Analysis by: Adrianne Chester Camat
ALIASES:

Win32/AutoRun.Agent.DL (NOD32)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This worm arrives via removable drives. It arrives by accessing affected shared networks. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

It drops copies of itself in all removable and physical drives found in the system. It propagates via shared networks and drops copies of itself into available networks. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

Arrival Details

This worm arrives via removable drives.

It arrives by accessing affected shared networks.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

  • %User Profile%\svchost.exe
  • %System%\drivers\services.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
[system] = "%System%\drivers\services.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
winlogon = "%User Profile%\svchost.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
[system] = "%System%\drivers\services.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
winlogon = "%User Profile%\svchost.exe"

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

Propagation

This worm drops copies of itself in all removable and physical drives found in the system.

It propagates via shared networks and drops copies of itself into available networks.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This worm connects to the following possibly malicious URL:

  • http://{BLOCKED}life.info