WORM_MSIL.AKE

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\Pictures\JSR.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following files:

• %User Profile%\Documents\JSR.doc
• %User Profile%\Pictures\Skiper.jpeg
• %System Root%\Users\Public\Pictures\Sample Pictures\Skiper.jpeg
• %Desktop%\Skiper.jpeg
• %Desktop%\Skiper's - Infection Report.txt

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Command Processor
Autorun = "cls& color 4f & start %User Profile%\Pictures\JSR.exe & echo Jai SiyaRam, Skiper Welcomes You "

Propagation

This worm drops the following copies of itself in all physical and removable drives:

• {drive letter} .exe

NOTES:

It also drops the following copies of itself in all folders and sub-folders in the affected system:

• {folder name where the malware is found}.exe

It drops the following files in all folders and sub-folders in the affected system:

• {folder where the malware is found}\desktop.ini
• {folder where the malware is found}\everything.{ed7ba470-8e54-465e-825c-99712043e01c}

everything.{ed7ba470-8e54-465e-825c-99712043e01c} is a shortcut link to All Control Panel items but treated as an empty folder in Windows OS other than Vista and 7.

At first execution, it opens %User Profile%\Documents\JSR.doc, changes the wallpaper and activates the screensaver.

%User Profile%\Documents\JSR.doc contains the following:

Jai SiyaRam,
------------------------------------------------------------------------------------------------------------------------------------------
SKIPER - BEYOND IMAGINATION

Skiper Welcomes progarmming lovers in the Group:)

You can discuss your problem with us or you can ask or answer questions
(Any how Related to Programming).
You can discuss your projects. You can help or take help.
You are humbly welcome!


You can join us at Facebook
search us by name Niitians Click

Thank you for reading ,
SKIPER

The wallpaper used depends on the first JPEG file found (alphanumerical order) in %System Root%\Users\Public\Pictures\Sample Pictures.

It uses Bubbles.scr for the screensaver.

%Desktop%\Skiper's - Infection Report.txt contains the number of directories\folders infected.

Note: {For users of Windows OS other than Vista and 7}

• %User Profile%\Documents is %User Profile%\My Documents
• %User Profile%\Pictures is %User Profile%\My Pictures