WORM_FANBOT.A

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers target email addresses from the Windows Address Book (WAB). It takes advantage of software vulnerabilities to propagate across networks.

It connects to Internet Relay Chat (IRC) servers. It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk.

It modifies the affected system's HOSTS files. This prevents users from accessing certain websites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\remote.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\RpcRemotes
DisplayName = "Remote Procedure Call (RPC) Remote"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\RpcRemotes
ImagePath = "%System%\remote.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\RpcRemotes
DisplayName = "Remote Procedure Call (RPC) Remote"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WinShell = "%System%\remote.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
WinShell = "%System%\remote.exe"

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
Ph4nt0m = "Ph4nt0m"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%System%\remote.exe = '%System%\remote.exe:*:Disabled:Generic Host Process for Win32 Services"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

Propagation

This worm drops copies of itself into the following folders used in peer-to-peer (P2P) networks:

• DONKEY
• DOWNLOAD
• HTDOCS
• INCOMING
• KAZAA
• MORPHEUS
• SHARE
• SHARING
• UPLOAD

It searches for available Simple Mail Transfer Protocol (SMTP) servers by checking the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Account Manager\Accounts

It gathers target email addresses from the Windows Address Book (WAB).

It avoids sending email messages to addresses containing the following strings:

• anyone
• contact
• feste
• gold-certs
• nobody
• noone
• nothing
• postmaster
• privacy
• rating
• samples
• service
• somebody
• someone
• submit
• the.bat
• webmaster

It takes advantage of the following software vulnerabilities to propagate across networks:

• (MS05-039) Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege (899588)

Backdoor Routine

This worm connects to any of the following Internet Relay Chat (IRC) servers:

• {BLOCKED}rl.3322.org

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following command(s) from a remote malicious user:

• Download or execute files
• Get system information
• Remove or update worm copy
• Start or terminate mass-mailing routine

