Arrival Details
This worm arrives by connecting affected removable drives to a system.
It arrives by accessing affected shared networks.
Installation
This worm drops the following copies of itself into the affected system:
- %drive%\{random numbers}.vbs
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\
explore\command
@ = "%SystemRoot%\System32\WScript.exe "%WINDOWS%\explorer.exe:{random numbers}.vbs" EMC"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\
open\command
@ = "%SystemRoot%\System32\WScript.exe "%WINDOWS%\explorer.exe:{random numbers}.vbs" EMC"
It modifies the following registry entries to ensure it automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%SystemRoot%\system\svchost.exe "%WINDOWS%\system32\smss.exe:{random numbers}.vbs""
(Note: The default value data of the said registry entry is "".)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\iexplore.exe\shell\
open\command
@ = "%SystemRoot%\System32\WScript.exe "%WINDOWS%\explorer.exe:{random numbers}.vbs" OIE"
(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" %1 .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
batfile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is "%1" %* .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
chm.file\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is "%WINDOWS%\hh.exe" %1 .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
cmdfile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is "%1" %* .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
hlpfile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is %SystemRoot%\System32\winhlp32.exe %1 .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
inffile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is %SystemRoot%\System32\NOTEPAD.EXE %1 .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
inifile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is %SystemRoot%\System32\NOTEPAD.EXE %1 .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
regfile\shell\open\
command
@ = "%SystemRoot%\System32\WScript.exe ""%WINDOWS%\explorer.exe:{random numbers}.vbs" %1 %*""
(Note: The default value data of the said registry entry is regedit.exe "%1" .)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell
@ = ""
(Note: The default value data of the said registry entry is none.)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\
OpenHomePage\Command
@ = "%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:1330456861.vbs" OIE"
(Note: The default value data of the said registry entry is %Program Files%\Internet Explorer\iexplore.exe .)
Other System Modifications
This worm modifies the following registry entries to hide files with Hidden attributes:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
CheckedValue = "3"
(Note: The default value data of the said registry entry is 2.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "2"
(Note: The default value data of the said registry entry is 1.)
Propagation
This worm drops the following copy(ies) of itself in all removable drives:
It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.
It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
The said .INF file contains the following strings:
[AutoRun]
Shellexecute=WScript.exe {random numbers}.vbs "AutoRun"
shell\open={random characters}
shell\open\command=WScript.exe {random numbers}.vbs "AutoRun"
shell\open\Default=1
shell\explore={random characters}
shell\explore\command=WScript.exe {random numbers}.vbs "AutoRun"
Dropping Routine
This worm sets the attributes of its dropped file(s) to the following:
NOTES:
Dropping Routine
This worm sets the attributes of its dropped file(s) to the following:
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Identify and terminate files detected as VBS_AUTORUN.ACE
[ Learn More ]
[ back ]
- If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
- If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.
To terminate the malware/grayware process:
- Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
- Open Windows Task Manager.
• For Windows 2000, XP, and Server 2003 users, press
CTRL+SHIFT+ESC, then click the Processes tab. - In the list of running programs, locate a malware/grayware/spyware file detected earlier.
- Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
- Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
- To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
- Close Task Manager.
Step 3
Restore this modified registry value
[ Learn More ]
[ back ]
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer"s registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- From: load = ”%SystemRoot%\system\svchost.exe %WINDOWS%\system32\smss.exe:{random numbers}.vbs"
To: ""
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs OIE"
To: "%Program Files%\Internet Explorer\iexplore.exe %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%1 %*"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%WINDOWS%\hh.exe %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%1 %*"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%SystemRoot%\System32\winhlp32.exe %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%SystemRoot%\System32\NOTEPAD.EXE %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "%SystemRoot%\System32\NOTEPAD.EXE %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
- From: @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
To: "regedit.exe %1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
- From: @ = "%SystemRoot%\System32\WScript.exe C:\WINDOWS\explorer.exe:1330456861.vbs OIE"
To: "%Program Files%\Internet Explorer\iexplore.exe"
To stop the malware/grayware/spyware from running when certain files are opened:
- Open the Run... window. To do this, click Start>Run.
