WORM_DROPPER.AKO

If a process named AVP.EXE exists, this malware drops a system driver component as %User Temp%\atapi.sys. The said system file is used by the malware to avoid detection and be able to load into memory. This is detected by Trend Micro as TROJ_AGENT.AGIO.

If a process named SHSTAT.EXE exists, it copies itself as %System Root%\McScript_InUse.exe, terminates itself, and deletes the initially executed copy.

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It injects its dropped file/component to specific processes.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\Downloaded Program Files\USBKey.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following file(s)/component(s):

• {drive letter}:\RECYCLER\Desktop.ini - used to trick the users that the created folder is a legitimate Recycle Bin directory
• %User Temp%\j7hgf.bat - batch file used to delete the initiailly executed copy of the malware. This will also be deleted once the execution is done.
• %System%\MsnShell32.dll - also detected as WORM_DROPPER.AKO

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops and executes the following files:

• %User Temp%\ushi32.exe - TROJ_DLOADR.AKT

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It injects its dropped file/component to the following processes:

• Explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524250}
(default) = "MsnShell32"

HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524250}\
InprocServer32
(default) = "%System%\MsnShell32.dll"

HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524250}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\ShellServiceObjectDelayLoad
MsnShell32 = "{35CEC8A3-2BE6-11D2-8773-92E220524250}"

Other System Modifications

This worm adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524250}

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\RECYCLER

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\RECYCLER\MsnHelp.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
shell\open=¦=+¬(&O)
shell\open\Command=RECYCLER\MsnHelp.exe
shell\open\Default=1
shell\explore=+-+¦¦_+f¦˜(&X)
shell\explore\command=RECYCLER\MsnHelp.exe
opEn=

Process Termination

This worm terminates the following services if found on the affected system:

• pccguide.exe

NOTES:

If a process named AVP.EXE exists, it drops a system driver component as %User Temp%\atapi.sys. The said system file is used by the malware to avoid detection and be able to load into memory. This is detected by Trend Micro as TROJ_AGENT.AGIO.

If a process named SHSTAT.EXE exists, it copies itself as %System Root%\McScript_InUse.exe, terminates itself, and deletes the initially executed copy.