WORM_IRCBRUTE.VZ

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

It modifies the affected system's HOSTS files. This prevents users from accessing certain websites.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Program Files%\winlogon.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Live Guards = "%Program Files%\winlogon.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Live Guards = "%Program Files%\winlogon.exe"

Other System Modifications

This worm creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
Windows Live Guards = "%Program Files%\winlogon.exe"

Propagation

This worm creates the following folders in all removable drives:

• DATABLOCK

It drops copies of itself into the following folders used in peer-to-peer (P2P) networks:

• %Program Files%\LimeWire\Shared
• %Program Files%\eDonkey2000\incoming
• %Program Files%\KAZAA
• %Program Files%\Morpheus\My Shared Folder\
• %Program Files%\BearShare\Shared\
• %Program Files%\ICQ\Shared Files\
• %Program Files%\Grokster\My Grokster\
• %System Root%\My Downloads\

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}:\DATABLOCK\System\DATABLOCK.EXE

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=DATABLOCK\System\DATABLOCK.EXE
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open\command=DATABLOCK\System\DATABLOCK.EXE
shell\open\default=1

Backdoor Routine

This worm connects to any of the following IRC server(s):

• http://{BLOCKED}trocked.servequake.com

It executes the following commands from a remote malicious user:

• Download and execute files
• Get drive information such as drive type and available disk space
• Get system information such as OS information, IP address, hostname, user name, etc.
• Get network information such as speed, uptime, etc.
• Kill processes
• List processes
• Log keystrokes
• Perform SYN and UDP floods
• Propagate itself via Windows Live Messenger
• Restart itself

However, as of this writing, the said sites are inaccessible.

Dropping Routine

This worm drops the following file(s), which it uses for its keylogging routine:

• %Program Files%\svchost.dat

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

HOSTS File Modification

This worm adds the following strings to the Windows HOSTS file:

• 127.0.0.1 avg.com
• 127.0.0.1 avp.com
• 127.0.0.1 ca.com
• 127.0.0.1 customer.symantec.com
• 127.0.0.1 dispatch.mcafee.com
• 127.0.0.1 download.mcafee.com
• 127.0.0.1 f-secure.com
• 127.0.0.1 kaspersky-labs.com
• 127.0.0.1 kaspersky.com
• 127.0.0.1 liveupdate.symantec.com
• 127.0.0.1 liveupdate.symantecliveupdate.com
• 127.0.0.1 mast.mcafee.com
• 127.0.0.1 mcafee.com
• 127.0.0.1 my-etrust.com
• 127.0.0.1 nai.com
• 127.0.0.1 networkassociates.com
• 127.0.0.1 rads.mcafee.com
• 127.0.0.1 scanner.novirusthanks.org
• 127.0.0.1 secure.nai.com
• 127.0.0.1 securityresponse.symantec.com
• 127.0.0.1 sophos.com
• 127.0.0.1 symantec.com
• 127.0.0.1 threatexpert.com
• 127.0.0.1 trendmicro.com
• 127.0.0.1 update.symantec.com
• 127.0.0.1 updates.symantec.com
• 127.0.0.1 us.mcafee.com
• 127.0.0.1 virscan.org
• 127.0.0.1 viruslist.com
• 127.0.0.1 virusscan.jotti.org
• 127.0.0.1 virustotal.com
• 127.0.0.1 www.avp.com
• 127.0.0.1 www.avg.com
• 127.0.0.1 www.ca.com
• 127.0.0.1 www.f-secure.com
• 127.0.0.1 www.grisoft.com
• 127.0.0.1 www.kaspersky.com
• 127.0.0.1 www.mcafee.com
• 127.0.0.1 www.my-etrust.com
• 127.0.0.1 www.nai.com
• 127.0.0.1 www.networkassociates.com
• 127.0.0.1 www.sophos.com
• 127.0.0.1 www.symantec.com
• 127.0.0.1 www.trendmicro.com
• 127.0.0.1 www.virscan.org
• 127.0.0.1 www.viruslist.com
• 127.0.0.1 www.virusscan.jotti.org
• 127.0.0.1 bitdefender.com
• 127.0.0.1 macafee.com
• 127.0.0.1 microsoft.com
• 127.0.0.1 nod32.com
• 127.0.0.1 norton.com
• 127.0.0.1 pandasoftware.com
• 127.0.0.1 www.download.mcafee.com
• 127.0.0.1 www.hotmail.com
• 127.0.0.1 www.kaspersky-labs.com
• 127.0.0.1 www.macafee.com
• 127.0.0.1 www.microsoft.com
• 127.0.0.1 www.nod32.com
• 127.0.0.1 www.norton.com
• 127.0.0.1 www.pandasoftware.com
• 127.0.0.1 www.virustotal.com

NOTES:

It drops copies of itself as DC201008.JPG.exe into folders used in peer-to-peer networks.