WORM_YAHLOVER.LJ

This worm arrives by connecting affected removable drives to a system. It arrives by accessing affected shared networks. It may be unknowingly downloaded by a user while visiting malicious websites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy. It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It disables Task Manager, Registry Editor, and Folder Options.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives by accessing affected shared networks.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• {install directory}\system3_.exe

It drops the following files:

• {install directory}\autorun.ini - copy of autorun.inf
• %Windows%\Tasks\At1.job

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Yahoo Messengger = "{install directory}\system3_.exe"

The scheduled task executes the malware every:

• 9:00 AM

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "{URL}"

(Note: The default value data of the said registry entry is {user defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = "{URL}"

(Note: The default value data of the said registry entry is {user defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = "{URL}"

(Note: The default value data of the said registry entry is {user defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Search Page = "{URL}"

(Note: The default value data of the said registry entry is {user defined value}.)

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NofolderOptions = "1"

Propagation

This worm searches for folders in all physical and removable drives then drops copies of itself inside the folder as {folder name}.EXE.

It drops the following copy of itself in all physical and removable drives:

• New Folder.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[Autorun]
Shell\Open\command={malware filename}.exe
Shell=Open

It sends the following messages using the aforementioned Instant Messaging applications:

happy valentine day screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and get new tips and tricks from URL
happy valentine day screen saver and beautiful screen saver from lovers http://{BLOCKED}gle. 0catch. com/love.scr and URL
golden lovers rose screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and see more from URL
rose is always red ,see in http://{BLOCKED}gle. 0catch. com/love.scr screen saver from URL
happy valentine day screen saver from http://{BLOCKED}gle.0catch. com/love.scr and get new tips and tricks from URL
I LOVE YOUUUUUUUUUUUUU from screensaver http://{BLOCKED}gle. 0catch. com/love.scr see more in URL happy valentine day screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and get new tips and tricks from URL
happy valentine day screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and get new tips and tricks for lovers URL
happy valentine day screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and view secrets from private cam BIN
happy valentine day screen saver from http://{BLOCKED}gle. 0catch. com/love.scr and view secrets from private cam BIN

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• Yahoo Messenger
• Google Talk

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• game_y.exe
• cmd.exe

NOTES:

Upon execution, the malware checks the OS version of the affected machine. If it is Windows Vista, it sets the install directory to %Desktop% or %User Temp%.

If the worm is not running on Windows Vista, the install directory is set to %System% or %Windows%.

It modifies the registry to change the start page/search page of the browser:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Start Page = {URL}
Default_Page_URL = {URL}
Default_Search_URL = {URL}
Search Page = {URL}

where {URL} can be any of the following:

• http://www.{BLOCKED}mworld.50webs.com
• http://www.{BLOCKED}gle.blogspot.com

This worm enumerates shared drives by checking the value from following registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

It then copies itself to the shared drive as New Folder.exe. It also copies its corresponding AUTORUN.INF to automatically execute the worm.

It terminates processes of applications with the following Window Names:

• [FireLion]
• Bkav2006
• Registry
• System Configuration
• Windows Task