WORM_GAMETHI.GRZ

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites.

It executes then deletes itself afterward.

It modifies registry entries to hide files with System and Read-only attributes.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It steals sensitive information such as user names and passwords related to certain games.

It opens a hidden Internet Explorer window.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\xvassdf.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following file(s)/component(s):

• %User Temp%\4tddfwq0.dll - also detected as WORM_GAMETHI.GRZ

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Its DLL component is injected to the following process(es):

• {All Running Processes}

It executes then deletes itself afterward.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
54dfsger = %User Temp%\xvassdf.exe

Other System Modifications

This worm modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops the following copy of itself in all physical and removable drives:

• puia6h.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=puia6h.exe
shell\open\Command=puia6h.exe

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• ALUSCHEDULERSVC.EXE
• ASHDISP.EXE
• AVGNT.EXE
• AVGRSX.EXE
• AVP.EXE
• CCSVCHST.EXE
• EKRN.EXE
• InphaseNXD.EXE
• LIVESRV.EXE
• SfFnUp.exe
• UFSEAGNT.EXE
• UfUpdUi.exe
• Update.exe
• VCRMON.EXE
• VSTSKMGR.EXE
• avgupd.exe
• luall.exe
• mcupdate.exe
• preupd.exe
• update.exe

Download Routine

This worm downloads updated copies of itself from the following websites:

• http://www.{BLOCKED}d3.com/1rb/ar1.rar
• http://www.{BLOCKED}lk.com/1rb/ar.rar

Information Theft

This worm steals sensitive information such as user names and passwords related to the following games:

• ARAD.exe
• Atlantica.exe
• Ragexe.exe
• coc.exe
• red stone.exe
• maplestory.exe
• pol.exe
• cabalmain.exe
• InphaseNXD.EXE

Other Details

This worm opens a hidden Internet Explorer window.

It does the following:

• Attempts to steal information from the file AAA.DAT
• Attempts to capture Yahoo! account login credentials whenever the following URLs are accessed:
  • https://login.yahoo.co.jp/config/login_verify2?.src=ym
  • https://login.yahoo.co.jp/config/login?
• Monitors traffic going to the following IP addresses:
  • 59.128.94.145
  • 59.128.94.146
  • 59.128.94.147
  • 59.128.94.148
  • 59.128.94.149
  • 59.128.94.150
  • 59.128.94.151
  • 59.128.94.152
  • 59.128.94.153
  • 59.128.94.154
  • 59.128.95.128
  • 59.128.95.130
  • 59.128.95.132
  • 59.128.95.134
  • 59.128.95.136
  • 59.128.95.138
  • 59.128.95.140
  • 59.128.95.142
  • 59.128.95.144
  • 59.128.95.146
  • 59.128.95.148
  • 59.128.95.150
  • 59.128.95.152
  • 59.128.95.154
  • 59.128.95.156
  • 59.128.95.158
  • 59.128.95.160