WORM_AUTORUN.SM6

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It adds key(s)/entry(ies) to allow itself to run on safe mode. This action adds difficulty in the removal of this malware from the affected computer.

It drops copies of itself in all removable drives.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

Installation

This worm drops the following files:

• %User Temp%\srv{random characters}.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Temp%\srv{random characters}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ImagePath = "%System Root%\system32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
DisplayName = "srv{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}\parameters
servicedll = "\?\globalroot\Device\HarddiskVolume1\%User Temp%\srv{numbers}.tmp"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}\Security
Security = "{hex values}"

It adds the following key(s)/entry(ies) to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
srv{random characters}

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random characters}

Other System Modifications

This worm modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{Default Data} srv{random characters}"

(Note: The default value data of the said registry entry is {Default Data}.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\3
CurrentLevel = "0"

(Note: The default value data of the said registry entry is 11000.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\3
1601 = "0"

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself in all removable drives.

The said .INF file contains the following strings:

;{garbage characters}
[AutoRun]
AcTIOn=opeN
;{garbage characters}
IcON=%Windows%\SYstEm32\ShelL32.DLl,4
;{garbage characters}
UsEaUtoPlAy=1
;{garbage characters}
oPEN=RUNDLl32.EXe sETup{numbers}.foN,{parameters}
;{garbage characters}
SHElL\eXPLore\ComManD=ruNDLL32.EXe setup{numbers}.fON,{parameters}
;{garbage characters}
SHelL\Open\cOmmaNd=rundLL32.EXE sETUP{numbers}.fON,{parameters}
;{garbage characters}

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}9.{BLOCKED}5.49.103/sknock.php?affid={parameter}&data=version={parameter}|{infection information}
• http://{BLOCKED}5.{BLOCKED}4.112.138/service/listener.php?affid={Parameter}
• http://{BLOCKED}9.{BLOCKED}5.49.103/srv
• http://{BLOCKED}9.{BLOCKED}5.49.103/dll
• http://{BLOCKED}9.{BLOCKED}5.49.103/exe
• http://{BLOCKED}5.{BLOCKED}4.112.136/dll
• http://{BLOCKED}5.{BLOCKED}4.112.136/srv
• http://{BLOCKED}5.{BLOCKED}14.112.136/exe
• http://{BLOCKED}5.{BLOCKED}4.112.138/X
• http://{BLOCKED}5.{BLOCKED}4.112.139/service/scripts/files/aff_{parameter}.dll