WORM_PALEVO.LJ

 Analysis by: Erika Bianca Mendoza

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Copies itself in all available physical drives, Propagates via removable drives

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates folders in all physical and removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

  TECHNICAL DETAILS

File Size:

81,920 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

02 Nov 2011

Payload:

Compromises system security, Connects to URLs/IPs

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

  • %User Profile%\aegvvp.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • 1jl8+10

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profile%\aegvvp.exe"

Propagation

This worm creates the following folders in all physical and removable drives:

  • keyboard

It drops the following copy(ies) of itself in all removable drives:

  • {Drive}:\keyboard\flash.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
USEAUTOPLAY=1
shellexcute=keyboard/flash.exe
Shellfiber
shell\Explore\command=keyboard/flash.exe
shell\Open\command=keyboard/flash.exe
icon=keyboard/flash.exe
open=keyboard/flash.exe
action=0pen folder to view files using Windows Explorer

Backdoor Routine

This worm executes the following commands from a remote malicious user:

  • Open a browser and connect to advertisement sites
  • Download and execute file(s) from remote site(s)
  • Drop a copy of the malware to specific drive(s)
  • Drop a copy of the malware to USB drive(s)

It connects to the following websites to send and receive information:

  • {BLOCKED}e.safehousenumber.com
  • {BLOCKED}k.portal-protection.net.ru
  • world.{BLOCKED}udio.ru
  • banana.{BLOCKED}nds.su
  • portal.{BLOCKED}owerbord.com

NOTES:

It opens an instance of svchost.exe where it injects itself to stay memory resident.

  SOLUTION

Minimum Scan Engine:

9.200

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Identify and delete files detected as WORM_PALEVO.LJ using either the Startup Disk or Recovery Console

[ Learn More ]

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

 
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • Taskman = "%User Profile%\aegvvp.exe"

Step 4

Search and delete this folder

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result. [DRIVE]:\keyboard

Step 5

Search and delete AUTORUN.INF files created by WORM_PALEVO.LJ that contain these strings

[ Learn More ]
[autorun]
USEAUTOPLAY=1
shellexcute=keyboard/flash.exe
Shellfiber
shell\Explore\command=keyboard/flash.exe
shell\Open\command=keyboard/flash.exe
icon=keyboard/flash.exe
open=keyboard/flash.exe
action=0pen folder to view files using Windows Explorer

Step 6

Scan your computer with your Trend Micro product to delete files detected as WORM_PALEVO.LJ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

RECOMMENDATION:

This malware is detected and removed by the latest Trend Micro anti-malware engine and pattern. Always keep pattern files and engines up-to-date. To know more about updating your Trend Micro product’s pattern, please refer to the following Trend Micro support page:

Note: The steps apply for specific products indicated in the page.

To actively detect and protect your machine, enable real-time scanning of your Trend Micro anti-malware product. Refer to the following Trend Micro support page to know more about enabling real-time scanning in your Trend Micro product:

Other recommendations to prevent infection:

  • Enable firewall to protect against threats. Steps to enable firewall in your Trend Micro product: http://esupport.trendmicro.com/3/How-do-I-enable-or-disable-the-Personal-Firewall-of-Trend-Micr-EN-1038273.aspx.
  • Be aware of social engineering attacks.
  • Avoid accessing the listed malicious URLs to prevent possible re-infection.
  • Monitor network connections for any suspicious connection or connectivity.
  • Regularly update list of sites that are trusted.
  • Avoid downloading software cracks and/or pirated applications.
  • Avoid visiting un-trusted sites that may redirect or download malware into the system.
  • Disable AutoPlay to avoid automatic execution of executable files in removable/network drives.
  • Disconnect drives when not needed. If write access is not required, enable read-only mode only.


Did this description help? Tell us how we did.