W32/Autorun.worm.bx

Content

W32/Autorun.worm.bx

Type: Virus
SubType: Worm
Discovery Date: 02/20/2008
Length: varies
Minimum DAT: 5235 (02/21/2008)
Updated DAT: 6595 (01/20/2012)
Minimum Engine: 5.1.00
Description Added: 02/20/2008
Description Modified: 10/07/2011 11:25 AM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

----Update on October 07, 2011---

Aliases

Kaspersky - Trojan.Win32.VB.vdt
NOD32 - a variant of Win32/Injector.DED
Ikarus - Trojan-Dropper
Microsoft - VirTool:Win32/VBInject.gen!CI

Upon execution the Worm injects itself with explorer.exe and connects to the site thunder.ir[Removed]ils.net address through a remote port 3211.

When executed it copies itself into the following location:

%Systemdrive%\CNN\A\Lic.exe
:[Removable Drive]:\CNN\A\Lic.exe

And drop the following files:

%Systemdrive%\CNN\A\Desktop.ini
:[Removable Drive]:\ CNN\A\Desktop.ini

The following folders have been created.

%Systemdrive%\CNN\
%Systemdrive%\CNN\A\

And also drops autorun.inf file into the root of all removable drivers and mapped drives in an attempt to autorun an executable when the drive is accesed.

The file "AutoRun.inf" is pointing to the malware binary executable. When the removable or networked drive is
accessed from a machine supporting the Autorun feature, the malware is launched automatically.

The autorun.inf is configured to launch the trojan file via the following command syntax.

[autorun]
open=CNN\A\Lic.exe
action=Open folder to view files
shell\open=Open
shell\open\command=CNN\A\Lic.exe
shell\open\default=1

The following registry key has been added to the system.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1A2CL9HB-10A0-27ND-CQP3-597182kam43G}

The following registry value has been added.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1A2CL9HB-10A0-27ND-CQP3-597182kam43G}\]
�StubPath� = " %Systemdrive%\CNN\A\Lic.exe"

The above mentioned registry ensures that the Trojan registers itself with the compromised system and execute upon every reboot.

----Update on June 25, 2010---A new variant of W32/Autorun.worm.bx can do the following:

- It drops itself to the following folder:

C:\RECYCLER\S-1-5-21-(SID)\system.exe

- Creates following registry key (so that system.exe runs every time Windows starts):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{99NEW9C2-4FCB-11CF-AAX5-62CB1C636422}
Path = "c:\RECYCLER\S-1-5-21-(SID)\system.exe"

- It injects itself to explorer.exe

- It adds itself to the Windows firewall whitelist:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\ FirewallPolicy \StandardProfile \ AuthorizedApplications \ List "C:\RECYCLER\S-1-5-21-(SID)\system.exe"

----------------------------------------

This detection is for a worm.
It attempts to spread to removable drives by creating an autorun.inf file, which will run the worm automatically, if a systems which use the removable drive are set to Autorun.

This worm adds the following files and registry entries to load itself on startup.

Files:
c:\WINDOWS\system32\amvo.exe
c:\WINDOWS\system32\amvo0.dll
c:\Program Files\Microsoft Common\svchost.exe

Registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
amva = C:\WINDOWS\System32\amvo.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Debugger = C:\Program Files\Microsoft Common\svchost.exe

This worm changes the following registry values in attempt to change the windows explorer view settings

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden = 2

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
CheckedValue = 0

This worm also attempts to create an autorun.inf file on the root any accessible disk volumes.

[Drive]:\autorun.inf

The autorun.inf will reference one of the following files that will also be written to the root of the volume.

(Additional filenames may be found in other variants of this worm)
[Drive]:\xn1i9x.com
[Drive]:\2ifetri.cmd
[Drive]:\x.com
[Drive]:\3wcxx91.cmd
[Drive]:\awda2.exe
[Drive]:\system.exe

Symptoms

Existence of mentioned files and registry keys.

Method of Infection

This worm may be spread by its intented method of infected removable drives.

Alternatively this may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the worm onto the user's system with no user interaction.

Some may also spread through spammed malicious pdf files.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password.
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions.
Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer".
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
Follow onscreen instructions.
Reset and remove the CD from CD-ROM drive.

Variants

N/A

All Information

Overview -

This detection is for a worm that attempts to copy itself to the root of any accessible disk volumes. Additionally it attempts to place an Autorun.inf file on the root of the volume so that it is executed the next time the volume is mounted.

The worm drops a DLL file that is injected into EXPLORER.EXE see the associated VIL at:

http://vil.nai.com/vil/content/v_144323.htm