WORM_PALEVO.LJ
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Copies itself in all available physical drives, Propagates via removable drives
This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It creates folders in all physical and removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.
TECHNICAL DETAILS
81,920 bytes
EXE
Yes
02 Nov 2011
Compromises system security, Connects to URLs/IPs
Arrival Details
This worm arrives by connecting affected removable drives to a system.
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This worm drops the following copies of itself into the affected system:
- %User Profile%\aegvvp.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- 1jl8+10
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profile%\aegvvp.exe"
Propagation
This worm creates the following folders in all physical and removable drives:
- keyboard
It drops the following copy(ies) of itself in all removable drives:
- {Drive}:\keyboard\flash.exe
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
The said .INF file contains the following strings:
[autorun]
USEAUTOPLAY=1
shellexcute=keyboard/flash.exe
Shellfiber
shell\Explore\command=keyboard/flash.exe
shell\Open\command=keyboard/flash.exe
icon=keyboard/flash.exe
open=keyboard/flash.exe
action=0pen folder to view files using Windows Explorer
Backdoor Routine
This worm executes the following commands from a remote malicious user:
- Open a browser and connect to advertisement sites
- Download and execute file(s) from remote site(s)
- Drop a copy of the malware to specific drive(s)
- Drop a copy of the malware to USB drive(s)
It connects to the following websites to send and receive information:
- {BLOCKED}e.safehousenumber.com
- {BLOCKED}k.portal-protection.net.ru
- world.{BLOCKED}udio.ru
- banana.{BLOCKED}nds.su
- portal.{BLOCKED}owerbord.com
NOTES:
It opens an instance of svchost.exe where it injects itself to stay memory resident.
SOLUTION
9.200
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Identify and delete files detected as WORM_PALEVO.LJ using either the Startup Disk or Recovery Console
Step 3
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Taskman = "%User Profile%\aegvvp.exe"
- Taskman = "%User Profile%\aegvvp.exe"
Step 4
Search and delete this folder
Step 5
Search and delete AUTORUN.INF files created by WORM_PALEVO.LJ that contain these strings
Step 6
Scan your computer with your Trend Micro product to delete files detected as WORM_PALEVO.LJ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
NOTES:
RECOMMENDATION:
This malware is detected and removed by the latest Trend Micro anti-malware engine and pattern. Always keep pattern files and engines up-to-date. To know more about updating your Trend Micro product’s pattern, please refer to the following Trend Micro support page:
Note: The steps apply for specific products indicated in the page.
To actively detect and protect your machine, enable real-time scanning of your Trend Micro anti-malware product. Refer to the following Trend Micro support page to know more about enabling real-time scanning in your Trend Micro product:
- Home Users: http://esupport.trendmicro.com/solution/en-us/1054798.aspx
- Business Users: http://esupport.trendmicro.com/Pages/How-do-I-enable-or-disable-the-Real-time-Protection-of-Trend-M-EN-1038331.aspx
Other recommendations to prevent infection:
- Enable firewall to protect against threats. Steps to enable firewall in your Trend Micro product: http://esupport.trendmicro.com/3/How-do-I-enable-or-disable-the-Personal-Firewall-of-Trend-Micr-EN-1038273.aspx.
- Be aware of social engineering attacks.
- Avoid accessing the listed malicious URLs to prevent possible re-infection.
- Monitor network connections for any suspicious connection or connectivity.
- Regularly update list of sites that are trusted.
- Avoid downloading software cracks and/or pirated applications.
- Avoid visiting un-trusted sites that may redirect or download malware into the system.
- Disable AutoPlay to avoid automatic execution of executable files in removable/network drives.
- Disconnect drives when not needed. If write access is not required, enable read-only mode only.
Did this description help? Tell us how we did.