JS_BASYO.A

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following copies of itself into the affected system:

• %User Profile%\PrintHood\Agregar Impresora.hta
• %User Startup%\Agregar Impresora.hta

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It adds the following processes:

• wmplayer.exe

It searches for the following folders where it can drop/create files:

• %User Profile%
• %User Startup%

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Propagation

This Worm drops copies of itself in the following drives:

• It propagates from drives C to Z after 60 seconds.

Other Details

This Worm does the following:

• It creates the following shortcut files pointing to the malware copy:
  
  • Videos comicos.mpg.lnk
  • (Vacío).lnk
  • Agregar Impresora.lnk
• It copies the icon of shortcut files from the following file:
  
  • %Program Files%\Windows Media Player\wmplayer.exe
  • %SystemRoot%\\system32\\shell32.dll, 51