WORM_VB.WMG

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds registry entries to enable its automatic execution at every system startup.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\{random filename}.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(default) = "%Windows%\{random filename}.exe"

Other System Modifications

This worm adds the following registry entries:

HKEY_CLASSES_ROOT\exefile
NeverShowExt =

It modifies the following registry entries:

HKEY_CLASSES_ROOT\exefile
(default) = "File Folder"

(Note: The default value data of the said registry entry is Application.)

HKEY_CLASSES_ROOT\exefile
TileInfo = "prop:"

(Note: The default value data of the said registry entry is prop:FileDescription;Company;FileVersion.)

HKEY_CLASSES_ROOT\exefile
InfoTip = "prop:"

(Note: The default value data of the said registry entry is prop:FileDescription;Company;FileVersion;Create;Size.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• cmd.exe

Other Details

This worm does the following:

• Searches for folders in the following locations then drops copies of itself as {folder name}.EXE:
  • physical drives
  • removable drives
  • C:\Documents and Settings\All Users\Documents
  • %Desktop%
  • %User Profile%\My Documents
• However, it does not create a copy of itself if the folder's name is the following: system volume information

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)