live casino online

This worm arrives via removable drives. It may be dropped by other malware.

It modifies registry entries to disable various system services. This action prevents most of the system functions to be used. It deletes registry entries, causing some applications and programs to not function properly.

It drops copies of itself into all the removable drives connected to an affected system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system. It exploits software vulnerabilities to propagate to other computers across a network.

It uses certain lists of user names and passwords to access password-protected shared files.

It prevents users from visiting antivirus-related websites that contain specific strings.

Arrival Details

This worm arrives via removable drives.

It may arrive via network shares.

It may be dropped by other malware.

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\{random file name}.dll
• %System%\{random file name}.dll
• %System%\{random number}.tmp
• %Program Files%\Internet Explorer\{random file name}.dll
• %Program Files%\Movie Maker\{random file name}.dll
• %User Temp%\{random file name}.dll

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
Type = "32"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
ObjectName = "Local System"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
Description = "{long sentences}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
ImagePath = "%System Root%\system32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}\Parameters
ServiceDll = "%System%\{malware file name}"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "rundll32.exe {malware path and file name}, {Parameter}"

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Tcpip\Parameters
TcpNumConnections = "0x00FFFFFE" - hex values

(Note: The default value data of the said registry entry is {System Default}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{original value} {random characters}"

(Note: The default value data of the said registry entry is {original value}.)

It modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinDefend
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WerSvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "4"

(Note: The default value data of the said registry entry is 2.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\explorer\
ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}

It deletes the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = "{value}"

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\RECYCLER\{SID}

It drops copies of itself into all the removable drives connected to an affected system.

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\RECYCLER\{SID}\{random characters}

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;garbage characters
;garbage characters
shelLExECUte =RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
;garbage characters
;garbage characters

It exploits the following software vulnerabilities to propagate to other computers across a network:

• first before modifying your computer's registry.
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
    • From: netsvcs = "{original value} {random characters}"
      To: netsvcs = {original value}
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    • From: TcpNumConnections = "0x00FFFFFE" - hex values
      To: TcpNumConnections = {System Default}
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
    • From: Start = "4"
      To: Start = 2
      
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL
    • From: CheckedValue = "0"
      To: CheckedValue = 1
      

  To restore registry values this malware/grayware modified:

  1. Open Registry Editor. To do this:
     
     • On Windows 2000, XP, and Server 2003:
       Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
     • On Windows Vista, 7, and Server 2008:
       Click the Start button, type REGEDIT in the Search input field then press Enter.
     • On Windows 8, 8.1, and Server 2012:
       Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
  2. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>SvcHost
  3. In the right panel, locate the registry value:
     netsvcs = "{original value} {random characters}"
  4. Right-click on the value name and choose Modify. Change the value data of this entry to:
     netsvcs = {original value}
  5. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>Tcpip>Parameters
  6. In the right panel, locate the registry value:
     TcpNumConnections = "0x00FFFFFE" - hex values
  7. Right-click on the value name and choose Modify. Change the value data of this entry to:
     TcpNumConnections = {System Default}
  8. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>wuauserv
  9. In the right panel, locate the registry value:
     Start = "4"
  10. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  11. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>WinDefend
  12. In the right panel, locate the registry value:
      Start = "4"
  13. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  14. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>ERSvc
  15. In the right panel, locate the registry value:
      Start = "4"
  16. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  17. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>WerSvc
  18. In the right panel, locate the registry value:
      Start = "4"
  19. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  20. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>wscsvc
  21. In the right panel, locate the registry value:
      Start = "4"
  22. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  23. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>BITS
  24. In the right panel, locate the registry value:
      Start = "4"
  25. Right-click on the value name and choose Modify. Change the value data of this entry to:
      Start = 2
  26. In the left panel, double-click the following:
      HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>explorer>Advanced>Folder>Hidden>SHOWALL
  27. In the right panel, locate the registry value:
      CheckedValue = "0"
  28. Right-click on the value name and choose Modify. Change the value data of this entry to:
      CheckedValue = 1
  29. Close Registry Editor.