WORM_SILLY.FK

This worm arrives by connecting affected removable drives to a system. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It bypasses the Windows firewall. This allows the malware to perform its intended routine without being detected by an installed firewall.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\{random name}.exe
• %System%\{random name}.exe
• %System%\{random name}.exe
• %Windows%\system\{random name}.exe
• %Windows%\inf\{random name}.exe
• %Windows%\Config\{random name}.exe
• %Program Files%\Common Files\{random name}.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
RSetting = %Windows%\inf\{random name}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
UserTools = %Program Files%\common files\{random name}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
CheckS = %Windows%\config\{random name}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
DeviceSys = %System%\{random name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
tDefault = %System%\{random name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Settings = %Windows%\{random name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
SystemT = %Windows%\system\{random name}.exe

Other System Modifications

This worm modifies the following registry entries to disable the Windows Firewall settings:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself in all removable and physical drives found in the system.

It drops the following copies of itself in all physical and removable drives:

• arquivos.exe
• program.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AUTORUN]
open=program.exe e
Shellexecute=program.exe e
Shell\Auto\Command=program.exe e
Shell=Auto

Other Details

This worm does the following:

• Drops copies of itself and an AUTORUN.INF file in mapped drives.