom,a drugs.doc.pif"
attachment; filename="~$AT CHG ADR.doc.bat"

These files will display to you as a .doc file, but the 2nd extend makes them executable files. In other words, a program that will run on your computer and install a worm. If you are interested, the following two URLs will provide you with information about this worm and what it can do:

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html
http://www.cai.com/virusinfo/encyclopedia/descriptions/s/sircam137216.htm

Actually the proper name of the worm seems to be "Magistr". I do not have the inborn fear of a worm as do some folks, for back about 1963-65 the first thing I would teach a computer class is how to write a worm. Those were the days before operating systems or disk drives, and you had to clear the core memory to make sure nothing was left over from the previous program.

Since the worm is in machine code it came to my computer in MIME format. Using the techniques described in:

http://pcgroup.nwark.com/bit---03.htm

I de-mimed them and took a look at the actual code. While I am not up to speed in reading machine code, it was quite evident that the following holds:

    It was a big file 137,268 bytes, probably with a lot of redundancy
    It will only run under a Win 32 system.

    It contained the names of a large number of chip codes, disk

    I/O codes, network error codes, different character sets -- foreign nations, and a great list of window interupts -- same as the old DOS interupts only now they use command names..

I have been looking for a complete list of these window interrupt names for several months.

Now if I could just find out where the actual author of the worm is located, I could give him/her a bit of advice.

Click here to return to top



==================================================================