WORM_ESFURY.SMM

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies registry entries to hide files with System and Read-only attributes.

It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection. It modifies the user's Internet Explorer search page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\{User Name}1\winlogon.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\{User Name}1

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NVIDIA Media Center Library = "%User Profile%\{User Name}1\winlogon.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NVIDIA Media Center Library = "%User Profile%\{User Name}1\winlogon.exe"

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application name}
Debugger = ""%User Profile%\{User Name}1\winlogon.exe""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFile = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFolderOptions = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer
NoFolderOptions = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorAdmin = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
PromptOnSecureDesktop = "1"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Control Panel\Sound
Beep = "no"

(Note: The default value data of the said registry entry is "yes".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr
Start = "4"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

It modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "3"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Where {application name} may be any of the following:

• BullGuard.exe
• ChromeSetup.exe
• Diskmon.exe
• EHttpSrv.exe
• FPAVServer.exe
• Filemon.exe
• FirewallControlPanel.exe
• FirewallSettings.exe
• GenericRenosFix.exe
• GoogleToolbarInstaller_download_signed.exe
• HJTInstall.exe
• HostsChk.exe
• IEDFix.exe
• MSASCui.exe
• Netscape.exe
• Opera_964_int_Setup.exe
• Process.exe
• Procmon.exe
• Regmon.exe
• Restart.exe
• Safari.exe
• SmitfraudFix.exe
• SrchSTS.exe
• UCCLSID.exe
• UserAccountControlSettings.exe
• VACFix.exe
• WS2Fix.exe
• _avp.exe
• _avp32.exe
• _avpcc.exe
• _avpm.exe
• _findviru.exe
• a2servic.exe
• ackwin32.exe
• acs.exe
• advxdwin.exe
• agentsvr.exe
• agentw.exe
• ahnsd.exe
• alerter.exe
• alertsvc.exe
• alogserv.exe
• amon.exe
• amon9x.exe
• anti-trojan.exe
• antigen.exe
• antivirus.exe
• ants.exe
• apimonitor.exe
• aplica32.exe
• apvxdwin.exe
• ashWebSv.exe
• atcon.exe
• atguard.exe
• atro55en.exe
• atupdater.exe
• atwatch.exe
• aupdate.exe
• autodown.exe
• autotrace.exe
• autoupdate.exe
• avcenter.exe
• avconfig.exe
• avconsol.exe
• ave32.exe
• avgcc32.exe
• avgctrl.exe
• avgemc.exe
• avgnt.exe
• avgserv.exe
• avgserv9.exe
• avguard.exe
• avgw.exe
• avkpop.exe
• avkserv.exe
• avkservice.exe
• avkwcl9.exe
• avkwctl9.exe
• avnotify.exe
