WORM_IMAUT.VN

This worm arrives via removable drives.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

Arrival Details

This worm arrives via removable drives.

It may arrive via network shares.

Installation

This worm drops the following non-malicious files:

• %System%\Penx.dat
• %System%\Xpen.dat
• %Windows%\wininit.ini

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following copies of itself into the affected system:

• %Windows%\dc.exe
• %Windows%\SVIQ.EXE
• %Windows%\Help\Other.exe
• %Windows%\inf\Other.exe
• %Windows%\system\Fun.exe
• %System%\WinSit.exe
• %System%\config\Win.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It injects codes into the following process(es):

• lsass.exe
• csrss.exe
• svchost.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
run = %System%\config\Win.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dc = %Windows%\dc.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dc2k5 = %Windows%\SVIQ.EXE

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Fun = %Windows%\system\Fun.exe

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = %Windows%\inf\Other.exe

(Note: The default value data of the said registry entry is blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe %System%\WinSit.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

Propagation

This worm drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It sends copies of itself to target recipients using the following instant-messaging (IM) applications:

• Yahoo! Messenger

It sends the following messages using the aforementioned Instant Messaging applications:

Chuc mung, ban da tam thoi thoat khoi Worm DungCoi
Olalala, may tinh cua ban da dinh Worm DungCoi...........

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• http://{BLOCKED}ivb.googlepages.com/NWB.txt

NOTES:
It drops the following copy of itself into network shares:

• Fun.exe