WORM_PROLACO.XWQ

This worm arrives as attachment to mass-mailed email messages. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system. It sends copies of itself as attachments to email messages using Microsoft Outlook Visual Basic for Applications (VBA).

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It sends gathered information to a predetermined email address using its own Simple Mail Transfer Protocol (SMTP) engine.

Arrival Details

This worm arrives as attachment to mass-mailed email messages.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

• %system%\foxit.exe - detected as TROJ_HILOTI.XWG

It drops the following component file(s):

• %WINDOWS%\statcvs.exe - also detected as WORM_PROLACO.XWQ
• %application data%\statcvs.exe - also detected as WORM_PROLACO.XWQ
• %system%\NvTaskbarInh.exe - - copy of itself
• %system%\statcvs.exe - also detected as WORM_PROLACO.XWQ

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
IDT PC Audio = %WINDOWS%\statcvs.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Nvidia Control Center3 = %system%\NvTaskbarInh.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IDT PC Audio = %WINDOWS%\statcvs.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{N5DKJK5H-5XG7-8421-4V52-B1QQ0LF833CU}
StubPath = %WINDOWS%\statcvs.exe""

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER
@ = H1UYEEMA[QRs}`{avx'ktn

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
DeleteFlag = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
DeleteFlag = 1

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = 24

(Note: The default value data of the said registry entry is 21.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cookies = C:\Documents and Settings\NetworkService\Cookies

(Note: The default value data of the said registry entry is C:\Documents and Settings\LocalService\Cookies.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cache = C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files

(Note: The default value data of the said registry entry is C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
History = C:\Documents and Settings\NetworkService\Local Settings\History

(Note: The default value data of the said registry entry is C:\WINDOWS\system32\config\systemprofile\Local Settings\History.)

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components
{N5DKJK5H-5XG7-8421-4V52-B1QQ0LF833CU} =

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%system%\\NvTaskbarInh.exe = %system%\NvTaskbarInh.exe:*:Enabled:Explorer

Propagation

This worm creates the following folders in all removable drives:

• RECYCLER\{SID}

It drops the following copy(ies) of itself in all removable drives:

• redmond.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=RECYCLER\{SID}\redmond.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLER\{SID}\redmond.exe
shell\open\default=1

It gathers target email addresses from files with the following extensions:

• txt
• htm
• xml
• php
• asp
• dbx
• log
• nfo
• lst
• rtf
• xml
• wpd
• wps
• xls
• doc
• wab

It sends copies of itself as attachments to email messages using Microsoft Outlook Visual Basic for Applications (VBA).

It avoids sending email messages to addresses containing the following strings:

• .mil
• abuse
• acd-group
• acdnet.com
• acdsystems.com
• acketst
• admin
• ahnlab
• alcatel-lucent.com
• anyone
• apache
• arin.
• avg-comsysinternals
• avira
• badware
• berkeley
• bitdefender
• bluewin.ch
• borlan
• bpsoft.com
• bsd
• bugs
• buyrar.com
• ca
• certific
• cisco
• clamav
• contact
• debian
• drweb
• eset.com
• example
• f-secure
• fido
• firefox
• fsf.
• ghisler.com
• gimp
• gnu
• gold-certs, gov.
• help
• honeynet
• honeypot
• iana
• ibm.com
• icrosoft
• idefense
• ietf
• ikarus
• immunityinc.com
• info
• inpris
• isc.o
• isi.e
• jgsoft
• kaspersky
• kernel
• lavasoft
• linux
• listserv
• mcafee
• messagelabs
• mit.e
• mozilla
• mydomai
• nobody
• nodomai
• noone
• nothing
• novirusthanks
• ntivi
• nullsoft.org
• page
• panda
• postmaster
• prevx
• privacy
• qualys
• quebecor.com
• rating
• redhat
• rfc-ed
• root
• rusils
• sales
• samba
• samples
• secur
• security
• sendmail
• service
• site
• slashdot
• soft
• somebody
• somoeone
• sopho
• sourceforge
• spam
• spm
• ssh.com
• submit
• sun.com
• support
• suse
• syman
• tanford.e
• the.bat
• unix
• usenet
• utgers.ed
• virus
• virusbuster
• webmaster
• websense
• winamp
• wincap
• wireshark
• www.ca.com

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Rootkit Capabilities

This worm also has rootkit capabilities, which enables it to hide its processes and files from the user.