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• A2HIJACKFREE.EXE
• ADAM.EXE
• AGTX0404.EXE
• AGTX0411.EXE
• AGTX0804.EXE
• ALERTAST.EXE
• ALESCAN.EXE
• ALEUPDAT.EXE
• ALUNOTIFY.EXE
• ANTIVIRUS_UPDATE.EXE
• APORTS.EXE
• AUPDATE.EXE
• BACKRAV.EXE
• BLACKD.EXE
• BLACKICE.EXE
• BOTZOR.EXE
• BRONSTAB.EXE
• CCEMFLSV.EXE
• CCENTER.EXE
• CFGWIZ.EXE
• CLEANUP.EXE
• CMDAGENT.EXE
• COOLBOT.EXE
• CSM.EXE
• CSSCAN.EXE
• CVT.EXE
• DEFWATCH.EXE
• DWHWIZRD.EXE
• EGHOST.EXE
• EKSPLORASI.PIF
• FINT2005.EXE
• FRAMEWORKSERVICE.EXE
• FRMINST.EXE
• HELLMSN.SCR
• HIJACKTHIS.EXE
• HNETWIZ.EXE
• HPMANAGER.EXE
• IAMSTATS.EXE
• ICESWORD.EXE
• IDTEMPLATE.EXE
• INBUILD.EXE
• IPARMOR.EXE
• ISSVC.EXE
• JAVA.EXE
• KATMAIN.EXE
• KAV.EXE
• KAV32.EXE
• KAVDX.EXE
• KAVLOG2.EXE
• KAVPFW.EXE
• KAVPFW.EXE
• KAVSEND.EXE
• KAVSTART.EXE
• KAVSTART.EXE
• KAVSVC.EXE
• KILLBOX.EXE
• KMAILMON.EXE
• KNLPS.EXE
• KNLSC13.EXE
• KPFWSVC.EXE
• KRECYCLE.EXE
• KREGEX.EXE
• KSHRMGR.EXE
• KVCENTER.KXP
• KVDETECH.EXE
• KVDETECT.EXE
• KVDISK.KXP
• KVDOS.EXE
• KVMONXP.KXP
• KVOL.EXE
• KVOLSELF.EXE
• KVREPORT.KXP
• KVSCAN.KXP
• KVSRVXP.EXE
• KVSTORY.KXP
• KVSTUB.KXP
• KVUPLOAD.EXE
• KVWSC.EXE
• KVXP.KXP
• KWATCH.EXE
• KWATCH9X.EXE
• LANGSET.EXE
• LDVPREG.EXE
• LOGPARSER.EXE
• LRSEND.EXE
• LSETUP.EXE
• LUALL.EXE
• LUAWRAP.EXE
• LUCOMSERVER.EXE
• LUINIT.EXE
• MAKEBOOT.EXE
• MCAFFEAV.EXE
• MCCONSOL.EXE
• MCSCRIPT.EXE
• MCSCRIPT_INUSE.EXE
• MCUPDATE.EXE
• MDAC.EXE
• MOUSEBM.EXE
• MOUSEMM.EXE
• MOUSESYNC.EXE
• MSAGENT.EXE
• MSNMSGS.EXE
• MSTASK.EXE
• NAPRDMGR.EXE
• NAVUSTUB.EXE
• NDETECT.EXE
• NVCHIP4.EXE
• PATCH.EXE
• PCCBROWS.EXE
• PCCGUIDE.EXE
• PCCLIENT.EXE
• PCCLOG.EXE
• PCCMAIN.EXE
• PCCMDCOM.EXE
• PCCSPYUI.EXE
• PCCTLCOM.EXE
• PCCTOOL.EXE
• PCCVSCAN.EXE
• PER.EXE
• PFW.EXE
• PHANTOM.EXE
• PICX.EXE
• PIREG.EXE
• PM.EXE
• PROCESSEXPLORER.EXE
• RAV.EXE
• RAVDOS.EXE
• RAVHDBAK.EXE
• RAVMON.EXE
• RAVMOND.EXE
• RAVPATCH.EXE
• RAVSTORE.EXE
• RAVSTUB.EXE
• RAVTIMER.EXE
• RAVXP.EXE
• REALSCHED.EXE
• REGCLEAN.EXE
• REGGUIDE.EXE
• REGSVR32.EXE
• RESCUE.EXE
• RFW.EXE
• RFWMAIN.EXE
• RFWSRV.EXE
• RKDETECTOR.EXE
• ROOTKITREVEALER.EXE
• RSAGENT.EXE
• RSCONFIG.EXE
• RSSMS.EXE
• RTVSCAN.EXE
• RUNDLL32.EXE
• SAVROAM.EXE
• SCAN32.EXE
• SCANBD.EXE
• SCNCFG32.EXE
• SCRIGZ.EXE
• SERVCE.EXE
• SETUPWIZ.EXE
• SHCFG32.EXE
• SHSTAT.EXE
• SMARTDRV.EXE
• SMARTUP.EXE
• SMSS.EXE
• SOUNDMAN.EXE
• SYMANTECROOTINSTALLER.EXE
• SYMCLNUP.EXE
• SYSTEM.EXE
• TASKGMR.EXE
• TMNTSRV.EXE
• TMOAGENT.EXE
• TMPFW.EXE
• TMPROXY.EXE
• TRA.EXE
• TRIALMSG.EXE
• TROJANDETECTOR.EXE
• TROJANWALL.EXE
• TROJDIE.KXP
• TSC.EXE
• UNINSTALL.KXP
• UPDATE.EXE
• UPDATERUI.EXE
• UPGRADE.EXE
• VIRUSBOX.KXP
• VPC32.EXE
• VPDN_LU.EXE
• VPTRAY.EXE
• VSTSKMGR.EXE
• WINHOST.EXE
• WINLDR.EXE
• WINTBP.EXE
• WPA.EXE
• WRITECAN.EXE
• ZONEALARM.EXE

HOSTS File Modification

This worm modifies the affected system's HOSTS files to prevent a user from accessing the following websites:

• avp.com
• ca.com
• customer.symantec.com
• db.kingsoft.com
• dispatch.mcafee.com
• download.mcafee.com
• f-secure.com
• iduba.net
• jiangmin.com
• kaspersky-labs.com
• kaspersky.com
• kaspersky.com.cn
• kingsoft.com
• liveupdate.symantec.com
• liveupdate.symantecliveupdate.com
• mast.mcafee.com
• mcafee.com
• microsoft.com
• my-etrust.com
• nai.com
• networkassociates.com
• online.rising.com.cn
• pandasoftware.com
• rads.mcafee.com
• rising.com.cn
• scan.kingsoft.com
• secure.nai.com
• securityresponse.symantec.com
• sophos.com
• symantec.com
• symantec.com.cn
• trendmicro.com
• update.symantec.com
• Update2.JiangMin.com
• Update3.JiangMin.com
• updates.symantec.com
• us.mcafee.com
• viruslist.com
• virustotal.com
• www.avp.com
• www.ca.com
• www.f-secure.com
• www.grisoft.com
• www.iduba.net
• www.jiangmin.com
• www.kaspersky.com
• www.kaspersky.com.cn
• www.mcafee.com
• www.microsoft.com
• www.my-etrust.com
• www.nai.com
• www.networkassociates.com
• www.pandaguard.com
• www.pandasoftware.com
• www.rising.com.cn
• www.sophos.com
• www.symantec.com
• www.symantec.com.cn
• www.trendmicro.com
• www.viruslist.com
• www.virustotal.com

It adds the following strings to the Windows HOSTS file:

• Play with the best, Die like the rest.
  
