VBS_AGENT.AVKG

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\My Documents\df5srvc.bfe
• %System Root%\{all folders found}\desktop.ini
• %System Root%\desktop.ini

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Df5serv = Wscript.exe //e:VBScript "%User Profile%\My Documents\df5srvc.bfe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Explorer = Wscript.exe //e:VBScript "%Application Data%\Microsoft\CD Burning\dekstop.ini"

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
WarningIfNotDefault = fandy love yuyun

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistrytools = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://www.{BLOCKED}t.co.nr

(Note: The default value data of the said registry entry is {default homepage}.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
UncheckedValue = 1

(Note: The default value data of the said registry entry is 0.)

Propagation

The said .INF file contains the following strings:

[autorun]
open=WScript.exe //e:VBScript dekstop.ini auto
shell\open=Open
shell\open\Command=WScript.exe //e:VBScript dekstop.ini auto
shell\open\Default=1
shell\explore=Explore
shell\explore\Command=WScript.exe //e:VBScript dekstop.ini auto

Dropping Routine

This worm drops the following files:

• %System Root%\autorun.inf - detected by Trend Micro as Mal_Otorun1
• %System Root%\{all folders found}\autorun.inf - detected by Trend Micro as Mal_Otorun1
• %System Root%\Microsoft.lnk
• %System Root%\Aplikasi.lnk
• %System Root%\{all folders found}\Microsoft.lnk
• %System Root%\{all folders found}\Aplikasi.lnk
• %System%\Serv60d.dll - nonmalicious
• %System%\auto.exe - detected by Trend Micro as Mal_Otorun1
• %System%\v.doc - nonmalicious

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This worm does the following:

• It creates shortcut links of all folders found in the %System Root% folder.

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)