Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:WORM/AutoIt.psait
Date discovered:16/08/2011
Type:Worm
In the wild:No
Reported Infections:Low
Distribution Potential:Low to medium
Damage Potential:Low to medium
Static file:Yes
File size:305.653 Bytes
MD5 checksum:00C5EA2728BC3860548053B5C62624E0
VDF version:7.11.13.90 - Tuesday, August 16, 2011
IVDF version:7.11.13.90 - Tuesday, August 16, 2011

 General Method of propagation:
   • Autorun feature


Aliases:
   •  Symantec: W32.SillyFDC
   •  TrendMicro: BKDR_PATCH.OJ
   •  Microsoft: Trojan:Win32/Malagent


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7


Side effects:
   • Drops a file
   • Lowers security settings
   • Registry modification

 Files It copies itself to the following locations:
   • C:\system32\891249\154\2\4\52\34\5\5\2\34\5\234\5234\523452345\234\52345\23462\362\34\6523\452\346\234\52\345\24\624\36\234\62\346\2346\23\46\services.exe
   • C:\system\service.exe
   • C:\system32\system.com
   • C:\system32\cmd.com
   • C:\system32\ctfmon.com
   • C:\GoodNight\Fucking_Hero\file.com

 Registry The following registry key is continuously in an infinite loop added in order to run the process after reboot.

–  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "system"="C:\system32\system.com"
   • "ctfmon.exe"="C:\system32\ctfmon.com"



The following registry keys are added:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
   Image File Execution Options\calc.exe]
   • "Debugger"="C:\system32\891249\154\2\4\52\34\5\5\2\34\5\234\5234\523452345\234\52345\23462\362\34\6523\452\346\234\52\345\24\624\36\234\62\346\2346\23\46\services.exe"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system]
   • "DisableRegistryTools"=dword:00000001



The following registry keys are changed:

Various Explorer settings:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   New value:
   • "Hidden"=dword:00000002

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   New value:
   • "NoFolderOptions"=dword:00000001
   • "NoDriveTypeAutoRun"=dword:0000005b

 Backdoor Contact server:
All of the following:
   • 67.215.77.**********:4600
   • 92.241.169.**********:4700


 Miscellaneous Anti debugging
Checks for debugger or virtual machine using time related techniques.

 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • UPX

Description inserted by Andrei Ilie on Thursday, October 6, 2011
Description updated by Andrei Ilie on Friday, October 7, 2011

Back . . . .