WORM_RIMECUD.ZB

This worm accesses websites to download files detected by Trend Micro as:

• TROJ_FAKEAV.SM8
• TROJ_RIMECUD.DL
• WORM_RIMECUD.SMC

This worm arrives via removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This worm arrives via removable drives.

It may be downloaded from the following remote sites:

• http://b.{BLOCKED}vel.biz/app.exe

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\RECYCLER\{random SID}\winfixer.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %System Root%\RECYCLER\{random SID}\Desktop.ini - nonmalicious file

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RECYCLER\{random SID}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It stays memory-resident by injecting codes into the following processes:

• explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%System Root%\RECYCLER\{random SID}\winfixer.exe"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\RECYCLER\{random SID}\winfixer.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

{random characters}
[autorun]
open=RECYCLER\{random SID}\winfixer.exe
{random characters}
icon=%System Root%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLER\{random SID}\winfixer.exe
{random characters}
shell\open\default=1
{random characters}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Download Routine

This worm accesses the following websites to download files:

• http://two.{BLOCKED}raoi.com/bnet.exe
• http://b.{BLOCKED}pgirl.com/myms.exe
• http://{BLOCKED}pgirl.com/ms0593.exe

It saves the files it downloads using the following names:

• %User Profile%\bnt.exe
• %User Profile%\msc.exe
• %User Profile%\wors.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Trend Micro detects the dowloaded file as:

• TROJ_FAKEAV.SM8
• TROJ_RIMECUD.DL
• WORM_RIMECUD.SMC

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.