WORM_AUTORUN.MKB

This worm arrives via removable drives.

It modifies registry entries to hide files with System and Read-only attributes.

It drops copies of itself into all the removable drives connected to an affected system. It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\winxp1\winlogon.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\winxp1

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NVIDIA Media Center Library = %User Profile%\winxp1\winlogon.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NVIDIA Media Center Library = %User Profile%\winxp1\winlogon.exe

It drops the following files:

• %User Profile%\winxp1\VERSION.TXT

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other System Modifications

This worm modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Local Page = http://9-y-0-f-n-w-c-m-d-y-g-c-4-e-o-9-4-x-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://p-e-7-j-7-b-t-1-g-w-9-3-3-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Search Page = http://g-q-4-v-h-6-k-y-x-5-0-9-l-2-e-v-5-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = http://6-p-4-l-y-f-v-1-9-g-3-l-8-3-t-z-7-7-i-8-s-a-e-b-5-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = http://7-6-9-l-u-f-9-3-4-g-i-w-5-9-c-3-u-r-5-8-q-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Search Page = http://n-d-2-3-9-b-6-9-s-v-z-9-6-c-u-n-z-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Local Page = http://4-1-z-d-1-v-q-g-u-4-9-u-5-o-h-8-u-k-a-k-k-5-y-e-s-2-5-7-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info

(Note: The default value data of the said registry entry is hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,62,6c,61,6e,6b,2e,68,74,6d,00, .)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Start Page = http://w-8-5-f-r-8-0-2-p-x-2-6-7-p-f-n-n-9-2-o-9-9-8-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info

(Note: The default value data of the said registry entry is about:blank.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr
Start = 4

(Note: The default value data of the said registry entry is 0.)

It also creates the following registry entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
Windows\CurrentControlSet
IP = 120.89.55.3

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Default_Search_URL = http://3-7-7-i-0-6-n-8-6-5-0-d-5-q-e-m-m-9-6-4-9-c-v-0-w-3-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Default_Page_URL = http://o-g-5-8-9-u-s-6-1-9-l-j-a-7-7-1-2-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = 0

It modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 3

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself into all the removable drives connected to an affected system.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open={random name}\S-4-7-01-4639107401-44944991267-104113574-7046\{random name}.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Abir la carpeta para ver los archivos
shell\open=Open
shell\open\command={random name}\S-4-7-01-4639107401-44944991267-104113574-7046\{random name}.exe
shell\open\default=1
shell\open\defauilt=1