Analysis by: Rika Joi Gregorio
ALIASES:

Worm:VBS/Autorun.AG(Microsoft), VBS/IE-Title(McAfee), VBS/Sasan-Fam(Symantec), VBS/AutoRun.BK worm(Eset)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size: 5,529 bytes
File Type: VBS
Memory Resident: Yes
Initial Samples Received Date: 27 Nov 2010

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

  • %System%\VirusCleaner.vbe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This worm modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\wscript.exe %System%\VirusCleaner.vbe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Window Title = "Total It Solutions"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFolderOptions = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "about:blank/"

(Note: The default value data of the said registry entry is "{default start page}".)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

  • {Drive Letter}:\VirusCleaner.vbe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=wscript.exe VirusCleaner.vbe
shell\open=Open
shell\open\Command=wscript.exe VirusCleaner.vbe

NOTES:

This worm delete files in drives with the following extensions:

  • vbs

It also delete files with the following file names:

  • ravmon.exe
  • sxs.exe
  • winfile.exe
  • run.wsh