Worm/Padobot.D - Worm

See also

Full description

Alias:	W32.Korgo.D, Worm.Win32.Padobot.Gen
Type:	Worm
Size:	9,728 Bytes
Origin:	unknown
Date:	05-30-2004
Damage:
VDF Version:	6.25.00.83 - Thu, 03 Jun 2004 12:14 (GMT+1)
Danger:	Medium
Distribution:	Medium

DistributionWorm/Padobot.D starts an attack over TCP port 445, using LSASS Windows security hole. If this succeeds, the worm tries to contact the host PC of other clean computers, for downloading its components.

Technical DetailsWhen activated, Padobot.D deletes the file ftpupd.exe from the current folder. It uses Mutexes u6, u7, u8 and uterm8, for ensuring that there are none of its
active tasks on the system.

The worm deletes the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
"WinUpdate"
"Windows Security Manager"
"avserve.exe"
"avserve2.exe"

The worm checks if the following registry entry was made:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"System Restore Service"

If it does not exist, the worm makes the registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wireless
"Client"="1"

If there is a registry entry for System Restore Service, but not in the same folder as the worm, it generates a copy of itself under a random name, in Windows system. It makes the entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"System Restore Service"="%System%\%randomfilename%.exe"

If the file System Restore Service exists and its path corresponds with the
worms path, the following entry is deleted:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wireless
"Client"

Worm/Padobot.D listens on TCP ports: 113; 3067 and other similar ports.

It also tries to contact the following IRC servers over TCP port 6667:

moscow-advokat.ru

graz.at.eu.undernet.org

flanders.be.eu.undernet.org

caen.fr.eu.undernet.org

brussels.be.eu.undernet.org

los-angeles.ca.us.undernet.org

washington.dc.us.undernet.org

london.uk.eu.undernet.org

lia.zanet.net

gaspode.zanet.org.za

irc.kar.net

irc.tsk.ru

gaz-prom.ru

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back