WORM_VOBFUS.DQ

This worm drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Installation

This worm drops the following copies of itself into the affected system:

• %User Profile%\{random file name}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name} = "%User Profile%\{random file name}.exe"

Other System Modifications

This worm modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Propagation

This worm drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

{garbage characters}
[autorun]
{garbage characters}
ActiON=23294
{garbage characters}
open={random file name}.eXe
{garbage characters}
icoN={random file name}.ico
{garbage characters}
USeAuToplay=1
{garbage characters}

NOTES:

This worm drops .LNK files in removable drives that point to a copy of itself. This is done to automatically execute dropped copies when the said drives are accessed.

The dropped .LNK files use random file names, names of the existing folders, and hardcoded file names. This technique enables the copy of the worm to execute first before opening the real folder. It then changes the attributes of the original folders to Hidden and System to avoid early detection.