WORM_ONLING.IF

This worm arrives by connecting affected removable drives to a system. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites. However, as of this writing, the said sites are inaccessible.

It may be injected into processes running in memory.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It steals sensitive information such as user names and passwords, particularly for certain games. Stolen information may be used for profit by cybercriminals who may gain access to the information.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

However, as of this writing, the said sites are inaccessible.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\mmvo.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following file(s)/component(s):

• %System%\mmvo0.dll - also detected as WORM_ONLING.IF
• kavo0.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It may be injected into processes running in memory.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mmva = %System%\mmvo.exe

Other System Modifications

This worm modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself in all removable and physical drives found in the system.

It drops the following copy of itself in all physical and removable drives:

• p3th8wb.cmd

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage}
[AutoRun]
;{garbage}
open=p3th8wb.cmd
;{garbage}
shell\\open\\Command=p3th8wb.cmd
;{garbage}
shell\\open\\Default=1
;{garbage}
shell\\explore\\Command=p3th8wb.cmd
;{garbage}

Download Routine

This worm accesses the following websites to download files:

• http://{BLOCKED}g.com/rbv/uu.rar

Information Theft

This worm steals sensitive information such as user names and passwords, particularly for certain games.

Other Details

This worm does the following:

• Steals online game credentials by injecting its dropped .DLL component file, kavo0.dll, into several processes to monitor the following online game applications/processes:
  
  • pol.exe
  • coc.exe
  • Ragnarok
  • Forthgoer
  • Lineage
• Attempts to steal information from the following files if present on the affected system:
  
  • aaa.dat
• Attempts to capture Yahoo! account login credentials whenever the following URLs are accessed:
  
  • https://login.yahoo.co.jp/config/login_verify2?.src=ym
  • https://login.yahoo.co.jp/config/login?
• Sends the gathered information to any of the following remote sites:
  
  • {BLOCKED}.{BLOCKED}.235.228
  • {BLOCKED}.{BLOCKED}.235.227
  • {BLOCKED}.{BLOCKED}.235.226
  • {BLOCKED}.{BLOCKED}.235.229
• Attempts to terminate services associated with the following antivirus product:
  
  • Kaspersky