WORM_RIMECUD.AH

This worm can propagate through P2P applications.

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\RECYCLER\{SID}\MsMxEng.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following non-malicious files:

• %System Root%\RECYCLER\{SID}\Desktop.ini

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RECYCLER\{SID}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = %SystemRoot%\RECYCLER\{SID}\MsMxEng.exe

Other System Modifications

This worm sets the attributes of the following files:

• Hidden
• System
• Read Only

Propagation

This worm creates the following folders in all removable drives:

• {random folder}

It drops copies of itself into the following folders used in peer-to-peer (P2P) networks:

• Ares
• Kazaa
• BearShare
• iMesh
• Shareaza
• DC++
• Emule
• LimeWire

It drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
OPen={folder name}\{filename}.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files using Windows Explorer
UsEaUtOpLaY=1
SHElL\opeN\coMmand={folder name}\{filename}.exe
shell\explore\command={folder name}\{filename}.exe
SHeLl\opEN=Open

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following command(s) from a remote malicious user:

• Spread via shared folders, USB drives, MSN Messenger and P2P networks
• Perform DoS attacks using SYN flooding
• Download and execute files from a remote server

It connects to the following websites to send and receive information:

• {BLOCKED}lmind.cn