Virus:Worm/Autorun.bns
Date discovered:31/07/2009
Type:Worm
In the wild:Yes
Reported Infections:Low to medium
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:76.288 Bytes
MD5 checksum:c00e51fba9f3b275436ce22c57772ca5
IVDF version:7.01.05.55 - Friday, July 31, 2009

 General Method of propagation:
• Autorun feature
   • Messenger


Aliases:
   •  Sophos: W32/Autorun-AVF
   •  Panda: W32/IRCBot.CPZ.worm
   •  Eset: Win32/Agent.NGR
   •  Bitdefender: Win32.Worm.IMStealer.I


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

 Files It copies itself to the following locations:
   • %TEMPDIR%\vshost32.exe
   • %drive%\vshost.exe



The following file is created:

– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%




It tries to download a file:

– The locations are the following:
   • http://win.studyingcenter-org.com/**********?p1=%number%&p2=USA&n=1
   • http://ns.dunno-net.com/**********?p1=%number%&p2=USA&n=1
   • http://fubar.cheapsocks.cn/**********?p1=%number%&p2=USA&n=1
At the time of writing this file was not online for further investigation.

 Registry The following registry keys are changed:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "Userinit"="%SYSDIR%\userinit.exe,%TEMPDIR%\vshost32.exe"

– [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   New value:
   • "BuildID"=dword:0xd3adc0de

 Messenger It is spreading via Messenger. The characteristics are described below:

– AIM Messenger
– Yahoo Messenger


To:
All entries in the contact list.


Propagation via file
It sends a file with the following name:
   • vshost.exe

 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Monday, December 14, 2009
Description updated by Petre Galan on Monday, December 14, 2009

Back . . . .