WORM_BUZUS.DF

It drops copies of itself into the shared folders of certain peer-to-peer (P2P) networks.

It executes command(s) from a remote malicious user.

This worm arrives via peer-to-peer (P2P) shares. It arrives via removable drives. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It receives commands from a server that may be controlled by a bot or a malicious user.

Arrival Details

This worm arrives via peer-to-peer (P2P) shares.

It arrives via removable drives.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following component file(s):

• {drive letter}:\Empty\Desktop.ini
• %System Root%\RECYCLER\{SID}\Desktop.ini

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\RECYCLER\{SID}\mwau.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects itself into the following processes as part of its memory residency routine:

• Explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = %System Root%\RECYCLER\{SID}\mwau.exe

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\Empty

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\Empty\autorun.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage codes}
;{garbage codes}
[autorun
;{garbage codes}
open=Empty/autorun.exe
;{garbage codes}
action=Open folder to view files using Windows Explorer
;{garbage codes}
shell\open\command=Empty/autorun.exe
;{garbage codes}
shell\explore\command=Empty/autorun.exe
;{garbage codes}
useautoplay=1
;{garbage codes}
:GOTO END

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• MSN Messenger

Backdoor Routine

This worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}r1.unibaq.com

Other Details

This worm does the following:

• It drops copies of itself into the shared folders of the following peer-to-peer (P2P) networks:
  
  • Ares
  • BearShare
  • iMesh
  • Shareaza
  • Kazaa
  • DC++
  • eMule
  • LimeWire
• It executes the following command(s) from a remote malicious user:
  
  • Download other malware
  • Update itself
  • Launch Denial of Service (DoS) attacks against target systems

Denial of Service

This worm receives commands from a server that may be controlled by a bot or a malicious user.