VBS_VKHOST

VKHOST variants are downloader malware that modify the affected system's HOSTS files to prevent a user from accessing certain websites.

Installation

This worm drops the following non-malicious files:

• %User Temp%\b.ico
• %User Temp%\dumb13145
• %User Temp%\{random}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This worm drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• {random}.lnk

Dropping Routine

This worm drops the following files:

• %User Temp%\{random}.vbs

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Download Routine

This worm saves the files it downloads using the following names:

• %User Temp%\{random1}
• %User Temp%\{random}.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}x.{BLOCKED}es.info/js/data/ex.dll
• http://{BLOCKED}a.{BLOCKED}q.info/js/data/ex.dll
• http://{BLOCKED}o.{BLOCKED}es.info/js/data/ex.dll
• http://{BLOCKED}v.{BLOCKED}ick.info/js/data/ex.dll
• http://{BLOCKED}l.{BLOCKED}r.info/js/data/ex.dll
• http://{BLOCKED}f.{BLOCKED}r.info/js/data/ex.dll