WORM_AUTORUN.AOA

This worm arrives by connecting affected removable drives to a system. It may be unknowingly downloaded by a user while visiting malicious websites.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

This file contains a URL where it connects to possibly download other files.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\ydze.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• EXPLORER.EXE

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = %Application Data%\ydze.exe

Propagation

This worm creates the following folders in all removable drives:

• Sex.and.the.City.2

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies the contents of an existing AUTORUN.INF file to automatically execute its dropped copy. It does this by adding the following strings in the .INF file:

• {garbage}
  [AUtorUN
  {garbage}
  OPEN=Sex.and.the.City.2//////Sex.and.the.City.2.R5.Xvid-TPB.exe
  {garbage}
  USEAuTopLAY=1
  {garbage}
  SHELL\\EXplore\COMMAND=Sex.and.the.City.2////\Sex.and.the.City.2.R5.Xvid-TPB.exe
  {garbage}
  SHELL\\OPEN\COMMAND=Sex.and.the.City.2////\Sex.and.the.City.2.R5.Xvid-TPB.exe
  {garbage}

Other Details

This file contains a URL where it connects to possibly download other files. As of this writing, this file contains the following URLs:

• www.{BLOCKED}bam.info