Virus.Win32.LOOKED.AA

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It injects its dropped file/component to specific processes.

It prepends its codes to target files. It infects certain file types by inserting code in the said files.

It does not have any backdoor routine.

As of this writing, the said sites are inaccessible.

It does not have any information-stealing capability.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus adds the following folders:

• %Windows%\uninstall\

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %Windows%\uninstall\rundl132.exe
• If an infected file is executed:
  • %Windows%\Logo1_.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• If an infected file is executed:
  • cmd /c %User Temp%\{temp filename].bat
  • %Windows%\Logo1_.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It injects its dropped file/component to the following processes:

• explorer.exe
• iexplore.exe

Autostart Technique

This Virus adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
load = %Windows%\uninstall\rundl132.exe

Other System Modifications

This Virus adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Soft\
DownloadWWW
auto = 1

File Infection

This Virus prepends its codes to target files.

It searches for target files in the following drives:

• C to Z (Fixed drives only)

It infects files with the following file extensions by inserting code in the said files:

• .EXE

It avoids infecting folders containing the following strings:

• system
• system32
• windows
• Documents and Settings
• System Volume Information
• Recycled
• winnt
• Program Files\Windows NT
• Program Files\WindowsUpdate
• Program Files\Windows Media Player
• Program Files\Outlook Express
• Program Files\Internet Explorer
• Program Files\ComPlus Applications
• Program Files\NetMeeting
• Program Files\Common Files
• Program Files\Messenger
• Program Files\InstallShield Installation Information
• Program Files\Microsoft Frontpage
• Program Files\Movie Maker
• Program Files\MSN Gaming Zone

Backdoor Routine

This Virus does not have any backdoor routine.

Rootkit Capabilities

This Virus does not have rootkit capabilities.

Process Termination

This Virus terminates the following services if found on the affected system:

• Kingsoft AntiVirus Service

It terminates the following processes if found running in the affected system's memory:

• EGHOST.EXE
• IPARMOR.EXE
• KAVPFW.EXE
• KRegEx.exe
• KVMonXP.KXP
• KVXP.KXP
• MAILMON.EXE
• mcshield.exe
• RavMon.exe
• Ravmond.EXE
• regsvc.exe

Dropping Routine

This Virus drops the following files:

• %System Root%\_desktop.ini → contains date of infection
• %Windows%\RichDll.dll → detected as TROJ_LOOKED.ACM
• If an infected file is executed:
  • %User Temp%\{temp filename].bat → replaces infected file with original(uninfected) file

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Download Routine

This Virus connects to the following URL(s) to download its component file(s):

• http://ad.{BLOCKED}u.com/bt1.exe
• http://ad.{BLOCKED}u.com/bt2.exe
• http://ad.{BLOCKED}u.com/bt3.exe
• http://ad.{BLOCKED}u.com/bt4.exe
• http://ad.{BLOCKED}u.com/bt5.exe
• http://ad.{BLOCKED}u.com/bt6.exe
• http://ad.{BLOCKED}u.com/bt7.exe
• http://ad.{BLOCKED}u.com/bt8.exe
• http://ad.{BLOCKED}u.com/bt9.exe
• http://ad.{BLOCKED}u.com/bta.exe
• http://ad.{BLOCKED}u.com/btb.exe
• http://ad.{BLOCKED}u.com/btc.exe
• http://ad.{BLOCKED}u.com/btd.exe
• http://ad.{BLOCKED}u.com/bte.exe
• http://ad.{BLOCKED}u.com/btf.exe
• http://ad.{BLOCKED}u.com/btg.exe
• http://ad.{BLOCKED}u.com/bth.exe
• http://ad.{BLOCKED}u.com/bti.exe

As of this writing, the said sites are inaccessible.

Information Theft

This Virus does not have any information-stealing capability.

Other Details

This Virus adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Soft

HKEY_LOCAL_MACHINE\Software\Soft\
DownloadWWW

It does the following:

• It prioritizes infection on the following executables:
  • ACDSee4.exe
  • ACDSee5.exe
  • ACDSee6.exe
  • AgzNew.exe
  • Archlord.exe
  • AutoUpdate.exe
  • autoupdate.exe
  • BNUpdate.exe
  • Datang.exe
  • editplus.exe
  • EXCEL.EXE
  • flashget.exe
  • foxmail.exe
  • FSOnline.exe
  • GameClient.exe
  • install.exe
  • jxonline_t.exe
  • launcher.exe
  • lineage.exe
  • LineageII.exe
  • MHAutoPatch.exe
  • Mir.exe
  • msnmsgr.exe
  • Mu.exe
  • my.exe
  • NATEON.exe
  • NSStarter.exe
  • Patcher.exe
  • patchupdate.exe
  • QQ.exe
  • Ragnarok.exe
  • realplay.exe
  • run.exe
  • setup.exe
  • Silkroad.exe
  • Thunder.exe
  • ThunderShell.exe
  • TTPlayer.exe
  • Uedit32.exe
  • Winrar.exe
  • WINWORD.EXE
  • woool.exe
  • zfs.exe
• It then infects all executables in directories and subdirectories that do not have any of the executables.
• This malware attempts to propagate via network shares. It uses administrator as its user name to gain access to the following default shares:
  • ADMIN$
  • IPC$
• It closes window(s) related to the following processes:
  • avp.exe
  • RavMon.exe

NOTES:

It does not exploit any vulnerability.