WORM_UTOTI.DW

This worm arrives by connecting affected removable drives to a system.

It bears the file icons of certain applications to avoid easy detection and consequent removal. It uses common file icons to trick a user into thinking that the files are legitimate.

It modifies registry entries to hide files with System and Read-only attributes.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

Installation

This worm drops the following copies of itself into the affected system:

• %system%\csrcs.exe

It bears the file icons of the following applications:

• Yahoo Messenger

It uses common file icons to trick a user into thinking that the files are legitimate.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
csrcs = %system%\csrcs.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
csrcs = %system%\csrcs.exe

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe csrcs.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This worm modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CurrenVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CurrenVersion\Explorer\
Advanced
SuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CurrenVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• wvmsba.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{random characters}
[autOruN]
OPeN=wvmsbA.EXe
aCTiOn=View files
;{random characters}
ACtiON= @wvmsba.exe
sHEll\open\commAND=wVmsba.exE
IcON=%SYSTem%\shelL32.dll,7
;{random characters}
useautOpLAY=1
;{random characters}
SHelL\OPeN\dEfAulT=1