PE_CAOLYWA.E-O

This file infector arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It infects by appending its code to target host files. It infects certain file types by inserting code in the said files. It creates an infection marker in infected files.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This file infector arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• PE_CAOLYWA.E

Installation

This file infector drops the following copies of itself into the affected system:

• %Windows%\Tasks\0x01xx8p.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It drops the following files:

• {drive letter}:\MSDOS.bat
• c:\zzz.sys

It drops the following non-malicious files:

• %Windows%\Tasks\spoolsv.ext (backup of spoolsv.exe)
• %Windows%\Tasks\SysFile.brk (backup of spoolsv.exe)

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

File Infection

This file infector infects the following file types:

• .exe
• .cmd
• .bat
• .com
• .scr

It infects by appending its code to target host files.

It infects files with the following file extensions by inserting code in the said files:

• .do
• .htm
• .html
• .shtm
• .shtml
• .asp
• .aspx
• .php
• .jsp
• .cgi
• .xml
• .GHO

It creates an infection marker in infected files.

It avoids infecting folders containing the following strings:

• Program Files

It avoids infecting the following files:

• qq.exe
• QQDoctor.exe
• QQDoctorMain.exe

Propagation

This file infector drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=MSDOS.bat
shell\open={characters}
shell\open\Command=MSDOS.bat
shell\open\Default=1
shell\explore={characters}
shell\explore\Command=MSDOS.bat

Backdoor Routine

This file infector executes the following commands from a remote malicious user:

• Visit URL(s)
• Download and execute files
• Infect files
• Spread via removable drives

Process Termination

This file infector terminates the following processes if found running in the affected system's memory:

• avp.exe
• kvsrvxp.exe
• kissvc.exe

Download Routine

This file infector saves the files it downloads using the following names:

• %System%\windows.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Information Theft

This file infector accesses the following site to download its configuration file:

• http://x.{BLOCKED}1.net/x.txt