WORM_RIMECUD.MAN
Windows 2000, WIndows XP, Windows Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This worm arrives via removable drives. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
TECHNICAL DETAILS
Arrival Details
This worm arrives via removable drives.
It may be dropped by other malware.
It may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This worm drops the following files depending on the platform/operating system of the affected computer:
- %User Profile%\vppg.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profiles%\vppg.exe"
Propagation
This worm drops the following copy(ies) of itself in all removable drives:
- joksam\guidence.exe
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
Other Details
This worm connects to the following possibly malicious URL:
- http://{BLOCKED}afehousenumber.com
- http://{BLOCKED}ortal-protection.net.ru
- http://{BLOCKED}ickstudio.ru
- http://{BLOCKED}.cocolands.su