WORM_FAKEFOLD.SAN
Trojan:Win32/VB.AAK (Microsoft), Trojan.Win32.Generic.pak!cobra (Sunbelt), Trojan.Win32.VB.uat (Kaspersky)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Worm
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.
It modifies Internet Explorer security settings. This puts the affected computer at greater risk, as it allows malicious URLs to be accessed by the computer.
It accesses websites to download files. This action allows this malware to possibly add other malware on the affected computer. As of this writing, the said sites are inaccessible.
TECHNICAL DETAILS
110,592 bytes
No
21 Jul 2013
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other System Modifications
This worm adds the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\tydown
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is "1".)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"
(Note: The default value data of the said registry entry is "0".)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
Checkedvalue = "0"
(Note: The default value data of the said registry entry is "1".)
Propagation
This worm drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.
Web Browser Home Page and Search Page Modification
This worm modifies Internet Explorer zone settings.
Dropping Routine
This worm drops the following files:
- %User Temp%\{random numbers}.exe
- %User Temp%\{random numbers}.tmp
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
Download Routine
This worm accesses websites to download the following files:
- http://cciv.{BLOCKED}2.org/8800.exe
As of this writing, the said sites are inaccessible.
SOLUTION
9.300
10.166.08
21 Jul 2013
10.167.00
21 Jul 2013
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows
- tydown
- tydown
Step 3
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = "2"
To: Hidden = "1"
- From: Hidden = "2"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideFileExt = "1"
To: HideFileExt = "0"
- From: HideFileExt = "1"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowSuperHidden = "0"
To: ShowSuperHidden = "1"
- From: ShowSuperHidden = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
- From: Checkedvalue = "0"
To: Checkedvalue = "1"
- From: Checkedvalue = "0"
Step 4
Search and delete this file
- %User Temp%\{random numbers}.exe
- %User Temp%\{random numbers}.tmp
Step 5
Reset Internet security settings
Step 6
Scan your computer with your Trend Micro product to delete files detected as WORM_FAKEFOLD.SAN. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.