WORM_OTORUN.HKZ

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Program Files%\Common Files\Microsoft Shared\explorer.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following files:

• %Favorites%\&çÍ·×ÍøÖ·µ¼º½&.url
• %Program Files%\Common Files\uiui8.dll
• %System Root%\Documents and Settings\All Users\Desktop\¸Ä±äÄãµÄÒ»Éú.url
• %System Root%\Documents and Settings\All Users\Desktop\Ãâ·ÑµçÓ°C.url
• %System Root%\Documents and Settings\All Users\Desktop\Intennet Exploner.lnk
• %System Root%\Documents and Settings\All Users\Desktop\ÌÔ±¦¹ºÎïA.url

(Note: %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\MFILES\winlogon.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\MFILES

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %System Root%\Documents and Settings\All Users\Start Menu\Programs\Startup\1681.lnk

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other System Modifications

This worm deletes the following files:

• %System%\drivers\etc\hosts

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
HideDesktopIcons

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{Application Name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\StorageDevicePolicies

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
HideDesktopIcons\ClassicStartMenu
{871C5380-42A0-1069-A2EA-08002B30309D} = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
HideDesktopIcons\NewStartPanel
{871C5380-42A0-1069-A2EA-08002B30309D} = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
ModRiskFileTypes = ".exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile
NeverShowExt = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{Application Name}
Debugger = "ntsd -d"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\StorageDevicePolicies
WriteProtect = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.

NOTES:
It deletes the following registry keys to disable Safe Mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}

It deletes all existing registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options before adding the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{Application Name} where {Application Name} is one of the following:

• 360Safe.exe
• 360rp.exe
• 360rpt.exe
• 360safebox.exe
• 360sd.exe
• 360tray.exe
• 799d.exe
• AST.exe
• AgentSvr.exe
• AntiU.exe
• AoYun.exe
• AppSvc32.exe
• ArSwp.exe
• ArSwp2.exe
• ArSwp3.exe
• AutoRun.exe
• AvMonitor.exe
• AvU3Launcher.exe
• AvastU3.exe
• CCenter.exe
• DSMain.exe
• Discovery.exe
• EGHOST.exe
• FTCleanerShell.exe
• FYFireWall.exe
• FileDsty.exe
• HijackThis.exe
• IceSword.exe
• Iparmor.exe
• KASMain.exe
• KASTask.exe
• KAV32.exe
• KAVDX.exe
• KAVPF.exe
• KAVPFW.exe
• KAVSetup.exe
• KISLnchr.exe
• KMFilter.exe
• KMailMon.exe
• KPFW32.exe
• KPFW32X.exe
• KPfwSvc.exe
• KRegEx.exe
• KRepair.com
• KVCenter.kxp
• KVMonXP.kxp
• KVMonXP_1.kxp
• KVScan.kxp
• KVSrvXP.exe
• KVStub.kxp
• KWatch.exe
• KWatch9x.exe
• KWatchX.exe
• KaScrScn.SCR
• KsLoader.exe
• KvDetect.exe
• KvReport.kxp
• KvXP.kxp
• KvXP_1.kxp
• KvfwMcl.exe
• MagicSet.exe
• NAVSetup.exe
• NPFMntor.exe
• Navapsvc.exe
• Navapw32.exe
• PFW.exe
• PFWLiveUpdate.exe
• QHSET.exe
• QQDoctor.exe
• QQDoctorMain.exe
• QQDoctorRtp.exe
• QQKav.exe
• QQSC.exe
• Ras.exe
• Rav.exe
• RavMon.exe
• RavMonD.exe
• RavStub.exe
• RavTask.exe
• RegClean.exe
• RsAgent.exe
• RsTray.exe
• Rsaupd.exe
• SDGames.exe
• SREng.EXE
• SREngPS.EXE
• ScanFrm.exe
• ScanU3.exe
• SelfUpdate.exe
• SmartUp.exe
• SysSafe.exe
• TNT.Exe
• TrojDie.kxp
• TrojanDetector.exe
• Trojanwall.exe
• TxoMoU.Exe
• UFO.exe
• UIHost.exe
• USBCleaner.exe
• UmxAgent.exe
• UmxAttachment.exe
• UmxCfg.exe
• UmxFwHlp.exe
• UmxPol.exe
• UpLive.exe
• WoptiClean.exe
• Wsyscheck.exe
• XDelBox.exe
• XP.exe
• adam.exe
• appdllman.exe
• auto.exe
• autoruns.exe
• av.exe
• avconsol.exe
• avgrssvc.exe
• avp.com
• avp.exe
• ccSvcHst.exe
• cross.exe
• filmst.exe
• ghost.exe
• guangd.exe
• iparmo.exe
• irsetup.exe
• isPwdSvc.exe
• jisu.exe
• kabaload.exe
• kavstart.exe
• kernelwind32.exe
• kissvc.exe
• kvol.exe
• kvolself.exe
• kvupload.exe
• kvwsc.exe
• loaddll.exe
• logogo.exe
• mcconsol.exe
• mmqczj.exe
• mmsk.exe
• niu.exe
• nod32.exe
• nod32krn.exe
• nod32kui.exe
• pagefile.exe
• pagefile.pif
• pfserver.exe
• qheart.exe
• qsetup.exe
• ravcopy.exe
• rfwProxy.exe
• rfwcfg.exe
• rfwmain.exe
• rfwsrv.exe
• rsnetsvr.exe
• rstrui.exe
• runiep.exe
• safeboxTray.exe
• safelive.exe
• scan32.exe
• servet.exe
• shcfg32.exe
• sos.exe
• stormii.exe
• sxgame.exe
• symlcsvc.exe
• tmp.exe
• upiea.exe
• vsstat.exe
• wbapp.exe
• webscanx.exe
• zhudongfangyu.exe
• zjb.exe
• zxsweep.exe
• ~.exe
• ~.exe