WORM_UTOTI.CLM

This worm arrives by connecting affected removable drives to a system. It arrives by accessing affected shared networks. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It disables Task Manager, Registry Editor, and Folder Options.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives by accessing affected shared networks.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\system3_.exe
• %Windows%\system3_.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following files:

• %System%\autorun.ini - copy of autorun.inf

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Run
Yahoo Messengger = %System%\system3_.exe

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
WINDOWS NT\CURRENTVERSION\Winlogon
Shell = Explorer.exe system3_.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This worm creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
Explorer
NofolderOptions = 1

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
SYSTEM
DisableTaskMgr = 1

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
SYSTEM
DisableRegistryTools = 1

Propagation

This worm drops copies of itself in all removable and physical drives found in the system.

It drops copies of itself in the following shared folders:

• New Folder.exe

It drops the following copy of itself in all physical and removable drives:

• system3_.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[Autorun]
Open=system3_.exe
Shellexecute=system3_.exe
Shell\\Open\\command=system3_.exe
SShell=Open

It sends the following messages via instant-messaging (IM) applications:

happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and get new tips and tricks from URL
happy valentine day screen saver and beautiful screen saver from lovers http://%7bBLOCKED%7dgle.0catch.com/love.scr and URL
golden lovers rose screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and see more from URL
I LOVE YOUUUUUUUUUUUUU from screensaver http://%7bBLOCKED%7dgle.0catch.com/love.scr see more in URL
happy valentine day screen saver from http://%7bblocked%7dgle.0catch.com/love.scr and get new tips and tricks from URL
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and get new tips and tricks for lovers URL
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and view secrets from private cam BINPublic|App={malware path and name}|Name=1
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and view secrets from private cam BINPublic|App={malware path and name}|Name=1

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• Google Talk
• Yahoo Messenger

Process Termination

This worm terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• game_y.exe
• cmd.exe
• Bkav2006
• System Configuration
• Registry
• Windows Task

Web Browser Home Page and Search Page Modification

This worm modifies the user's Internet Explorer home page to the following websites:

• http://www.{BLOCKED}mworld.50webs.com

Download Routine

This worm connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}way.com/asdb0{number from 0 to 50}/setting.ini