WORM_SILLY.MBC
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
431,104 bytes
EXE
Yes
21 Mar 2011
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This worm drops the following files:
- %System%\iconhandle.dll
- %System%\webad.dll
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
It drops the following copies of itself into the affected system:
- %System%\web.dat
- %System%\winweb.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
Other System Modifications
This worm adds the following registry keys as part of its installation routine:
HKEY_CLASSES_ROOT\iconhandle.seticon
HKEY_CLASSES_ROOT\iconhandle.seticon.1
HKEY_CLASSES_ROOT\AppID\iconhandle.DLL
HKEY_CLASSES_ROOT\AppID\{DD0AD1D0-6C36-4894-B38E-9E5D3392114D}
HKEY_CLASSES_ROOT\CLSID\{AEFA7E78-CF7E-4550-829F-2C786A0070BF}
HKEY_CLASSES_ROOT\Interface\{72397142-9352-4A45-99AD-2EF143072AC0}
HKEY_CLASSES_ROOT\TypeLib\{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}
NOTES:
It searches for folders in all removable drives and drop copies of itself using the name of the folders found as the file name of the dropped copies.
SOLUTION
8.900
7.917.80
21 Mar 2011
NOTES:
Did this description help? Tell us how we did.