WORM_VB.SMIC
Worm:Win32/VB.WJ (Microsoft), W32/Autorun.worm.c (McAfee)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It modifies certain registry entries to hide file extensions.
It drops copies of itself into all the physical drives of an affected system. It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.
It modifies the Internet Explorer Zone Settings.
TECHNICAL DETAILS
540,672 bytes
EXE
13 Aug 2013
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
"(Default Value)" = "%SystemRoot%\{Random Numbers}-.exe"
Other System Modifications
This worm adds the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes
exefile =
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\ShellNoRoam\MUICache\
C:\WINDOWS
{Random Name}.exe = "{Random Name}"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
It modifies the following registry entries to hide file extensions:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"
(Note: The default value data of the said registry entry is "0".)
Propagation
This worm drops copies of itself into all the physical drives of an affected system.
It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.
Web Browser Home Page and Search Page Modification
This worm modifies the Internet Explorer Zone Settings.
NOTES:
It drops copies of itself into all the physical drives as {Random Value}.exe.