Process Termination

This worm terminates the following services if found on the affected system:

• APVXDWIN
• AVG8_TRAY
• AVP
• AVP
• AntiVirSchedulerService
• Arrakis3
• BDAgent
• CAVRID
• CSIScanner
• CaCCProvSP
• DrWebScheduler
• ERSvc
• Ehttpsrv
• Emproxy
• FPAVServer
• GWMSRV
• ISTray
• K7EmlPxy
• K7RTScan
• K7SystemTray
• K7TSMngr
• K7TSStart
• LIVESRV
• MBAMService
• MCNASVC
• MPFSERVICE
• MPS9
• McENUI
• MskAgentexe
• PAVFNSVR
• PAVPRSRV
• PAVSVR
• PSHOST
• PSIMSVC
• PSKSVCRETAIL
• RSCCenter
• RSRavMon
• RavTask
• SAVScan
• SBAMTray
• SCANINICIO
• SUM
• Savadminsrvice
• Savservice
• SpIDerMail
• SpamBlocker
• TPSRV
• ThreatFire
• VSSERV
• WerSvc
• WinDefend
• XCOMM
• antivirservice
• avast!
• avg8emc
• avg8wd
• bdss
• ccEvtMgr
• ccproxy
• ccpwdsvc
• ccsetmgr
• cctray
• egui
• ekrn
• liveupdate
• mcODS
• mcmisupdmgr
• mcmscsvc
• mcpromgr
• mcproxy
• mcredirector
• mcshield
• mcsysmon
• msk80service
• navapsvc
• npfmntor
• nscservice
• sbamsvc
• sbamui
• scan
• sdauxservice
• sdcodeservice
• sndsrvc
• spbbcsvc
• wscsvc
• OfficeScanNT Monitor
• Spam Blocker for Outlook Express
• F-PROT Antivirus Tray application
• Windows Defender
• aswupdsv
• avast! Antivirus
• avast! Mail Scanner
• avast! Web Scanner
• McAfee HackerWatch Service
• Norton AntiVirus
• LiveUpdate Notice Service
• Symantec Core LC
• Sophos Autoupdate Service
• Sophos Agent
• Sophos Certification Manager
• Sophos Management Service
• Sophos Message Router
• PANDA SOFTWARE CONTROLLER

It terminates the following processes if found running in the affected system's memory:

• ALSvc.exe
• APvxdwin.exe
• AVENGINE.exe
• AlMon.exe
• CCenter.exe
• FPAVServer.exe
• FPWin.exe
• FprotTray.exe
• HWAPI.exe
• K7EmlPxy.exe
• K7RTScan.exe
• K7SysTry.exe
• K7TSMngr.exe
• K7TSecurity.exe
• McNASvc.exe
• McProxy.exe
• Mcshield.exe
• MpfSrv.exe
• NTRtScan.exe
• PAVSRV51.exe
• PSCtrlS.exe
• PShost.exe
• PavFnSvr.exe
• PavPrSrv.exe
• Pavbckpt.exe
• PsIMSVC.exe
• Rav.exe
• RavMon.exe
• RavStub.exe
• RavTask.exe
• RavmonD.exe
• RedirSvc.exe
• SavAdminService.exe
• SavMain.exe
• SavService.exe
• SbeConsole.exe
• SrvLoad.exe
• TPSRV.exe
• TmListen.exe
• Webproxy.exe
• ashdisp.exe
• ashserv.exe
• avcenter.exe
• avciman.exe
• avgcsrvx.exe
• avgemc.exe
• avgnt.exe
• avgrsx.exe
• avgtray.exe
• avguard.exe
• avgui.exe
• avgwdsvc.exe
• avp.exe
• avp.exe
• bdagent.exe
• bdss.exe
• ccsvchst.exe
• drweb32w.exe
• drwebupw.exe
• egui.exe
• ekrn.exe
• emproxy.exe
• guardgui.exe
• iface.exe
• isafe.exe
• livesrv.exe
• mbam.exe
• mcagent.exe
• mcmscsvc.exe
• mcods.exe
• mcpromgr.exe
• mcsysmon.exe
• mcvsshld.exe
• mps.exe
• mskagent.exe
• msksrver.exe
• pccnt.exe
• prevx.exe
• psksvc.exe
• sbamtray.exe
• sbamui.exe
• seccenter.exe
• spidergui.exe
• vetmsg.exe
• vsserv.exe
• xcommsvr.exe

Dropping Routine

This worm executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Stolen Information

This worm sends gathered information to a predetermined email address using its own Simple Mail Transfer Protocol (SMTP) engine.

Other Details

Based on analysis of the codes, it has the following capabilities:

• Creates the following registry to disable Windows User Account Controls notification:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
• EnableLUA = 0
• Modifies the following registry to disable System Restore:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
• DisableSR = 1
• Default value is 0.
• Modifies the following registry to Windows Error Reporting Service:
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
• Start = 4
• Default value is 2.
• Modifies the following registry to Windows Security Center:
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
• Start = 4
• Default value is 2.
• Searches for MSI files in network drives and repackages the said files with a copy of itself. It does this by utilizing Windows Iexpress Wizard. The repackaged file when run, extracts and executes the original MSI file and the copy of this worm.
• Checks the location of the Windows Address Book by querying the following registry key:
• HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name

It attempts to access the following websites to download files, which are possibly malicious:

• http:\\www.{BLOCKED}n.com
• hxxp:\ww{BLOCKED}vine.net