WORM_ZIMUS.B

Trend Micro has flagged this worm as noteworthy due to the increased potential for damage, propagation, or both, that it possesses. Specifically, it deletes important files that are needed during system bootup.

To get a one-glance comprehensive view of the behavior of this Worm, refer to the Threat Diagram shown below.

This worm may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This worm may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\tokset.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following file(s)/component(s):

• %Program Files%\Dump\Dump.exe
• %System Root%\IQTEST\Iqtest.exe
• %System Root%\IQTEST\Readme.txt
• %System%\ainf.inf
• %System%\drivers\Mseu.sys - also detected as WORM_ZIMUS.B
• %System%\drivers\Mstart.sys - also detected as WORM_ZIMUS.B
• %System%\mseus.exe - also detected as WORM_ZIMUS.B

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %Program Files%\Dump
• %System Root%\IQTEST

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Eventlog\MSTART
(Default) =  

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Mseu
(Default) =  

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\MSTART
(Default) =  

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\UnzipService
(Default) =  

Other System Modifications

This worm deletes the following files:

• C:\BOOT.INI
• C:\BOOTMGR
• C:\BOOTMGR.BAK
• C:\BOOTSECT
• C:\BOOTSECT.BAK
• C:\Documents and Settings\*.*
• C:\Documents and Settings\Administrator\My Documents\*.*
• C:\HYBERFILE.SYS
• C:\NTDETECT.COM
• C:\NTLDR
• C:\System Volume Information\*.*
• C:\Users\*.*
• C:\Users\Administrator\*.*
• D:\Documents and Settings\*.*
• D:\Documents and Settings\Administrator\My Documents\*.*
• D:\System Volume Information\*.*
• D:\Users\*.*
• D:\Users\Administrator\*.*
• E:\Documents and Settings\*.*
• E:\Documents and Settings\Administrator\My Documents\*.*
• E:\System Volume Information\*.*
• E:\Users\*.*
• E:\Users\Administrator\*.*
• F:\Documents and Settings\*.*
• F:\Documents and Settings\Administrator\My Documents\*.*
• F:\System Volume Information\*.*
• F:\Users\*.*
• F:\Users\Administrator\*.*
• G:\Documents and Settings\*.*
• G:\Documents and Settings\Administrator\My Documents\*.*
• G:\System Volume Information\*.*
• G:\Users\*.*
• G:\Users\Administrator\*.*
• H:\Documents and Settings\*.*
• H:\Documents and Settings\Administrator\My Documents\*.*
• H:\System Volume Information\*.*
• H:\Users\*.*
• H:\Users\Administrator\*.*
• I:\Documents and Settings\*.*
• I:\Documents and Settings\Administrator\My Documents\*.*
• I:\System Volume Information\*.*
• I:\Users\*.*
• I:\Users\Administrator\*.*
• J:\Documents and Settings\*.*
• J:\Documents and Settings\Administrator\My Documents\*.*
• J:\System Volume Information\*.*
• J:\Users\*.*
• J:\Users\Administrator\*.*

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Dump = %Program Files%\Dump\Dump.exe

Propagation

This worm drops copies of itself in the following drives:

• A
• B
• C
• D
• E
• F
• G
• H
• I
• J