• avnt.exe
• avp.exe
• avp32.exe
• avpcc.exe
• avpdos32.exe
• avpexec.exe
• avpinst.exe
• avpm.exe
• avpmon.exe
• avpnt.exe
• avptc32.exe
• avpupd.exe
• avrescue.exe
• avscanavshadow.exe
• avsched32.exe
• avsynmgr.exe
• avupgsvc.exe
• avwebloader.exe
• avwin95.exe
• avwinnt.exe
• avwsc.exe
• avwupd32.exe
• avxmonitor9x.exe
• avxmonitornt.exe
• avxquar.exe
• avxw.exe
• azonealarm.exe
• bd_professional.exe
• bidef.exe
• bidserver.exe
• bipcp.exe
• bipcpevalsetup.exe
• bisp.exe
• blackd.exe
• blackice.exe
• boot.exe
• bootwarn.exe
• borg2.exe
• bs120.exe
• callmsi.exe
• ccapp.exe
• ccevtmgr.exe
• cclaw.exe
• ccpxysvc.exe
• ccsetmgr.exe
• ccshtdwn.exe
• cdp.exe
• cfgwiz.exe
• cfiadmin.exe
• cfiaudit.exe
• cfind.exe
• cfinet.exe
• cfinet32.exe
• chrome.exe
• clamauto.exe
• claw95.exe
• claw95cf.exe
• claw95ct.exe
• clean.exe
• cleaner.exe
• cleaner3.exe
• cleanpc.exe
• cmd.exe
• cmgrdian.exe
• cmon016.exe
• connectionmonitor.exe
• consent.exe
• cpd.exe
• cpdclnt.exe
• cpf.exe
• cpf9x206.exe
• cpfnt206.exe
• crashreporter.exe
• csinject.exe
• csinsm32.exe
• css1631.exe
• ctrl.exe
• cv.exe
• cwnb181.exe
• cwntdwmo.exe
• defalert.exe
• defscangui.exe
• defwatch.exe
• deputy.exe
• doors.exe
• dpf.exe
• drvins32.exe
• drwatson.exe
• drweb32.exe
• dumphive.exe
• dv95.exe
• dv95_o.exe
• dvp95.exe
• dvp95_0.exe
• earthagent.exe
• ecengine.exe
• ecls.exe
• ecmd.exe
• edi.exe
• efinet32.exe
• efpeadm.exe
• egui.exe
• ekrn.exe
• ent.exe
• esafe.exe
• escanh95.exe
• escanhnt.exe
• escanv95.exe
• espwatch.exe
• etrustcipe.exe
• evpn.exe
• ewido.exe
• exantivirus-cnet.exe
• exit.exe
• expert.exe
• explored.exe
• f-agnt95.exe
• f-prot.exe
• f-prot95.exe
• f-stopw.exe
• fa-setup.exe
• fact.exe
• fameh32.exe
• fast.exe
• fch32.exe
• fih32.exe
• findviru.exe
• firefox.exe
• firewall.exe
• fix-it.exe
• flowprotector.exe
• fnrb32.exe
• fp-win.exe
• fp-win_trial.exe
• fprot.exe
• fprot95.exe
• frw.exe
• fsaa.exe
• fsav.exe
• fsav32.exe
• fsav530stbyb.exe
• fsav530wtbyb.exe
• fsav95.exe
• fsave32.exe
• fsgk32.exe
• fslaunch.exe
• fsm32.exe
• fsma32.exe
• fsmb32.exe
• fssm32.exe
• fwenc.exe
• fwinstall.exe
• gbmenu.exe
• gbpoll.exe
• generics.exe
• gibe.exe
• gpedit.exe
• guard.exe
• guarddog.exe
• guardgui.exe
• guardhlp.exe
• hacktracersetup.exe
• helper.exe
• htlog.exe
• hwpe.exe
• iamapp.exe
• iamserv.exe
• iamstats.exe
• ibmasn.exe
• ibmavsp.exe
• icload95.exe
• icloadnt.exe
• icmon.exe
• icmoon.exe
• icssuppnt.exe
• icsupp.exe
• icsupp95.exe
• icsuppnt.exe
• iface.exe
• ifw2000.exe
• iomon98.exe
• iparmor.exe
• iris.exe
• isrv95.exe
• jammer.exe
• jed.exe
• jedi.exe
• kav8.0.0.357es.exe
• kavlite40eng.exe
• kavpers40eng.exe
• kavsvc.exe
• kerio-pf-213-en-win.exe
• kerio-wrl-421-en-win.exe
• kerio-wrp-421-en-win.exe
• killprocesssetup161.exe
