WORM_PROLACO.XWQ

 Analysis by: Roland Marco Dela Paz
 Modified by: Michael Cabel

 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This worm arrives as attachment to mass-mailed email messages. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system. It sends copies of itself as attachments to email messages using Microsoft Outlook Visual Basic for Applications (VBA).

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It sends gathered information to a predetermined email address using its own Simple Mail Transfer Protocol (SMTP) engine.

  TECHNICAL DETAILS

Ports:

Random

File Size:

Varies

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

19 Oct 2010

Arrival Details

This worm arrives as attachment to mass-mailed email messages.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

  • %system%\foxit.exe - detected as TROJ_HILOTI.XWG

It drops the following component file(s):

  • %WINDOWS%\statcvs.exe - also detected as WORM_PROLACO.XWQ
  • %application data%\statcvs.exe - also detected as WORM_PROLACO.XWQ
  • %system%\NvTaskbarInh.exe - - copy of itself
  • %system%\statcvs.exe - also detected as WORM_PROLACO.XWQ

It injects codes into the following process(es):

  • explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
IDT PC Audio = %WINDOWS%\statcvs.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Nvidia Control Center3 = %system%\NvTaskbarInh.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IDT PC Audio = %WINDOWS%\statcvs.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{N5DKJK5H-5XG7-8421-4V52-B1QQ0LF833CU}
StubPath = %WINDOWS%\statcvs.exe""

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER
@ = H1UYEEMA[QRs}`{avx'ktn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
DeleteFlag = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
DeleteFlag = 1

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = 24

(Note: The default value data of the said registry entry is 21.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cookies = C:\Documents and Settings\NetworkService\Cookies

(Note: The default value data of the said registry entry is C:\Documents and Settings\LocalService\Cookies.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cache = C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files

(Note: The default value data of the said registry entry is C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
History = C:\Documents and Settings\NetworkService\Local Settings\History

(Note: The default value data of the said registry entry is C:\WINDOWS\system32\config\systemprofile\Local Settings\History.)

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components
{N5DKJK5H-5XG7-8421-4V52-B1QQ0LF833CU} =

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%system%\\NvTaskbarInh.exe = %system%\NvTaskbarInh.exe:*:Enabled:Explorer

Propagation

This worm creates the following folders in all removable drives:

  • RECYCLER\{SID}

It drops the following copy(ies) of itself in all removable drives:

  • redmond.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=RECYCLER\{SID}\redmond.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLER\{SID}\redmond.exe
shell\open\default=1

It gathers target email addresses from files with the following extensions:

  • txt
  • htm
  • xml
  • php
  • asp
  • dbx
  • log
  • nfo
  • lst
  • rtf
  • xml
  • wpd
  • wps
  • xls
  • doc
  • wab

It sends copies of itself as attachments to email messages using Microsoft Outlook Visual Basic for Applications (VBA).

It avoids sending email messages to addresses containing the following strings:

  • .mil
  • abuse
  • acd-group
  • acdnet.com
  • acdsystems.com
  • acketst
  • admin
  • ahnlab
  • alcatel-lucent.com
  • anyone
  • apache
  • arin.
  • avg-comsysinternals
  • avira
  • badware
  • berkeley
  • bitdefender
  • bluewin.ch
  • borlan
  • bpsoft.com
  • bsd
  • bugs
  • buyrar.com
  • ca
  • certific
  • cisco
  • clamav
  • contact
  • debian
  • drweb
  • eset.com
  • example
  • f-secure
  • fido
  • firefox
  • fsf.
  • ghisler.com
  • gimp
  • gnu
  • gold-certs, gov.
  • help
  • honeynet
  • honeypot
  • iana
  • ibm.com
  • icrosoft
  • idefense
  • ietf
  • ikarus
  • immunityinc.com
  • info
  • inpris
  • isc.o
  • isi.e
  • jgsoft
  • kaspersky
  • kernel
  • lavasoft
  • linux
  • listserv
  • mcafee
  • messagelabs
  • mit.e
  • mozilla
  • mydomai
  • nobody
  • nodomai
  • noone
  • nothing
  • novirusthanks
  • ntivi
  • nullsoft.org
  • page
  • panda
  • postmaster
  • prevx
  • privacy
  • qualys
  • quebecor.com
  • rating
  • redhat
  • rfc-ed
  • root
  • rusils
  • sales
  • samba
  • samples
  • secur
  • security
  • sendmail
  • service
  • site
  • slashdot
  • soft
  • somebody
  • somoeone
  • sopho
  • sourceforge
  • spam
  • spm
  • ssh.com
  • submit
  • sun.com
  • support
  • suse
  • syman
  • tanford.e
  • the.bat
  • unix
  • usenet
  • utgers.ed
  • virus
  • virusbuster
  • webmaster
  • websense
  • winamp
  • wincap
  • wireshark
  • www.ca.com