• [Phantom] 2005 made by Evil[xiaou]. Special Thanks:x140d4n.
  
• If u have Zotob's SourceCode, please u mail it to me!!!
  
• E-mail:x140yu@Gmail.Com thanks!!!

NOTES:

This worm propagates by sending a copy of itself as an attachment to email messages, which it sends to target recipients using its own Simple Mail Transfer Protocol (SMTP) engine.

The email message it sends out has the following details:

• Subject: (any of the following)
  
  • *DETECTED* Online User Violation
  • Email Account Suspension
  • Important Notification
  • Members Support
  • Notice of account limitation
  • Security measures
  • Warning Message: Your services near to be closed.
  • You have successfully updated your password
  • Your Account is Suspended
  • Your Account is Suspended For Security Reasons
  • Your new account password is approved
  • Your password has been successfully updated
  • Your password has been updated
• Message body: (any of the following)
• Dear user {name of recipient},
  
  You have successfully updated the password of your {email account of user} account. If you did not authorize this change or if you need assistance with your account, please contact {random} customer service at: {random}
  
  Thank you for using {random name}!
  The {random name} Support Team
  
  Attachment: No Virus (Clean)
  {random domain name} Antivirus - www.{random antivirus Web site}.com
  
  
• Dear {name of recipient} Member,
  
  We have temporarily suspended your email account {email account of user}. This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors. See the details to reactivate your {email account of user} account.
  
  Sincerely,
  The {random name} Support Team
  
  Attachment: No Virus (Clean)
  {random domain name} Antivirus www.{random antivirus Web site}.com
  
  
• Dear {name of recipient} Member,
  
  Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service.
  
  If you choose to ignore our request, you leave us no choice but to cancel your membership.
  
  Virtually yours,
  The {random name} Support Team
  
  Attachment: No Virus found
  
  
• Dear user {name of recipient}, It has come to our attention that your {email account of user} User Profile ( x ) records are out of date. For further details see the attached document. Thank you for using {random}! The {random name} Support Team
  
  +++ Attachment: No Virus (Clean)
  +++ {random domain name} Antivirus - www.{random antivirus name}.com
  
  
• +++ {random} Antivirus - www.{random}
  +++ Attachment: No Virus (Clean)
  
  The {random} Support Team
  Thank you for using {random}!
  If you did not authorize this change or if you need assistance with your account, please contact {random} customer service at: {random}
  You have successfully updated the password of your {random} account.
  
  
• Attachment: (any of the following file names)
  
  
  • {random}
  • accepted-password
  • account-details
  • account-info
  • account-password
  • account-report
  • approved-password
  • document
  • email-details
  • email-password
  • important-details
  • new-password
  • password
  • readme
  • updated-password
  
  
  (with any of the following extension names)
  • BAT
  • CMD
  • EXE
  • PIF
  • SCR
  • ZIP

It may also generate email addresses by combining the following names with a domain name, which it copies from previously harvested email addresses:

• andrew
• brenda
• brent
• brian
• claudia
• david
• debby
• frank
• george
• helen
• james
• jerry
• jimmy
• julie
• kevin
• linda
• maria
• michael
• peter
• robert
• sales
• sandra
• smith
• steve

It avoids sending email to addresses containing any of the following substrings in the email name and domain name fields:

• Names:
  
• abuse
• accoun
• admin
• administrato
• certific
• google
• icrosoft
• linux
• listserv
• ntivi
• register
• secur
• service
• support
• Domain Names:
  
• acketst
• arin.
• berkeley
• borlan
• example
• google
• hotmail
• ibm.com
• icrosof
• inpris
• isc.o
• isi.e
• kernel
• linux
• mit.e
• mozilla
• mydomai
• nodomai
• panda
• rfc-ed
• ripe.
• ruslis

If it does not find a default mail server, it queries the message exchange servers of the gathered email addresses by appending the domain names of the said addresses with the following strings:

• gate.
• mail.
• mail1.
• mx.
• mx1.
• mxs.
• ns.
• relay.
• smtp.

