WORM_UTOTI.KDX

It also drops a non-malicious file in all physical, shared and removable drives named KHW.

This worm arrives by connecting affected removable drives to a system. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It propagates via shared networks and drops copies of itself into available networks.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

• %System%\csrcs.exe - copy of itself
• %System%\autorun.in - copy of autorun.inf
• %System%\autorun.i - copy of autorun.inf

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
csrcs = %System%\csrcs.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
csrcs = %System%\csrcs.exe

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe csrcs.exe

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This worm adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

File Infection

This worm propagates via shared networks and drops copies of itself into available networks.

Propagation

This worm drops the following copies of itself in all physical and removable drives:

• {random name}.exe

It uses the following file names for the copies it drops into shared networks:

• {random name}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage}
[AUtoRun]
sHEll\OPeN\DeFault=1
;{garbage}
ActiOn=View files
USEauTOPLay=1
ICon=%sysTeM%\ShELL32.dLl,7
ShEll\OpEN\cOMMANd={malware file name}.exe
;{garbage}
actION= @{malware file name}.exe
;{garbage}
oPEN={malware file name}.exe
;{garbage}

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It connects to the following websites to send and receive information:

• http://www.{BLOCKED}d8.com/xny.htm
• http://{BLOCKED}e.extasix.com/eny.htm
• http://{BLOCKED}y.myhome.cx/kny.htm
• http://www.{BLOCKED}f4.com.cn/zny.htm

Information Theft

This worm gathers the following information on the affected computer:

• User Name
• Computer Name
• OS Version
• OS Service Pack
• Home Drive
• Drive Serial
• OS Language
• System Directory

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://www.whatismyip.com/automation/n09230945.asp
• http://checkip.dyndns.org

It does the following:

• It also drops a non-malicious file in all physical, shared and removable drives named KHW.