WORM_VB.IWL

It creates a copy itself and replaces the legitimate Microsoft file SERVICES.EXE, which is responsible for interacting with system services. This file automatically executes at system startup. It replaces this legitimate file to enable its automatic execution at system startup.

This worm arrives by connecting affected removable drives to a system. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops and executes the following files:

• %System%\winm.dll - detected as TSPY_KEYLOGGER.AB

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\ .cmd

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other System Modifications

This worm also creates the following registry entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.exe
@ = exefile

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile
@ = aplicación

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile\DefaultIcon
@ = shell32.dll,2

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• rundll.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=.\rundll c
shellexecute=.\rundll c
action=Explorar
icon=%SystemRoot%\system32\SHELL32.dll,8
shell=usbmenu
shell\usbmenu\command=.\rundll .\c
shell\usbmenu\icon=%SystemRoot%\system32\SHELL32.dll,8
shell\usbmenu=Explorar

Dropping Routine

This worm executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This worm does the following:

• It creates a copy itself as %System%\services.exe.
• It replaces the legitimate Microsoft file SERVICES.EXE, which is responsible for interacting with system services. This file automatically executes at system startup. It replaces this legitimate file to enable its automatic execution at system startup.

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)