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Rootkit Capabilities

This worm also has rootkit capabilities, which enables it to hide its processes and files from the user.

Process Termination

This worm terminates the following services if found on the affected system:

  • APVXDWIN
  • AVG8_TRAY
  • AVP
  • AVP
  • AntiVirSchedulerService
  • Arrakis3
  • BDAgent
  • CAVRID
  • CSIScanner
  • CaCCProvSP
  • DrWebScheduler
  • ERSvc
  • Ehttpsrv
  • Emproxy
  • FPAVServer
  • GWMSRV
  • ISTray
  • K7EmlPxy
  • K7RTScan
  • K7SystemTray
  • K7TSMngr
  • K7TSStart
  • LIVESRV
  • MBAMService
  • MCNASVC
  • MPFSERVICE
  • MPS9
  • McENUI
  • MskAgentexe
  • PAVFNSVR
  • PAVPRSRV
  • PAVSVR
  • PSHOST
  • PSIMSVC
  • PSKSVCRETAIL
  • RSCCenter
  • RSRavMon
  • RavTask
  • SAVScan
  • SBAMTray
  • SCANINICIO
  • SUM
  • Savadminsrvice
  • Savservice
  • SpIDerMail
  • SpamBlocker
  • TPSRV
  • ThreatFire
  • VSSERV
  • WerSvc
  • WinDefend
  • XCOMM
  • antivirservice
  • avast!
  • avg8emc
  • avg8wd
  • bdss
  • ccEvtMgr
  • ccproxy
  • ccpwdsvc
  • ccsetmgr
  • cctray
  • egui
  • ekrn
  • liveupdate
  • mcODS
  • mcmisupdmgr
  • mcmscsvc
  • mcpromgr
  • mcproxy
  • mcredirector
  • mcshield
  • mcsysmon
  • msk80service
  • navapsvc
  • npfmntor
  • nscservice
  • sbamsvc
  • sbamui
  • scan
  • sdauxservice
  • sdcodeservice
  • sndsrvc
  • spbbcsvc
  • wscsvc
  • OfficeScanNT Monitor
  • Spam Blocker for Outlook Express
  • F-PROT Antivirus Tray application
  • Windows Defender
  • aswupdsv
  • avast! Antivirus
  • avast! Mail Scanner
  • avast! Web Scanner
  • McAfee HackerWatch Service
  • Norton AntiVirus
  • LiveUpdate Notice Service
  • Symantec Core LC
  • Sophos Autoupdate Service
  • Sophos Agent
  • Sophos Certification Manager
  • Sophos Management Service
  • Sophos Message Router
  • PANDA SOFTWARE CONTROLLER

It terminates the following processes if found running in the affected system's memory:

  • ALSvc.exe
  • APvxdwin.exe
  • AVENGINE.exe
  • AlMon.exe
  • CCenter.exe
  • FPAVServer.exe
  • FPWin.exe
  • FprotTray.exe
  • HWAPI.exe
  • K7EmlPxy.exe
  • K7RTScan.exe
  • K7SysTry.exe
  • K7TSMngr.exe
  • K7TSecurity.exe
  • McNASvc.exe
  • McProxy.exe
  • Mcshield.exe
  • MpfSrv.exe
  • NTRtScan.exe
  • PAVSRV51.exe
  • PSCtrlS.exe
  • PShost.exe
  • PavFnSvr.exe
  • PavPrSrv.exe
  • Pavbckpt.exe
  • PsIMSVC.exe
  • Rav.exe
  • RavMon.exe
  • RavStub.exe
  • RavTask.exe
  • RavmonD.exe
  • RedirSvc.exe
  • SavAdminService.exe
  • SavMain.exe
  • SavService.exe
  • SbeConsole.exe
  • SrvLoad.exe
  • TPSRV.exe
  • TmListen.exe
  • Webproxy.exe
  • ashdisp.exe
  • ashserv.exe
  • avcenter.exe
  • avciman.exe
  • avgcsrvx.exe
  • avgemc.exe
  • avgnt.exe
  • avgrsx.exe
  • avgtray.exe
  • avguard.exe
  • avgui.exe
  • avgwdsvc.exe
  • avp.exe
  • avp.exe
  • bdagent.exe
  • bdss.exe
  • ccsvchst.exe
  • drweb32w.exe
  • drwebupw.exe
  • egui.exe
  • ekrn.exe
  • emproxy.exe
  • guardgui.exe
  • iface.exe
  • isafe.exe
  • livesrv.exe
  • mbam.exe
  • mcagent.exe
  • mcmscsvc.exe
  • mcods.exe
  • mcpromgr.exe
  • mcsysmon.exe
  • mcvsshld.exe
  • mps.exe
  • mskagent.exe
  • msksrver.exe
  • pccnt.exe
  • prevx.exe
  • psksvc.exe
  • sbamtray.exe
  • sbamui.exe
  • seccenter.exe
  • spidergui.exe
  • vetmsg.exe
  • vsserv.exe
  • xcommsvr.exe

Dropping Routine

This worm executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Stolen Information

This worm sends gathered information to a predetermined email address using its own Simple Mail Transfer Protocol (SMTP) engine.

Other Details

Based on analysis of the codes, it has the following capabilities:

  • Creates the following registry to disable Windows User Account Controls notification:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
  • EnableLUA = 0
  • Modifies the following registry to disable System Restore:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
  • DisableSR = 1
  • Default value is 0.
  • Modifies the following registry to Windows Error Reporting Service:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
  • Start = 4
  • Default value is 2.
  • Modifies the following registry to Windows Security Center:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
  • Start = 4
  • Default value is 2.
  • Searches for MSI files in network drives and repackages the said files with a copy of itself. It does this by utilizing Windows Iexpress Wizard. The repackaged file when run, extracts and executes the original MSI file and the copy of this worm.
  • Checks the location of the Windows Address Book by querying the following registry key:
  • HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name

It attempts to access the following websites to download files, which are possibly malicious:

  • http:\\www.{BLOCKED}n.com
  • hxxp:\ww{BLOCKED}vine.net

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

7.552.07

FIRST VSAPI PATTERN DATE:

19 Oct 2010

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by WORM_PROLACO.XWQ

     TROJ_HILOTI.XWG

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %System%\NvTaskbarInh.exe = %System%\NvTaskbarInh.exe:*:Enabled:Explorer
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    • IDT PC Audio = %WINDOWS%\statcvs.exe
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Nvidia Control Center3 = %system%\NvTaskbarInh.exe
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • IDT PC Audio = %WINDOWS%\statcvs.exe
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
    • DeleteFlag= 1
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
    • DeleteFlag = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA = 0

Step 5

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.

 
  • In HKEY_CURRENT_USER\Software
    • Nvideo3
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Nvideo3
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
    • {N5DKJK5H-5XG7-8421-4V52-B1QQ0LF833CU}

Step 6

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
    • From: DisableSR = 1
      To: DisableSR = 0.
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
    • From: Start = 4
      To: Start = 2
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
    • From: Start = 4
      To: Start = Default value is 2.
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch
    • From: Epoch = 24
      To: Epoch = 21
  • In HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    • From: Cookies = C:\Documents and Settings\NetworkService\Cookies
      To: Cookies = C:\Documents and Settings\LocalService\Cookies
  • In HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    • From: Cache = C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files
      To: Cache = C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files
  • In HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    • From: History = C:\Documents and Settings\NetworkService\Local Settings\History
      To: History = C:\WINDOWS\system32\config\systemprofile\Local Settings\History

Step 7

Search and delete AUTORUN.INF files created by WORM_PROLACO.XWQ that contain these strings

[ Learn More ]
[AutoRun]
open=RECYCLER\{SID}\redmond.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLER\{SID}\redmond.exe
shell\open\default=1

Step 8

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result. [DRIVE]:\RECYCLER\{SID}

Step 9

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_PROLACO.XWQ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.

Related Malware