Network Worm: Worm.Win32.AutoRun.oor

Risk level: high

virus symptoms

The sample is a network worm which was developed use the “Delphi”, it is used the “nspack” packers way in an attempt to evade signature scanning, the size of packers “33,792 bytes”, the icon for the virus”“, the extension “exe”, mainly through the “file bundle”, “download tools download”, “removable storage media” and other modes, the main purpose of the virus is to download a large number of trojan and malicious programs.
After the user’s computer was infected will be shut down for the security software for no reason, network performance is Slow, can not boot from safe mode, windows system without undue error occurred.
Infection of the operating system

Windows 2000/Windows XP / Windows 2003

Transmission

Web Trojans, file bundle, download manager

Manual Solution:

1, manually delete the following files:
% Temp% \ dll8.Tmp
% SystemRoot% system32 \ isb.Ini
X: \ GRIL.PIF
X: \ AutoRun.inf (X: is any disk drive letter)

2, manually replace the following documents:
% SystemRoot% \ system32 \ dllcache \ linkinfo.dll replace the% SystemRoot% \ system32 \ linkinfo.Dll

3, manually delete the following Registry value:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ [Security Software]

4, manually modify the following registry:
Key: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \

Folder \ Hidden \ SHOWALL
Value: SHOWALL
Data: 1

Variable declaration:

% SystemDriver% partition where the operating system, typically “C: \”
Where% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

Viruses create files:

% SystemDriver% \ sam.Dll
% SystemRoot% \ Fonts \ isnsts.VBS
% Temp% \ Temp \ dll8.Tmp
% SystemRoot% system32 \ isb.Ini
% SystemRoot% \ system32 \ dllcache \ linkinfo.Dll
% SystemRoot% \ fonts \ safeg.Sys
% SystemRoot% \ lubb.Fon
% SystemRoot% \ fonts \ lvbasb.Sys
X: \ GRIL.PIF
X: \ AutoRun.inf (X: is any drive letter)

Viruses modify the file:

% SystemRoot% \ system32 \ linkinfo.Dll

Virus delete the file:

% SystemDriver% \ sam.Dll
% SystemRoot% \ Fonts \ bsv.VBS
% SystemRoot% \ fonts \ safeg.Sys
% SystemRoot% \ lubb.Fon
% SystemRoot% \ fonts \ lvbasb.Sys

Virus to create the registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ safeg
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ lubb
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ lvbasb
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ [all hijack]

Viruses modify the registry:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \

Folder \ Hidden \ SHOWALL \ CheckedValue

Virus delete the registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SafeBoot \ Minimal \ (4D36E967-E325-11CE-BFC1-08002BE10318)
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SafeBoot \ Network \ (4D36E967-E325-11CE-BFC1-08002BE10318)
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ [Security Software]

Connect to the network virus

http://wind **. ch.ma / dd.txt