WORM_IMAUT.GQ

This worm may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names. The sent messages contains a link where a copy of the malware may be downloaded.

Arrival Details

This worm may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\dc.exe
• %Windows%\SVIQ.exe
• %System%\WinSit.exe
• %System%\config\Win.exe
• %Windows%\system\Fun.exe
• %Windows%\inf\Other.exe
• %Windows%\Help\Other.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It is injected into the following processes running in memory:

• csrss.exe
• lsass.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dc2k5 = %Windows%\SVIQ.EXE

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Fun = %Windows%\system\Fun.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dc = %Windows%\dc.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
run = %System%\config\Win.exe

Other System Modifications

This worm modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = %Windows%\inf\Other.exe

(Note: The default value data of the said registry entry is {blank}.)

HKEY_LOCAL_MACHINE\SOFTWARE\MIcrosoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe %System%\WinSit.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

Propagation

This worm drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

The sent messages contain the following link(s), where a copy of the malware may be downloaded:

• http://{BLOCKED}vb.{BLOCKED}pages.com/NWB.txt

It sends copies of itself to target recipients using the following instant-messaging (IM) applications:

• Yahoo! Messenger

It sends the following messages using the aforementioned Instant Messaging applications:

http://{BLOCKED}vb.{BLOCKED}pages.com/NWB.txt
Chuc mung, ban da tam thoi thoat khoi Worm DungCoi
Olalala, may tinh cua ban da dinh Worm DungCoi...........

Dropping Routine

This worm drops the following files:

• %Windows%\wininit.ini

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)