Detection added	Jan 02 2009
Description added	Jan 13 2009

• Technical details
• Payload
• Removal instructions

This worm spreads via local networks and removable storage media. It is a PE DLL file. The components of the worm are between 155KB and 165KB in size. It is packed using UPX.

Installation

The worm copies its executable file to the Windows system directory as follows:

%System%\<rnd>.dll <rnd> is a string of random symbols

The worm creates a service to ensure it will be run each time Windows is launched on the victim machine. The following registry key is created:

The worm also modifies the following registry key value::

Network spreading

When infecting a computer, the worm launches an HTTP server on a random TCP port. This is then used to load the worm’s executable file to other computers.

The worm gets the IP addresses of computers in the same network as the victim machine and attacks them via a buffer overrun vulnerability in the Server service. (More details about this vulnerability can be found on the Microsoft site: www.microsoft.com).

The worm sends a specially crafted RPC request to remote machines, which causes a buffer overrun when the wcscpy_s function is called in netapi32.dll. This launches code which downloads the worm file, launches and installs it on the new victim machine.

In order to exploit the vulnerability described above, the worm attempts to connect to the Administrator account on the remote machine. The worm uses the following passwords to brute force the account:

Spreading via removable storage media

The worm copies its executable file as follows:

<X>:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\<rnd>.vmx rnd is a string of random lower case symbols; X is the disk.

The worm also places the following file in the root of each disk:

This ensures the worm’s executable file will be run each time the user opens the infected disk using Windows Explorer.

When launching, the worm injects its code into the address space of one of the “svchost.exe” system processes. This code is responsible for the worm’s malicious payload:

• Disables system restore
• Blocks addresses which contain the following strings:
  indowsupdate
  wilderssecurity
  threatexpert
  castlecops
  spamhaus
  cpsecure
  arcabit
  emsisoft
  sunbelt
  securecomputing
  rising
  prevx
  pctools
  norman
  k7computing
  ikarus
  hauri
  hacksoft
  gdata
  fortinet
  ewido
  clamav
  comodo
  quickheal
  avira
  avast
  esafe
  ahnlab
  centralcommand
  drweb
  grisoft
  eset
  nod32
  f-prot
  jotti
  kaspersky
  f-secure
  computerassociates
  networkassociates
  etrust
  panda
  sophos
  trendmicro
  mcafee
  norton
  symantec
  microsoft
  defender
  rootkit
  malware
  spyware
  virus

The worm also downloads a file from the link shown below:

This file is saved to the Windows system directory and then launched for execution. The link was not live at the time of writing.

The worm may also download files from links of the type shown below:

rnd2 is a random number. URL is a link formed by a special algorithm which uses the current date. The worm gets the current date from one of the sites listed below:

Files downloaded by the worm are saved to the Windows system directory with their original name.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, you can either use a special removal tool, which can be found here support.kaspersky.com or follow the instructions below:

1. Delete the system registry key shown below::
   [HKLM\SYSTEM\CurrentControlSet\Services\netsvcs]
2. Delete "%System%\<rnd>.dll" from the system registry key parameter shown below:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] "netsvcs"
3. Reboot the computer.
4. Delete the original worm file (the location will depend on how the malicious program penetrated the computer).
5. Delete the file shown below:
   

   %System%\<rnd>.dll <rnd> is a string of random symbols

6. Delete the following files from all removable storage media:
   

   <X>:\autorun.inf <X>:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\<rnd>.vmx rnd is a string of random lower case symbols; X is the disk.

7. Download and install operating system updates from the following link:
   http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
8. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus.