Analysis by: Sabrina Lei Sioting
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This worm arrives by accessing affected shared networks.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

  TECHNICAL DETAILS

File Size: 49,152 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 17 Aug 2010

Arrival Details

This worm arrives by accessing affected shared networks.

Installation

This worm drops the following copies of itself into the affected system:

  • %System Root%\AUTOEXEC.exe
  • %System%\New Folder.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following component file(s):

  • %System Root%\n.txt
  • %System Root%\yahoopath.txt

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
New Folder = New Folder.exe

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = userinit.exe,New Folder.exe

(Note: The default value data of the said registry entry is %system%\userinit.exe,.)

Other System Modifications

This worm adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1