Description: 

This malicious, polymorphic Visual Basic (VB) script arrives in encrypted form. It runs whenever a user loads infected HTML files. It then decrypts itself and executes its virus code.

It creates copies of itself as the following files:

• %System%\Blank.htm
• %System%\Folder.htt
• (malware path)\Folder.htt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)

This malicious VB script searches all available disk drives and subfolders for target files to infect. These files have the following extensions:

• ASP
• HTM
• HTML
• HTT
• JSP
• PHP

Infected files are appended with the encrypted version of the malicious VB script.

When this VB script is executed on the 30th day of February, April, June, August, October, and December, it renames the system files WIN.INI to WON.CHK, and SYSTEM.INI to SYSTEM.CHK.

It runs on infected systems unpatched for the VM ActiveX component vulnerability. Installing patches or the latest version of Microsoft Internet Explorer makes it unable to execute or propagate.

For more information about this Windows vulnerability, please refer to the following Microsoft Web page:

Microsoft Security Bulletin MS00-075

Details:

Arrival and Installation

This malicious, polymorphic Visual Basic (VB) script arrives in encrypted form. It runs whenever a user loads infected HTML files. It then decrypts itself and executes its virus code. Afterwards, it checks the source of its host, whether it is HTML or VBS, to initialize its variables properly.

It creates copies of itself as the following files:

• %System%\Blank.htm
• %System%\Folder.htt
• <malware path>\Folder.htt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)

Folder View Settings

This malicious VB script also drops a copy of itself as FOLDER.HTT in the folder %Windows%\Web. It then creates the file named DESKTOP.INI in the folder where it executes. The latter file sets the current folder view settings to FOLDER.HTT.

(Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WINNT.)

If Web content is enabled, the files FOLDER.HTT and DESKTOP.INI are copied to every folder opened in Windows Explorer. In effect, the Explorer window displays the infected FOLDER.HTT, thus running the malicious VB script.

File Infection

When infecting, this malicious VB script searches all available disk drives and subfolders for files with the following extensions:

• ASP
• HTM
• HTML
• HTT
• JSP
• PHP

Infected files are appended with the encrypted version of the malicious VB script.

Payload

When this VB script is executed on the 30th day of February, April, June, August, October, and December, it renames the system files WIN.INI to WON.CHK, and SYSTEM.INI to SYSTEM.CHK.

Exploit

The malicious VB script runs on infected systems unpatched for the VM ActiveX component vulnerability. Installing patches or the latest version of Microsoft Internet Explorer makes the malware unable to execute or propagate.

For more information about this Windows vulnerability, please refer to the following Microsoft Web page:

Microsoft Security Bulletin MS00-075

Analysis By: Steve Inosanto Espino

Revision History:

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Disabling Web Content

1. In My Computer or in Windows Explorer, click on Tools menu and choose Folder Options.
2. Click on General tab.
3. Under Active Desktop, click Use Windows classic desktop.
4. Under Web View, click Use Windows classic folders.
5. Click Apply.
6. Click on View tab.
7. Under Advanced settings, uncheck Remember each folders view settings.
8. Click Apply.
9. Click OK.

Additional Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure sets.

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as VBS_REDLOF.F. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other users can use HouseCall, Trend Micros free online virus scanner.

Applying the Patch

Download the latest patch. Information on the vulnerability exploited by this malware and the corresponding patch can be found at the following link:

Microsoft Security Bulletin MS00-075

Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.