Content
VBS/Doli.worm
- Type
- Virus
- SubType
- Worm
- Discovery Date
- 09/05/2007
- Length
- Minimum DAT
- 5113 (09/05/2007)
- Updated DAT
- 5171 (11/26/2007)
- Minimum Engine
- 4.4.00
- Description Added
- 09/05/2007
- Description Modified
- 11/22/2007 8:08 AM (PT)
Tab Navigation
Characteristics
Files
The worm drops the following files:
%Sysdir%\winini.vbs
%Sysdir%\snd44.gif
%Sysdir%\user44.ico
%Sysdir%\VbScr.xml
And it copies itself as:
%Sysdir%\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Temporary Internet Files\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Application Data\Microsoft\CD Burning\www.MacDonald.com-index.htm
%UserProfile%\Favorites\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\History\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Music\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Pictures\www.MacDonald.com-index.htm
%UserProfile%\My Documents\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\Programs\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\www.MacDonald.com-index.htm
And it also may copy itself at one of the following locations:
%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#imen_nannou@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#ahlem_3ishk@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amina_kissme@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amel_sousse@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sana_hammamet@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#molka_nabeul@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#noura_sfax@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amani_staracademy@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sandra_algerie@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#madiha_ariana@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sonia_malhat_manar2@yahoo.fr.htm
Moreover, if the worm is executed more than 8 times, it will copy itself 99 times under:
%UserProfile%Desktop\message_sandwich{random number}.htm
It creates a copy of itself in the root of all fixed, removable and network drives it finds (except A:\), using the filename www.MacDonald.com-index.htm.
It may copy itself as {filename}.{ext}.vbs if there are some files with one of the following extensions in the sub-folders of the drives:
*.mp3
*.mpg
*.doc
*.xls
*.jpg
(The decision is made randomly).
It infects all .htm and .html files found in the sub-folders of the fixed, removable and network drives.
Registry
-
The worm modifies the following registry entry to count the number of executions of the script:
HKEY_LOCAL_MACHINE\"shell" = "{counter}"
- It creates the following registry entries to force the execution of the worm at startup or when Internet Explorer is executed:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\"Start Page" = "%Sysdir%\www.MacDonald.com-index.htm"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"
- If the worm is executed more than 6 times, it creates the following subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LIDO44.FILE
- And it modifies these registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.3gp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ace\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dat\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.frm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gif\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ini\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mdb\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mov\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp2\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp3\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ocx\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pdf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ppt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.txt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xls\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\"" = "LIDO44.FILE"
HKEY_CURRENT_USER\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_USERS\.DEFAULT\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_CURRENT_USER\Console\"FullScreen" = "1"
HKEY_CURRENT_USER\Console\"ScreenColors" = "4"
- It disables the taskmanager too:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"
- And finally, if the worm is executed more than 8 times, it modifies these registry entries:
HKEY_CURRENT_USER\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_USERS\.DEFAULT\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_CURRENT_USER\Control Panel\Colors\"Background" = "200 100 100"
HKEY_CURRENT_USER\Control Panel\Desktop\"Wallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"OriginalWallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"WallpaperStyle" = "2"
HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\"Shell Icon Size" = "72"
Symptoms
- The presence of the above files and registry entries.
- Increase in file size for .html and .htm files
- The following notification may appear in the systray:
- The startpage is changed and the following webpage appears when Internet Explorer is opened:
Method of Infection
The virus may arrive on the compromised computer through an infected .html page.
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Characteristics
Characteristics -
Files
The worm drops the following files:
%Sysdir%\winini.vbs
%Sysdir%\snd44.gif
%Sysdir%\user44.ico
%Sysdir%\VbScr.xml
And it copies itself as:
%Sysdir%\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Temporary Internet Files\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Application Data\Microsoft\CD Burning\www.MacDonald.com-index.htm
%UserProfile%\Favorites\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\History\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Music\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Pictures\www.MacDonald.com-index.htm
%UserProfile%\My Documents\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\Programs\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\www.MacDonald.com-index.htm
And it also may copy itself at one of the following locations:
%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#imen_nannou@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#ahlem_3ishk@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amina_kissme@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amel_sousse@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sana_hammamet@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#molka_nabeul@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#noura_sfax@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amani_staracademy@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sandra_algerie@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#madiha_ariana@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sonia_malhat_manar2@yahoo.fr.htm
Moreover, if the worm is executed more than 8 times, it will copy itself 99 times under:
%UserProfile%Desktop\message_sandwich{random number}.htm
It creates a copy of itself in the root of all fixed, removable and network drives it finds (except A:\), using the filename www.MacDonald.com-index.htm.
It may copy itself as {filename}.{ext}.vbs if there are some files with one of the following extensions in the sub-folders of the drives:
*.mp3
*.mpg
*.doc
*.xls
*.jpg
(The decision is made randomly).
It infects all .htm and .html files found in the sub-folders of the fixed, removable and network drives.
Registry
-
The worm modifies the following registry entry to count the number of executions of the script:
HKEY_LOCAL_MACHINE\"shell" = "{counter}"
- It creates the following registry entries to force the execution of the worm at startup or when Internet Explorer is executed:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\"Start Page" = "%Sysdir%\www.MacDonald.com-index.htm"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"
- If the worm is executed more than 6 times, it creates the following subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LIDO44.FILE
- And it modifies these registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.3gp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ace\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dat\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.frm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gif\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ini\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mdb\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mov\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp2\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp3\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ocx\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pdf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ppt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.txt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xls\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\"" = "LIDO44.FILE"
HKEY_CURRENT_USER\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_USERS\.DEFAULT\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_CURRENT_USER\Console\"FullScreen" = "1"
HKEY_CURRENT_USER\Console\"ScreenColors" = "4"
- It disables the taskmanager too:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"
- And finally, if the worm is executed more than 8 times, it modifies these registry entries:
HKEY_CURRENT_USER\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_USERS\.DEFAULT\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_CURRENT_USER\Control Panel\Colors\"Background" = "200 100 100"
HKEY_CURRENT_USER\Control Panel\Desktop\"Wallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"OriginalWallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"WallpaperStyle" = "2"
HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\"Shell Icon Size" = "72"
Symptoms
Symptoms -
- The presence of the above files and registry entries.
- Increase in file size for .html and .htm files
- The following notification may appear in the systray:
- The startpage is changed and the following webpage appears when Internet Explorer is opened:
Method of Infection
Method of Infection -
The virus may arrive on the compromised computer through an infected .html page.
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
