WORM_DYBALOM.AR

It is capable of launching DoS attacks, updating itself and removing itself from the affected system. It can also enumerate running processes, download other files, and retrieve user names and passwords used in Mozilla Firefox.

This worm arrives by connecting affected removable drives to a system. It arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It adds registry entries to enable its automatic execution at every system startup.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\Microsoft\winlog.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 1o#+/37;CGKOSW[

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
winlog.exe = %Application Data%\Microsoft\winlog.exe

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• winlog.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
shell=verb
open=winlog.exe
action=Open folder to view files
shell\open=Open
icon=%SystemRoot%\system32\SHELL32.dll,4

Backdoor Routine

This worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}1234.no-ip.info

However, as of this writing, the said sites are inaccessible.

NOTES:
It has the following capabilities:

• Launch DoS attack
• Update itself
• Remove itself
• Enumerate running processes
• Kill processes
• Download other files
• Retrieve saved user names and passwords used in Mozilla Firefox