WORM_IRCBOT.JPA

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It adds registry entries to enable its automatic execution at every system startup.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following component file(s):

• %Application Data%\google_cache{random numbers}.tmp - non-malicious file
• {drive letter}:\ProductInstall\FSA-5916-37591-2352322-634621321-6662355\Desktop.ini - non-malicious file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\lsass.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MPoNvDde

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Local Security Authentication Server = %Application Data%\lsass.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Local Security Authentication Server = %Application Data%\lsass.exe

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\ProductInstall
• {drive letter}:\ProductInstall\FSA-5916-37591-2352322-634621321-6662355

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\ProductInstall\FSA-5916-37591-2352322-634621321-6662355\Install.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=ProductInstall\FSA-5916-37591-2352322-634621321-6662355\Install.exe
icon=%System%\SHELL32.dll,4
action=Open folder to view files
shell\open\command=ProductInstall\FSA-5916-37591-2352322-634621321-6662355\Install.exe
shell\open\default=1

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Backdoor Routine

This worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• syn.{BLOCKED}128.info

NOTES:

It executes the following commands from a remote malicious user:

• Update itself
• Remove itself and registry modifications
• Download additional files
• Terminate a process
• Execute a file