• kis8.0.0.506latam.exe
• kpf.exe
• kpfw32.exe
• ldnetmon.exe
• ldpro.exe
• ldpromenu.exe
• ldscan.exe
• licmgr.exe
• localnet.exe
• lockdown.exe
• lockdown2000.exe
• lookout.exe
• lsetup.exe
• luall.exe
• luau.exe
• lucomserver.exe
• luinit.exe
• luspt.exe
• mcagent.exe
• mcmnhdlr.exe
• mcshield.exe
• mctool.exe
• mcuimgr.exe
• mcupdate.exe
• mcvsrte.exe
• mcvsshld.exe
• mdll.exe
• mfw2en.exe
• mfweng3.02d30.exe
• mgavrtcl.exe
• mgavrte.exe
• mghtml.exe
• mgui.exe
• minilog.exe
• monitor.exe
• monsys32.exe
• monsysnt.exe
• monwow.exe
• moolive.exe
• mpfagent.exe
• mpfservice.exe
• mpftray.exe
• mrflux.exe
• msblast.exe
• msconfig.exe
• msinfo32.exe
• msn.exe
• mspatch.exe
• mssmmc32.exe
• mu0311ad.exe
• mwatch.exe
• mxtask.exe
• n32scan.exe
• n32scanw.exe
• nai_vs_stat.exe
• nav32_loader.exe
• nav80try.exe
• navap.exe
• navapsvc.exe
• navapw32.exe
• navauto-protect.exe
• navdx.exe
• naveng.exe
• navengnavex15.exe
• navex15.exe
• navlu32.exe
• navnt.exe
• navrunr.exe
• navsched.exe
• navstub.exe
• navw.exe
• navw32.exe
• navwnt.exe
• nc2000.exe
• ncinst4.exe
• nd98spst.exe
• ndd32.exe
• ndntspst.exe
• neomonitor.exe
• neowatchlog.exe
• netarmor.exe
• netcfg.exe
• netinfo.exe
• netmon.exe
• netscanpro.exe
• netspyhunter-1.2.exe
• netstat.exe
• netutils.exe
• nisserv.exe
• nisum.exe
• nmain.exe
• nod32.exe
• normist.exe
• norton_internet_secu_3.0_407.exe
• notstart.exe
• npf40_tw_98_nt_me_2k.exe
• npfmessenger.exe
• nprotect.exe
• npscheck.exe
• npssvc.exe
• nsched32.exe
• ntdetect.exe
• ntrtscan.exe
• ntxconfig.exe
• nui.exe
• nupdate.exe
• nupgrade.exe
• nvapsvc.exe
• nvarch16.exe
• nvc95.exe
• nvlaunch.exe
• nvsvc32.exe
• nwinst4.exe
• nwservice.exe
• nwtool16.exe
• offguard.exe
• ogrc.exe
• opera.exe
• ostronet.exe
• outpost.exe
• outpostinstall.exe
• outpostproinstall.exe
• padmin.exe
• panixk.exe
• pathping.exe
• pavcl.exe
• pavproxy.exe
• pavsched.exe
• pavw.exe
• pcc2002s902.exe
• pcc2k_76_1436.exe
• pccclient.exe
• pccguide.exe
• pcciomon.exe
• pccmain.exe
• pccntmon.exe
• pccpfw.exe
• pccwin97.exe
• pccwin98.exe
• pcdsetup.exe
• pcfwallicon.exe
• pcip10117_0.exe
• pcscan.exe
• pcscanpdsetup.exe
• penis32.exe
• periscope.exe
• persfw.exe
• perswf.exe
• pf2.exe
• pfwadmin.exe
• ping.exe
• pingscan.exe
• platin.exe
• pop3trap.exe
• poproxy.exe
• popscan.exe
• portdetective.exe
• portmon.exe
• portmonitor.exe
• ppinupdt.exe
• pptbc.exe
• ppvstop.exe
• prckiller.exe
• processmonitor.exe
• procexp.exe
• procexplorerv1.0.exe
• programauditor.exe
• proport.exe
• protectx.exe
• pspf.exe
• purge.exe
• pview.exe
• pview95.exe
• qconsole.exe
• qserver.exe
• rapapp.exe
• rav.exe
• rav7.exe
• rav7win.exe
• rav8win32eng.exe
• realmon.exe
• regedit.exe
• regedt32.exe
• rescue.exe
• rescue32.exe
• route.exe
• routemon.exe
• rrguard.exe
