Worm:Win32/Fakerecy.B

Worm:Win32/Fakerecy.B is a worm that spreads via logical drives.

Installation

Worm:Win32/Fakerecy.B creates the following files in the system drive (which is usually C:):

• autorun.inf - detected as Worm:INF/Autorun.B
• Recycled\desktop.ini
• Recycled\INFO2
• Recycled\ctfmon.exe - copy of itself
• <startup folder>\ctfmon.exe

Note - <startup folder> refers to a variable location that is determined by the malware by querying the operating system. The default installation location for the Startup folder for Windows 9x, Me, NT, 2000, XP and 2003 is '%USERPROFILE%\Start Menu\Programs\Startup'. For Windows Vista and Windows 7, the default location is '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'.

Note that its copy in the startup folder automatically runs when Windows starts.

Spreads via...

Logical drives

Worm:Win32/Fakerecy.B spreads to other computers by looking for accessible mapped drives (D: down to Z:). If it finds a drive, it creates the following files, similar to the ones that it drops in the system drive:

• autorun.inf - detected as Worm:INF/Autorun.B
• Recycled\desktop.ini
• Recycled\INFO2
• Recycled\ctfmon.exe - copy of itself

The "autorun.inf" file ensures that Worm:Win32/Fakerecy.B automatically runs when drives in which Autorun is enabled are accessed.

Analysis by Jaime Wong