Win32/Randex

When Win32/Randex runs, it copies itself to the system folder. It may add a value to the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

This value causes the worm to run when Windows restarts.

 

The Win32/Randex worm may connect to randomly generated IP addresses through TCP port 445. The worm then uses a predefined list of weak passwords to attempt log on to writeable network shares on remote computers. After gaining access, the worm copies itself to the remote computer and creates a task to run the copy.

 

The Win32/Randex worm connects to a remote IRC server and joins a specific channel to receive commands from attackers. Upon successful installation, the worm notifies attackers through a private message. Attackers can then use the established IRC channel to perform backdoor actions such as launching distributed denial of service (DDoS) attacks against IP addresses, scanning for vulnerable computers with weak administrator passwords, downloading remote files and running them, retrieving computer configuration information, retrieving CD keys of popular games, joining or leaving specific IRC channels, adding or removing IRC users, and updating the worm.

 

Some variants of the worm also drop a backdoor Trojan component, which opens TCP ports and acts as an HTTP proxy.