WORM_SPYBOT.SMP

This worm drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It deletes itself after execution.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\system\svhost.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WSVCHO = %Windows%\system\svhost.exe

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
SVCWINSPOOL
=

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
SVCWINSPOOL
=

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\system\svhost.exe = %Windows%\system\svhost.exe:*:Enabled:svhost

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• wlan.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
shellexecute=wlan.exe
action=Open folder to view files
shell\default=Open
shell\default\command=wlan.exe
shell=default

Dropping Routine

This worm drops the following files:

• %System%\drivers\sysdrv32.sys - detected as HKTL_TCPAGENT

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This worm deletes itself after execution.