• rshell.exe
• rstrui.exe
• rtvscn95.exe
• rulaunch.exe
• safeweb.exe
• sbserv.exe
• scan32.exe
• scan95.exe
• scanpm.exe
• sched.exe
• schedapp.exe
• scrscan.exe
• scvhosl.exe
• sd.exe
• sdclt.exe
• serv95.exe
• setup_flowprotector_us.exe
• setupvameeval.exe
• sgssfw32.exe
• sh.exe
• sharedaccess.exe
• shellspyinstall.exe
• shn.exe
• smc.exe
• sofi.exe
• spf.exe
• sphinx.exe
• spider.exe
• spysweeper.exe
• spyxx.exe
• srwatch.exe
• ss3edit.exe
• st2.exe
• supftrl.exe
• supporter5.exe
• sweep.exe
• sweep95.exe
• sweepnet.exe
• sweepsrv.sys.exe
• swnetsup.exe
• swsc.exe
• swxcacls.exe
• symproxysvc.exe
• symtray.exe
• sysdoc32.exe
• syshelp.exe
• taskkill.exe
• tasklist.exe
• taskmgr.exe
• taskmon.exe
• taumon.exe
• tauscan.exe
• tbscan.exe
• tc.exe
• tca.exe
• tcm.exe
• tcpsvs32.exe
• tds-3.exe
• tds2-98.exe
• tds2-nt.exe
• tds2.exe
• tfak.exe
• tfak5.exe
• tftpd.exe
• tgbob.exe
• titanin.exe
• titaninxp.exe
• tmlisten.exe
• tmntsrv.exe
• tracerpt.exe
• tracert.exe
• trjscan.exe
• trjsetup.exe
• trojantrap3.exe
• undoboot.exe
• unzip.exe
• update.exe
• updater.exe
• vbcmserv.exe
• vbcons.exe
• vbust.exe
• vbwin9x.exe
• vbwinntw.exe
• vccmserv.exe
• vcleaner.exe
• vcontrol.exe
• vcsetup.exe
• vet32.exe
• vet95.exe
• vet98.exe
• vettray.exe
• vfsetup.exe
• vir-help.exe
• virusmdpersonalfirewall.exe
• vmsrvc.exe
• vnlan300.exe
• vnpc3000.exe
• vpc32.exe
• vpc42.exe
• vpcmap.exe
• vpfw30s.exe
• vptray.exe
• vscan.exe
• vscan40.exe
• vscenu6.02d30.exe
• vsched.exe
• vsecomr.exe
• vshwin32.exe
• vsisetup.exe
• vsmain.exe
• vsmon.exe
• vsscan40.exe
• vsstat.exe
• vswin9xe.exe
• vswinntse.exe
• vswinperse.exe
• vvstat.exe
• w32dsm89.exe
• w9x.exe
• watchdog.exe
• webscan.exe
• webscanx.exe
• webtrap.exe
• wfindv32.exe
• wgfe95.exe
• whoswatchingme.exe
• wimmun32.exe
• wingate.exe
• winhlpp32.exe
• wink.exe
• winmgm32.exe
• winppr32.exe
• winrecon.exe
• winroute.exe
• winservices.exe
• winsfcm.exe
• wmias.exe
• wmiav.exe
• wnt.exe
• wradmin.exe
• wrctrl.exe
• wsbgate.exe
• wyvernworksfirewall.exe
• xpf202en.exe
• xscan.exe
• zapro.exe
• zapsetup3001.exe
• zatutor.exe
• zatutorzauinst.exe
• zauinst.exe
• zlh.exe
• zonalarm.exe
• zonalm2601.exe
• zonealarm.exe

Web Browser Home Page and Search Page Modification

This worm modifies the user's Internet Explorer home page to the following websites:

• "http://{BLOCKED}.-b-8-5-d-0-p-l-1-4-z-r-r-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info"

It modifies the user's Internet Explorer search engine into the following websites:

• "http://{BLOCKED}k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info"

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://whos.amung.us/swidget/hs2k61jne5aj
• http://widgets.amung.us/small/00/{Random Numbers}.png
• http://www.whatismyip.org/