SpawnDropper0 (VPS)
Delbot-AI (PMA sig AV)
Backdoor.Vanbot.AN (deskttop sig AV)

Malcode Installation

Upon execution, the malware will drop a copy of itself to the %System% directory as mdnex.exe.

(Where %System% refers to the Windows system folder. On Windows XP and 2003, the Windows system folder is usually C:\Windows\System32, on Windows 2000 it is usually C:\WINNT\System32)

The malcode will then create the following registry entry so that its dropped copy will be executed upon system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 
Microsoft DNSx = “%System%\mdnex.exe"

It will then attempt to download the file radi.exe from www.tgiweb.com (not available as of this time) to the C:\ directory and run it.

To ensure that only one instance of the malcode is running at any given time, it will try to create a mutex named “MSDNSx0” and terminates if it already exists.

Propagation

This worm propagates by exploiting the recent Microsoft DNS Server Service vulnerability (CVE-2007-1748), an older Microsoft vulnerability affecting the Microsoft Windows Server Service (CVE-2006-3439/MS06-040), and an older Symantec vulnerability (CVE-2006-2630).

Upon successful exploitation, a copy of the worm will be downloaded to the target system as C:\U.exe.

Bot Capability

This worm will attempt to connect to any of these IRC servers on TCP port 8080 and join channel ##DNS:

x.rofflewaffles.us
symantec.has.sand.in.its.vagina
is.wayne.brady.gonna.have.to.chokeabitch.us
x.anti-viral.us

Once the connection is established, the affected system will be able to receive commands from a remote attacker. 

• Affected system being controlled by a remote attacker via IRC
• High bandwidth utilization due to network worm behavior  

1. Terminate the following malcode process:
   
   mdnex.exe
   
   Note: Since the malcode also attempts to terminate the task manager, the task manager program (%System%\taskmgr.exe) can be copied to a different filename and then executed. Also, several process management tools are available from the Internet: An example is Process Explorer from Sysinternals: http://www.sysinternals.com/Utilities/ProcessExplorer.html
   
2. Delete the following malcode file:
   
   %System%\mdnex.exe
   
   (Where %System% refers to the Windows system folder. On Windows XP and 2003, the Windows system folder is usually C:\Windows\System32, on Windows 2000 it is usually C:\WINNT\System32)