WORM_P2PLOAD.K

This worm arrives via peer-to-peer (P2P) shares. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

As of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives via peer-to-peer (P2P) shares.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following non-malicious files:

• %System%\{malware file name}.exe.log
• %System%\{malware file name}.exe.log.{random numbers}

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\{random characters}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
Type = 10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
ImagePath = {malware path and file name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
DisplayName = {malware file name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{malware file name}.exe
ObjectName = LocalSystem

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\30A1CD119712BB638412FDC21ADDEE80

HKEY_LOCAL_MACHINE\SOFTWARE\30A1CD119712BB638412FDC21ADDEE80

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\{malware file name}.exe = %System%\{malware file name}.exe:*:Enabled:{malware file name}

Propagation

This worm drops copies of itself into the following folders used in peer-to-peer (P2P) networks:

• Shared folders of the following applications:
• Ares
• Bearshare
• Cultiv8r
• Gnotella
• Gnucleus
• Gnut
• Gtk-Gnutella
• Hagelslag
• Limewire
• Mactella
• Morpheus
• MyNapster
• NapShare
• OCFolders
• Qtella
• Shareaza
• SwapNut
• Toadnode

Download Routine

This worm accesses the following websites to download files:

• http://{BLOCKED}syouall.com/flickr/?a=3292&c=

As of this writing, the said sites are inaccessible.