WORM_TOPHOS.AD

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\search.cmd

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Propagation

This worm drops copies of itself in the following drives:

• {drive letter}:\Photo.scr

It drops copies of itself in the following shared folders:

• {Shared folder path}\Photo.scr

Download Routine

This worm connects to the following URL(s) to download its component file(s):

• http://www.{BLOCKED}d.net/load.gif?{random number}

It saves the files it downloads using the following names:

• %Application Data%\temp.cmd

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

As of this writing, the said sites are inaccessible.

NOTES:

This worm has a folder icon and opens the following folders to trick users that it is a legitimate folder:

• %User Profile%\Pictures (Windows Vista and higher versions)
• %User Profile%\My Documents\My Pictures (Versions lower than Windows Vista)