WORM_VBOBFUS.AQ

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies registry entries to hide files with System and Read-only attributes.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %UserProfile%\{random}.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Profile%\{random}.exe /h"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
Run = "%User Profile%\{random}.exe /k"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Profile%\{random}.exe /y"

Other System Modifications

This worm modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSupperHidden = "00000001"

(Note: The default value data of the said registry entry is 00000000.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Drive Letter}\Porn.exe
• {Drive Letter}\Secret.exe
• {Drive Letter}\Sexy.exe
• {Drive Letter}\{random}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open={random}.exe
acTiOn=4564
uSEAuTOpLaY=1

Other Details

This worm connects to the following possibly malicious URL:

• {BLOCKED}1.{BLOCKED}dates.com