WORM_BUZUS.FG

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\avgt32.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious file:

• [drive letter]:\{Computer Name}\{Computer Name}\Desktop.ini

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• PigSuckedagaxaisnMyDiCK

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Messenger = %User Temp%\avgt32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Messenger = %User Temp%\avgt32.exe

Propagation

This worm creates the following folders in all removable drives:

• [drive letter]:\{Computer Name}
• [drive letter]:\{Computer Name}\{Computer Name}

It drops the following copy(ies) of itself in all removable drives:

• [drive letter]:\{Computer Name}\{Computer Name}\{Computer Name}hjd.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage characters}
[autorun]
open={Computer Name}\{Computer Name}\{Computer Name}hjd.exe
action=Open folder to see files using Windows Explorer
shell\\\open=Explore
shell\\\open\\\command={Computer Name}\{Computer Name}\{Computer Name}hjd.exe
;
shell\\\open\\\default=1
;{garbage characters}

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Download and execute other files
• Terminate Processes
• Create/Delete Registry Entries
• Update itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}p.{BLOCKED}s.in
• {BLOCKED}p.{BLOCKED}y.in
• {BLOCKED}p.{BLOCKED}at.org
• {BLOCKED}p.{BLOCKED}k.net
• {BLOCKED}p.{BLOCKED}idic.net
• {BLOCKED}v.{BLOCKED}c.cz
• {BLOCKED}v.{BLOCKED}n.cc

As of this writing, the said sites are inaccessible.

Process Termination

This worm terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• Wireshark
• tcpview
• MSASCui
• msmpeng

Dropping Routine

This worm sets the attributes of its dropped file(s) to the following:

• Read-only
• Hidden
• System