WORM_UTOTI.AAE
Microsoft: Worm:Win32/Katar.A; Mcafee: W32/Autorun.worm.aaaz; Symantec: W32.Harakit
Windows 2000, XP, Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Propagates via removable drives
It drops several .CAB files in the Windows folder that contains a copy of itself.
It uses file names of popular games and applications as the file names of the said .CAB files. It then searches for folders in a specific directory and drops a copy using the name of folders found. It also searches for registry entries under a certain registry hive and replaces the registry data to enable execution in every system startup.
This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites.
It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.
It modifies registry entries to hide files with System and Read-only attributes.
It drops copies of itself into network drives. It drops copies of itself in all removable drives.
TECHNICAL DETAILS
581,120 bytes
PE
Yes
29 Nov 2010
Arrival Details
This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It may be downloaded by other malware/grayware/spyware from remote sites.
Installation
This worm drops the following copies of itself into the affected system:
- %System Root%\KHATRA.exe
- %Windows%\Xplorer.exe
- %Windows%\KHATARNAKH.exe
- %System%\KHATRA.exe
- %Windows%\system\gHost.exe
- %Application Data%\Microsoft\CD Burning\KHATRA.exe
- %Application Data%\Microsoft\CD Burning\winxp.exe
- %Application Data%\Microsoft\CD Burning\New Folder(3).exe
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It drops the following non-malicious file:
- %Windows%\inf\Autoplay.inF
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
G_Host = %Windows%\System\gHost.exe /Reproduce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Xplorer = ""%Windows%\Xplorer.exe" /Windows"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%System%\KHATRA.exe"
It modifies the following registry entries to ensure it automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%System%\KHATRA.exe"
(Note: The default value data of the said registry entry is "".)
Other System Modifications
This worm adds the following registry entries as part of its installation routine:
HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForSCR = "1"
HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForEXE = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Window Title = "Internet Exploiter"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = 1
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoControlPanel = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableFileTracing = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableConsoleTracing = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
FileTracingMask = dword:ffff0000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
ConsoleTracingMask = ffff0000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
MaxFileSize = 00100000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = 0
It modifies the following registry key(s)/entry(ies) as part of its installation routine:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = ff
(Note: The default value data of the said registry entry is 91.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mnmsrvc
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NtmsSvc
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ProtectedStorage
Start = 4
(Note: The default value data of the said registry entry is 2.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\RDSessMgr
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TermService
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TlntSvr
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\upnphost
Start = 2
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4
(Note: The default value data of the said registry entry is 2.)
It modifies the following registry entries to hide files with System and Read-only attributes:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 0
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0
(Note: The default value data of the said registry entry is 1.)
It creates the following registry entry(ies) to bypass Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\KHATRA.exe = "%System%\KHATRA.exe:*:Enabled:System"
Propagation
This worm drops copies of itself into network drives.
It drops copies of itself in all removable drives.
Other Details
This worm does the following:
- Drops several .CAB files in the Windows folder that contains a copy of itself.
- Uses file names of popular games and applications as the file names of the said .CAB files.
- Searches for folders in the directory %User Profile%\My Documents andand drops a copy using the name of folders found.
- Searches for registry entries under the following registry hive and replaces the registry data with "%System%\KHATRA.exe" to enable execution in every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
SOLUTION
8.900
7.660.02
29 Nov 2010
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Restart in Safe Mode
Step 3
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- G_Host = %Windows%\System\gHost.exe /Reproduce
- G_Host = %Windows%\System\gHost.exe /Reproduce
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Xplorer = %Windows%\Xplorer.exe /Windows
- Xplorer = %Windows%\Xplorer.exe /Windows
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Taskman = %System%\KHATRA.exe
- Taskman = %System%\KHATRA.exe
- In HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\caution
- NoUnsafeTypeCautionForSCR = 1
- NoUnsafeTypeCautionForSCR = 1
- In HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\caution
- NoUnsafeTypeCautionForEXE = 1
- NoUnsafeTypeCautionForEXE = 1
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Window Title = Internet Exploiter
- Window Title = Internet Exploiter
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- DisableRegistryTools = 1
- DisableRegistryTools = 1
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- NoControlPanel = 1
- NoControlPanel = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
- EnableFileTracing = 0
- EnableFileTracing = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
- EnableConsoleTracing = 0
- EnableConsoleTracing = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
- FileTracingMask = dword:ffff0000
- FileTracingMask = dword:ffff0000
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
- ConsoleTracingMask = ffff0000
- ConsoleTracingMask = ffff0000
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG
- MaxFileSize = 00100000
- MaxFileSize = 00100000
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
- AtTaskMaxHours = 0
- AtTaskMaxHours = 0
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %System%\KHATRA.exe = %System%\KHATRA.exe:*:Enabled:System
- %System%\KHATRA.exe = %System%\KHATRA.exe:*:Enabled:System
Step 4
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- From: load = %System%\KHATRA.exe
To:
- From: load = %System%\KHATRA.exe
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- From: NoDriveTypeAutoRun = ff
To: 91
- From: NoDriveTypeAutoRun = ff
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmsrvc
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage
- From: Start = 4
To: 2
- From: Start = 4
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost
- From: Start = 2
To: 3
- From: Start = 2
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
- From: Start = 4
To: 2
- From: Start = 4
Step 5
Search and delete this file
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_UTOTI.AAE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 7
Restore deleted/modified files and/or registry entries from backup
*Note: Only Microsoft-related files/keys/values will be restored. If this malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Note: Restore the modified autostart registry entries from backup. You may also reinstall the applications related to the modified registry entries in this registry hive.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Did this description help? Tell us how we did.