- In the Open input box, type:
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com - Press Enter. This opens Registry Editor.
- In the left panel of the Registry Editor window, double-click the following:
- HKEY_CURRENT_USER>Software>Microsoft>Windows NT>CurrentVersion>Windows
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Applications>iexplore.exe>shell>open>command "
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>batfile>shell>open>command
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>chm.file>shell>open>command
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>cmdfile>shell>open>command
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>hlpfile>shell>open>command "
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>inffile>shell>open>command "
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>inifile>shell>open>command
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>regfile>shell>open>command
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{20D04FE0-3AEA-1069-A2D8-08002B30309D}>shell
- HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{871C5380-42A0-1069-A2EA-08002B30309D}>shell>OpenHomePage>Command
- In the right panel, locate the registry value:
Default - Check whether its value data is the path and file name of the malware/grayware/spyware file.
- If the value data is the malware/grayware/spyware file, right-click the Default key and choose Modify to change its value.
- In the Value data input box, delete the existing value and type the default value:
%1 %* - Repeat this procedure for the following registry key(s):
- load = "%SystemRoot%\system>svchost.exe %WINDOWS%\system32>smss.exe:{random numbers}.vbs"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs OIE"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs %1 %*"
- @ = ""
- @ = "%SystemRoot%\System32>WScript.exe C:>WINDOWS>explorer.exe:1330456861.vbs OIE"
- Close Registry Editor.
- Click Start>Run, then type:
command /c del regedit.com - Press Enter.
Step 4
Delete this registry value
[ Learn More ]
[ back ]
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\explore\command
- @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs EMC"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command
- @ = "%SystemRoot%\System32\WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs EMC"
To delete the registry value this malware/grayware created:
- Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
- In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{20D04FE0-3AEA-1069-A2D8-08002B30309D}>shell>explore>command - In the right panel, locate and delete the entry:
@ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs EMC" - In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{20D04FE0-3AEA-1069-A2D8-08002B30309D}>shell>open>command - In the right panel, locate and delete the entry:
@ = "%SystemRoot%\System32>WScript.exe %WINDOWS%\explorer.exe:{random numbers}.vbs EMC" - Close Registry Editor.
Step 5
Restore this modified registry value
[ Learn More ]
[ back ]
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN
- From: CheckedValue = "3"
To: "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
- From: CheckedValue = "2"
To: "1"
To restore the registry value this malware/grayware modified:
- Open Registry Editor. Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
- In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>NOHIDDEN - In the right panel, locate the registry value:
CheckedValue = "3" - Right-click on the value name and choose Modify. Change the value data of this entry to:
CheckedValue = "2" - In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL - In the right panel, locate the registry value:
CheckedValue = "2" - Right-click on the value name and choose Modify. Change the value data of this entry to:
CheckedValue = "1" - Close Registry Editor.
Step 6
Search and delete AUTORUN.INF files created by VBS_AUTORUN.ACE that contain these strings
[ Learn More ]
[ back ]
[AutoRun]
Shellexecute=WScript.exe {random numbers}.vbs AutoRun
shell\open={random characters}
shell\open\command=WScript.exe {random numbers}.vbs AutoRun
shell\open\Default=1
shell\explore={random characters}
shell\explore\command=WScript.exe {random numbers}.vbs AutoRun
To identify and delete AUTORUN.INF files created:
- Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
- In the Named input box, type:
AUTORUN.INF - In the Look in: drop-down list, select a drive, then press Enter.
- Select the file, then open using Notepad.
- Check if the following lines are present in the file:
[AutoRun]
Shellexecute=WScript.exe {random numbers}.vbs AutoRun
shell\open={random characters}
shell\open\command=WScript.exe {random numbers}.vbs AutoRun
shell\open\Default=1
shell\explore={random characters}
shell\explore\command=WScript.exe {random numbers}.vbs AutoRun
- If the lines are present, delete the file.
- Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
- Close Search Results.
Step 7
Scan your computer with your Trend Micro product to delete files detected as VBS_AUTORUN.ACE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.