Worm/Padobot.F - Worm

See also

Full description

Alias:	W32.Korgo.F, Worm.Win32.Padobot.e, W32/Korgo.worm.g, WORM_KORGO.F
Type:	Worm
Size:	10,752 Bytes
Origin:	unknown
Date:	06-01-2004
Damage:	Uses LSASS security hole (MS04-011 Microsoft Security Bulletin)
VDF Version:	6.25.00.83 - Thu, 03 Jun 2004 12:14 (GMT+1)
Danger:	Medium
Distribution:	Medium

DistributionAs Worm/Sasser before it, Worm/Padobot.F spreads using LSASS security hole. More information is to be found on MS04-011 Microsoft Security Bulletin.

The worm connects to other systems using TCP Port 445. When connected, the worm file is downloaded from the infected system and activated.

Technical DetailsWhen activated, Padobot.F deletes the file ftpupd.exe from the folder it was run on. The worm deletes the following registry entries:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"System Service Manager"
"System Restore Service"
"Bot Loader"
"Windows Update Service"
"WinUpdate"
"Windows Security Manager"
"avserve.exe"
"avserve2.exe"

The worm checks if the following registry entry exist:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"Disk Defragmenter"="%%"

If it does not exist, the worm makes the registry entry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wireless]
"Client"="1"

If it finds the registry entry for "Disk Defragmenter", the worm randomly generates a file and copies it in Windows System. It makes the entry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"Disk Defragmenter"="%System%\%random_name%.exe"

The worm tries to connect to EXPLORER.EXE task, so it might not be detected and recognized in the task list, if EXPLORER.EXE or the worm itself were active.

Worm/Padobot.F listens on TCP ports: 113, 3067 and other similar ports. If it succeeds to connect to a port, it tries to upload its viral file. The worm also tries to contact the following IRC servers on TCP Port 6667:
- gaspode.zanet.org.za
- lia.zanet.net
- irc.tsk.ru
- london.uk.eu.undernet.org
- washington.dc.us.undernet.org
- los-angeles.ca.us.undernet.org
- brussels.be.eu.undernet.org
- caen.fr.eu.undernet.org
- flanders.be.eu.undernet.org
- graz.at.eu.undernet.org
- moscow-advocat.ru
- gaz-prom.ru

The worm starts an attack on TCP Port 445, using the LSASS Windows security hole. When succeeded, the contacted PC tries to connect to the Host-PC and to download the virus file.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back