Aliases

Net-Worm.Win32.Kido.dv (Kaspersky Lab) is also known as: Net-Worm.Win32.Kido.dv (Kaspersky Lab),

Detection added	Jan 02 2009
Description added	Jan 15 2009

• Technical details
• Payload
• Removal instructions

This worm spreads via local networks and removable storage media. It is a PE DLL file. The components of the worm are 165840 B. It is packed using UPX.

Installation

The worm copies its executable file as follows:

<rnd> is a string of random symbols

The worm creates a service to ensure it will be run each time Windows is launched on the victim machine. The following registry key is created:

The worm also modifies the following registry key value:

Network spreading

When infecting a computer, the worm launches an HTTP server on a random TCP port. This is then used to load the worm’s executable file to other computers.

The worm gets the IP addresses of computers in the same network as the victim machine and attacks them via a buffer overrun vulnerability (MS08-067) in the Server service. (More details about this vulnerability can be found on the Microsoft site: www.microsoft.com).

The worm sends a specially crafted RPC request to remote machines, which causes a buffer overrun when the wcscpy_s function is called in netapi32.dll. This launches code which downloads the worm file, launches and installs it on the new victim machine.

In order to exploit the vulnerability described above, the worm attempts to connect to the Administrator account on the remote machine. The worm uses the following passwords to brute force the account:

Spreading via removable storage media

The worm copies its executable file to all removable storage media as follows:

rnd is a random string of lower case symbols; d is a random number; x is the disk

The worm also places the following file in the root of each disk:

This ensures the worm’s executable file will be run each time the user opens the infected disk using Windows Explorer.

When launching, the worm injects its code into the address space of one of the “svchost.exe” system processes. This code is responsible for the worm’s malicious payload

• Disables the following services:
  wuauserv
  BITS
• Blocks addresses which contain the following strings:
  indowsupdate
  wilderssecurity
  threatexpert
  castlecops
  spamhaus
  cpsecure
  arcabit
  emsisoft
  sunbelt
  securecomputing
  rising
  prevx
  pctools
  norman
  k7computing
  ikarus
  hauri
  hacksoft
  gdata
  fortinet
  ewido
  clamav
  comodo
  quickheal
  avira
  avast
  esafe
  ahnlab
  centralcommand
  drweb
  grisoft
  eset
  nod32
  f-prot
  jotti
  kaspersky
  f-secure
  computerassociates
  networkassociates
  etrust
  panda
  sophos
  trendmicro
  mcafee
  norton
  symantec
  microsoft
  defender
  rootkit
  malware
  spyware
  virus

The worm may also download files from links of the type shown below:

rnd2 is a random number. URL is a link formed by a special algorithm which uses the current date. The worm gets the current date from one of the sites listed below:

Downloaded files are saved to the Windows system directory with their original name.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, you can either use a special removal tool, which can be found here support.kaspersky.com or follow the instructions below:

1. Delete the system registry key shown below:
   [HKLM\SYSTEM\CurrentControlSet\Services\netsvcs]
2. Delete "%System%\.dll" from the system registry key parameter shown below:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] "netsvcs"
3. Reboot the computer.
4. Delete the original worm file (the location will depend on how the malicious program penetrated the computer).
5. Delete copies of the worm:
   %System%\<rnd>.dll
   %Program Files%\Internet Explorer\<rnd>.dll
   %Program Files%\Movie Maker\<rnd>.dll
   %All Users Application Data%\<rnd>.dll
   %Temp%\<rnd>.dll
   %System%\<rnd>.tmp
   %Temp%\<rnd>.tmp
   <rnd> is a random string of symbols
6. Delete the files shown below from all removable storage media:
   <X>:\autorun.inf <X>:\RECYCLER\S-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>\<rnd>.vmx
   .

   rnd is a random string of lower case symbols; d is a random number; x is the disk

7. Download and install operating system updates from the link below:
   http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
8. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus.