WORM_SILLY.SLH

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It modifies certain registry entries to disable Security Center functions. Doing this allows this malware to execute its routines without being detected. It modifies registry entries to hide files with System and Read-only attributes. It creates certain registry entries to prevent execution of files with certain file types.

It drops copies of itself into network drives. It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It may arrive via network shares.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following component file(s):

• [drive letter]:\RÈCYCLER\desktop.ini

It drops the following copies of itself into the affected system:

• %Application Data%\Java\?shimgvw?.exe
• %Application Data%\Java\?Jview?.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\Java

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Computer Name}? = %Application Data%\Java\?shimgvw?.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
jre? = %Application Data%\Java\?Jview?.exe

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\exefile
NeverShowExt = ""

HKEY_CLASSES_ROOT\jpegfile
NeverShowExt = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile
NeverShowExt = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpegfile
NeverShowExt = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = 0

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CLASSES_ROOT\jpegfile\DefaultIcon
(Default) = "%Application Data%\Java\?shimgvw?.exe,0"

(Note: The default value data of the said registry entry is "shimgvw.dll,3".)

HKEY_CURRENT_USER\Control Panel\Desktop
AutoEndTasks = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
HungAppTimeout = "400"

(Note: The default value data of the said registry entry is "5000".)

HKEY_CURRENT_USER\Control Panel\Desktop
WaitToKillAppTimeout = "400"

(Note: The default value data of the said registry entry is "20000".)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control
WaitToKillServiceTimeout = "2000"

(Note: The default value data of the said registry entry is "20000".)

It modifies the following registry entries to disable Security Center functions:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirstRunDisabled = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirstRunDisabled = 1

(Note: The default value data of the said registry entry is 0.)

It modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
UncheckedValue = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
UncheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entries to prevent execution of files with certain file types:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ansavgd
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
attrib.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
autorunme.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
blastclnn.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
blastclnnn.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
cscript.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
egui.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
EHttpSrv.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ekrn.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ise32.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MSASCui.exe
Debugger = "rundll32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Nbrowser.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
New Folder.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Njeeves.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32krn.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32kui.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npcsvc32.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npc_login.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npc_tray.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npflgutl.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfports.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfrules.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfsvc32.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfuser.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
npfwiz.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nprosec.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nuaa.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Nvcoa.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nvcsched.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nvoy.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
reg32.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rtpsvc.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
scsaver.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SSCVIHOST.exe
Debugger = "cmd.exe /c del /f /q "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wscript.exe
Debugger = "rundll32.exe"

Propagation

This worm creates the following folders in all removable drives:

• [drive letter]:\RÈCYCLER

It drops the following copy(ies) of itself in all removable drives:

• [drive letter]:\RÈCYCLER\thumbs.db

It drops copies of itself into network drives.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

{garbage codes}
{garbage codes}
{garbage codes}
{garbage codes}
[Autorun] ;{garbage codes}
;{garbage codes}
;{garbage codes}
UseAutoPlay=1 ;{garbage codes}
;{garbage codes}
;{garbage codes}
Action=Open folder to view files ;{garbage codes}
;{garbage codes}
;{garbage codes}
Open=RÈCYCLER\thumbs.db ;{garbage codes}
;{garbage codes}
;{garbage codes}
Shell\Open\Command=RÈCYCLER\thumbs.db ;{garbage codes}
;{garbage codes}
;{garbage codes}
Shell\Open\Default=1 ;{garbage codes}
;{garbage codes}
;{garbage codes}
Shell\Explore\Command=RÈCYCLER\thumbs.db ;{garbage codes}
;{garbage codes}
;{garbage codes}
;{garbage codes}
;{garbage codes}

NOTES:
It drops copies of itself in removable drives. These dropped copies use the names of JPEG files located on the said drives for their file names. It then sets the attributes of the JPEG files to Read-Only, Hidden, and System to fool users into clicking the malware copy. Once a copy of the malware is executed, it also opens the original picture file to avoid suspicion from the user.