Detección heurística: Este gusano es detectado como Exploit-DcomRpc.gen con VirusScan de McAfee desde DAT 4288, con la opción de ficheros comprimidos activada.

A partir de DAT 4360 se detecta como W32/Cycle.worm.a

El gusano hace una copia de sí mismo en la carpeta de sistema con el nombre de SVCHOST.EXE de 10.280 bytes (gusano comprimido con UPX)

%SysDir%\SVCHOST.EXE

E instala un servicio ("Host Service") en la máquina víctima:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Host Service

HKEY_CURRENT_USER\System\CurrentControlSet\Services\Host Service

El gusano crea un shell remoto en la maquina destino, escuchando a través de un puerto variable, y conecta con dicha máquina para descargar el gusano de otro PC infectado utilizando el TFTP.EXE, a través del puerto UDP69 y crea el fichero gusano llamado CYCLONE.EXE

El gusano también abre el puerto TCP 3332 con lo que identifica las máquinas ya infectadas. Además, finaliza procesos víricos del NetSky, del Lovsan o Blaster y del Sasser al detener : SKYNETAVE.EXE, MSBLAST.EXE, AVSERVE.EXE y AVSERVE2.EXE

A partir del 19 de Mayo tiene programado efectuar ataques de DdoS (Denegación de servicios) a dos webs, una de noticias en Inglaterra y otra en Irán:

• www.bbc.com (British Broadcasting Company)
• www.irna.com (Islamic Republic News Agency)

El fichero CYCLONE.TXT que se genera en el directorio donde se encuentra instalado Windows, es de 3316 bytes, y contiene un texto político sobre los derechos humanos en Irán:

Hi

My name is Cyclone and I live in Iran,
and I want to speak with you about problems that we have in iran:

A.In Iran we don't have any kind of freedom, because we have islamic republic in iran:
1.we can't speak freely about regime, we can't speak even a little bit against them!!!
2.I have to be a moslem otherwise they don't care about me!
3.we CAN'T even wear the clothes and styles that we wants!
4.women MUST wear a cloth that no one can even see their hair!!!
5.they do not allow our national celebrations to be held, they beat us!!
6.Many more...
B.The human rights is not implemented in Iran and there is no justice,

1.Lynch is very common in Iran. If you are against the regime then you may silently killed, or if there is a tribunal, you can't say anything, everyone works against you there.
2.1985-1990, the Islamic Republic of IRAN has been killed more than 10,000 Iranian youngs. that has been comfirmed by the documentations! This people killed without any tribunal or any proof.
3.there is a punishment that is used so much during this years, in this punishment, the person who must be killed stand in a hole then others attack him with stones, this will continue until he/she dead. there is some pictures and videos that shows this terrible torture!
4.Many more...

C.Misery and poverty grows in Iran, because the islamic republic leaders steal the money, they stolen the money that provided by selling oil, and then the people must die because they don't have enough money to even buy a bread!!!
D.Misery and poverty cause vice to grow, you see many young people in Iran using drugs and I think this is also a trick by the government to not allow us to arise against them!
E.Islamic republic gave Iran a bad name. before islamic republic we can travel anywhere in the world without any problem but now we have so much problems if we want to travel a foreign country, anyone think that we are terrorist. THE PEOPLE OF IRAN ARE NOT TERRORIST, THE ISLAMIC REPUBLIC OF IRAN IS TERRORIST.

The people of Iran trying to arise, but failed to do. About one year ago, Iranian people try to say to the world that we don't need Islamic republic but the government and police beat the people who try to tell the truth and they killed some people.
You see that they don't even care about their own people, think what happen if they gain access to an ATOMIC BOMB!!! it's very dangerous for the world.

With all of this conditions and injustices, european governments still support islamic republic, they say that they just care about their own country!
and I want to show them our WRATH!
All of the european people are my friends and I never want to harm them, just government and the Politicians!

If you protest against iraq war and say why there must be a war against iraq, and if you do this for humanity, please do anything that you can do for helping iranian people.
at least make your country not to support islamic republic anymore, I'm deadly sure that if european countries do not support islamic republic. it will be destroyed after 3-6 months! so please help!

I don't want to damage, I just want my country to grow, to improve!!! I have no other way to tell this words to world, sorry!!

 

Una causa-efecto del desbordamiento de bufer del LSASS puede provocar el apagado del sistema mediante cuenta atrás de 60 segundos. Este tiempo puede ser detenido en XP mediante la ejecución (Inicio-ejecutar...) de SHUTDOWN -a y en W2000, que no tiene dicho comando, puede detenerse una vez iniciado atrasando una hora el reloj de la barra de inicio, para permitir acceder a Internet y actualizar los parches de Microsoft.

Para su eliminación se recomienda ejecutar nuestra utilidad ELILSA, así como aplicar los parches de Microsoft arriba indicados.

 Instrucciones para eliminar ataques remotos del gusano, provocando reinicios al arrancar

Si al iniciar el sistema ya aparece la cuenta atrás antes, sin que pueda ejecutar nada, apague el ordenador, desconecte el cable de red, arranque y ejecute nuestra utilidad ELILSA.EXE, la cual si ya hubiera el virus lo eliminaría, pero además bloquea el intento de intrusión por el puerto TCP445, tras lo cual, en la misma sesión, puede conectar el cable de red, entrar en Internet y descargar los parches de Microsoft necesarios.

Una vez instalados los parches, reinicie el sistema, lo cual restablecerá el acceso al port TCP445. Si prefiere restablecer el sistema sin reiniciar, puede ejecutar ELILSA EXE /Start bien desde Inicio-Ejecutar o desde un Shell al Dos.