WORM_UTOTI.CLM
Windows 2000, XP, Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
Propagates via instant messaging applications
This worm arrives by connecting affected removable drives to a system. It arrives by accessing affected shared networks. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
It disables Task Manager, Registry Editor, and Folder Options.
It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.
TECHNICAL DETAILS
607,232 bytes
PE
Yes
14 Oct 2010
Downloads files, Terminates processes
Arrival Details
This worm arrives by connecting affected removable drives to a system.
It arrives by accessing affected shared networks.
It may be dropped by other malware.
It may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This worm drops the following copies of itself into the affected system:
- %System%\system3_.exe
- %Windows%\system3_.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
It drops the following files:
- %System%\autorun.ini - copy of autorun.inf
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Run
Yahoo Messengger = %System%\system3_.exe
It modifies the following registry entry(ies) to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
WINDOWS NT\CURRENTVERSION\Winlogon
Shell = Explorer.exe system3_.exe
(Note: The default value data of the said registry entry is Explorer.exe.)
Other System Modifications
This worm creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
Explorer
NofolderOptions = 1
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
SYSTEM
DisableTaskMgr = 1
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
Windows\CURRENTVERSION\Policies\
SYSTEM
DisableRegistryTools = 1
Propagation
This worm drops copies of itself in all removable and physical drives found in the system.
It drops copies of itself in the following shared folders:
- New Folder.exe
It drops the following copy of itself in all physical and removable drives:
- system3_.exe
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
The said .INF file contains the following strings:
[Autorun]
Open=system3_.exe
Shellexecute=system3_.exe
Shell\\Open\\command=system3_.exe
SShell=Open
It sends the following messages via instant-messaging (IM) applications:
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and get new tips and tricks from URL
happy valentine day screen saver and beautiful screen saver from lovers http://%7bBLOCKED%7dgle.0catch.com/love.scr and URL
golden lovers rose screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and see more from URL
I LOVE YOUUUUUUUUUUUUU from screensaver http://%7bBLOCKED%7dgle.0catch.com/love.scr see more in URL
happy valentine day screen saver from http://%7bblocked%7dgle.0catch.com/love.scr and get new tips and tricks from URL
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and get new tips and tricks for lovers URL
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and view secrets from private cam BINPublic|App={malware path and name}|Name=1
happy valentine day screen saver from http://%7bBLOCKED%7dgle.0catch.com/love.scr and view secrets from private cam BINPublic|App={malware path and name}|Name=1
It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:
- Google Talk
- Yahoo Messenger
Process Termination
This worm terminates processes or services that contain any of the following strings if found running in the affected system's memory:
- game_y.exe
- cmd.exe
- Bkav2006
- System Configuration
- Registry
- Windows Task
Web Browser Home Page and Search Page Modification
This worm modifies the user's Internet Explorer home page to the following websites:
- http://www.{BLOCKED}mworld.50webs.com
Download Routine
This worm connects to the following URL(s) to download its configuration file:
- http://{BLOCKED}way.com/asdb0{number from 0 to 50}/setting.ini
SOLUTION
8.900
under testing
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Terminate this process using Process Explorer
DATA_GENERIC
DATA_GENERIC
Step 3
To enable Registry Editor, Task Manager, and Folder options:
- Open Notepad. To do this, click Start>Run, type Notepad in the text box provided, then press Enter.
- Copy and paste the following script:
- Save this file as C:RESTORE.VBS.
- Click Start>Run again, type C:RESTORE.VBS in the text box provided, then press Enter.
- Click Yes at the prompt of the message box to execute the .VBS file.
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Run
- Yahoo Messengger = %System%\system3_.exe
- Yahoo Messengger = %System%\system3_.exe
Step 5
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Winlogon
- From: Shell=Explorer.exe system3_.exe
To: Explorer.exe
- From: Shell=Explorer.exe system3_.exe
Step 6
Reset the Internet Explorer Home and Search pages
Step 7
Search and delete AUTORUN.INF files created by WORM_UTOTI.CLM that contain these strings
Step 8
Search and delete this file
Step 9
Delete the Scheduled Tasks added by this malware/grayware
Step 10
Scan your computer with your Trend Micro product to delete files detected as WORM_UTOTI.CLM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.