It uses the following file names for the copies it drops into peer-to-peer (P2P) networks:

• 1001 Sex and more.rtf.exe
• 3D Studio Max 6 3dsmax.exe
• ACDSee 10.exe
• AcrobatReader_New.exe
• activation_crack.exe
• Adobe Photoshop 10 crack.exe
• Adobe Photoshop 10 full.exe
• Adobe Premiere 10.exe
• Ahead Nero 8.exe
• Altkins Diet.doc.exe
• American Idol.doc.exe
• angels.pif
• Arnold Schwarzenegger.jpg.exe
• Best Matrix Screensaver new.scr
• Bifrost.scr
• BlackIce_Firewall_Enterpriseactivation_Crack.exe
• Britney sex xxx.jpg.exe
• Britney Spears and Eminem porn.jpg.exe
• Britney Spears blowjob.jpg.exe
• Britney Spears cumshot.jpg.exe
• Britney Spears fuck.jpg.exe
• Britney Spears full album.mp3.exe
• Britney Spears porn.jpg.exe
• Britney Spears Sexy archive.doc.exe
• Britney Spears Song text archive.doc.exe
• Britney Spears.jpg.exe
• Britney Spears.mp3.exe
• Butterfly.scr
• Clone DVD 6.exe
• Cloning.doc.exe
• cool screensaver.scr
• Cracks & Warez Archiv.exe
• Dark Angels new.pif
• dcom_patches.exe
• Dictionary English 2004 - France.doc.exe
• dictionary.doc.exe
• DivX 8.0 final.exe
• dolly_buster.jpg.pif
• Doom 3 release 2.exe
• doom2.doc.pif
• e.book.doc.exe
• E-Book Archive2.rtf.exe
• e-book.archive.doc.exe
• eminem - lick my pussy.mp3.pif
• Eminem blowjob.jpg.exe
• Eminem full album.mp3.exe
• Eminem Poster.jpg.exe
• Eminem sex xxx.jpg.exe
• Eminem Sexy archive.doc.exe
• Eminem Song text archive.doc.exe
• Eminem Spears porn.jpg.exe
• Eminem.mp3.exe
• firefox-1.6a1.en-US.win32.installer.exe
• Full album all.mp3.pif
• Gimp 1.8 Full with Key.exe
• Harry Potter 1-6 book.txt.exe
• Harry Potter 5.mpg.exe
• Harry Potter all e.book.doc.exe
• Harry Potter e book.doc.exe
• Harry Potter game.exe
• Harry Potter.doc.exe
• How to hack new.doc.exe
• how to hack.doc.exe
• icq2005-final.exe
• Internet Explorer 9 setup.exe
• 'K.jpg.pif
• Kazaa Lite 4.0 new.exe
• Kazaa new.exe
• Keygen 4 all new.exe
• Kula.jpg.pif
• Kula.scr
• Learn Programming 2004.doc.exe
• Lightwave 9 Update.exe
• Magix Video Deluxe 5 beta.exe
• Matrix.mpg.exe
• matrix.scr
• max payne 2.crack.exe
• Maxthon_New.exe
• Microsoft Office 2003 Crack best.exe
• Microsoft WinXP Crack full.exe
• MS Service Pack 6.exe
• MSN7-final.exe
• netsky source code.scr
• Norton Antivirus 2005 beta.exe
• nuke2004.exe
• Office_Crack.exe
• Opera 11.exe
• Partitionsmagic 10 beta.exe
• Porno Screensaver britney.scr
• porno.scr
• programming basics.doc.exe
• Rain.scr
• RealPlayer_New.exe
• RFC compilation.doc.exe
• rfc compilation.doc.exe
• Ringtones.doc.exe
• Ringtones.mp3.exe
• Saddam Hussein.jpg.exe
• Screensaver2.scr
• Serial.txt.exe
• Serials 2005_New.exe
• Serials edition.txt.exe
• Smashing the stack full.rtf.exe
• Star Office 9.exe
• Strip-Girl-2.0b.exe
• strippoker.exe
• Super Dollfie.pif
• Teen Porn 15.jpg.pif
• The Sims 4 beta.exe
• TouchNet Browser 1.29b.exe
• Ulead Keygen 2004.exe
• UltraEdit-32 12.01 + Cracker.exe
• virii.scr
• Visual Studio Net Crack all.exe
• Win Longhorn re.exe
• Win Longhorn.doc.exe
• WinAmp 13 full.exe
• Winamp5.exe
• Windows 2000 Sourcecode.doc.exe
• Windows 2003 crack.exe
• Windows XP crack.exe
• WinXP eBook newest.doc.exe
• Winxp_Crack.exe
• XXX hardcore pics.jpg.exe