WORM_AUTORUN.AE

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives via peer-to-peer (P2P) shares. It arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies certain registry entries to hide file extensions.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies certain registry entries to hide Hidden files.

Arrival Details

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives via peer-to-peer (P2P) shares.

It arrives via removable drives.

It may arrive via network shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %User Startup%\ADOBE UPDATE.LNK
• {drive letter}:\Autorun.inf
• %Windows%\Tasks\At1.job
• %Windows%\Tasks\At2.job

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following copies of itself into the affected system:

• %User Temp%\systray.exe
• %User Profile%\APPLICATION DATA\usrinit.exe
• %Program Files%\COMMON FILES\ADOBEUPDATE.EXE
• %Program Files%\KAZAA LITE\MY SHARED FOLDER\SEX_SCREENSAVER.SCR
• %Program Files%\KAZAA LITE\MY SHARED FOLDER\Sex_Game.exe
• %Program Files%\Kazaa\MY SHARED FOLDER\SEX_SCREENSAVER.SCR
• %Program Files%\Kazaa\MY SHARED FOLDER\Sex_Game.exe
• %Program Files%\EDONKEY2000\incoming\SEX_SCREENSAVER.SCR
• %Program Files%\EDONKEY2000\incoming\Sex_Game.exe
• %Program Files%\emule\incoming\SEX_SCREENSAVER.SCR
• %Program Files%\emule\incoming\Sex_Game.exe
• %Program Files%\limewire\shared\SEX_SCREENSAVER.SCR
• %Program Files%\limewire\shared\Sex_Game.exe
• %Program Files%\XPCode\SexGame.exe
• %Program Files%\XPCode\SEXSCREENSAVER.SCR
• %Program Files%\XPCode\SEXGAMELIST.PIF
• %User Profile%\Local Settings\startup.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %Program Files%\XPCode

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This worm creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
SoundMax = "%User Profile%\Local Settings\startup.exe"

Other System Modifications

This worm also creates the following registry entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Shares
New_soft = "CSCFlags=0 MaxUses=5 Path=C:\Program Files\XPCode Permissions=0 Remark=NewSoftwares Type=0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaskHours = "48"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableConfig = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableSR = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
Nofolderoptions = "1"

It modifies the following registry entries to hide file extensions:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "2"

(Note: The default value data of the said registry entry is "0".)

Propagation

This worm drops the following copy of itself in all physical and removable drives:

• {drive letter}:\autorun.exe

It uses the following file names for the copies it drops into shared networks:

• SexScreenSaver.exe
• AdobeUpdate.exe
• Sex_Game.exe
• SEX_SCREENSAVER.SCR

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
action=Open Removable Drive
open=autorun.exe OPEN
icon=C:\windows\system32\shell32.dll,8
shell\open=Open
shell\open\Command=autorun.exe OPEN
shell\open\Default=1
shell\explore=Explore
shell\explore\Command=autorun.exe EXPLORE
shell\AutoPlay=AutoPlay
shell\AutoPlay\Command=autorun.exe OPEN

Other Details

This worm modifies the following registry entries to hide Hidden files:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "2"

(Note: The default value data of the said registry entry is "1".)

NOTES:
This worm drops the following shortcut file in removable drives to point to this worm's copy in the removable drive:

• New Folder.lnk

It modifies the following shortcut files to enable the execution of its dropped component.

• %User Profile%\Start Menu\Programs\Accessories\Command Prompt.lnk
• %User Profile%\Start Menu\Programs\Accessories\Notepad.lnk