Threat behavior
Worm:Win32/Pykspa.A is a worm that sends instant-messages on behalf of a user logged into Skype, an Internet chat client application. Messages sent contain a link to a remote Web site hosting a copy of the worm. Worm:Win32/Pykspa.A terminates processes, and redirects Web browser connections for various security-related Web sites to random IP addresses.
Worm:Win32/Pykspa.A may be introduced to a system in two ways:
- clicking a link referencing a remote Web site hosting a copy of the worm
- mounting an infected removable drive with "autorun" feature enabled
If Worm:Win32/Pykspa.A is run, it will perform the following actions:
- Displays the Windows bitmap file "Soap Bubbles.bmp" found in the %WinDir% folder to minimize suspicion
- Drops copies of itself into the <system> folder
mshtmlsh32.exe
sdrivec32.exe
winlgcverx.exe
wndrivsd32.exe - Modifies the registry to run copies of the worm at Windows startup:
Adds value: Services Start<random digit>
With data: mshtmlsh32.exe
In subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Adds value: Logon Settings<random digit>
With data: mshtmlsh32.exe
Adds value: Windows Sysdat
With data: explorer.exe mshtmlsh32.exe
In subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon - Enumerates all removable drives using the Windows API GetDriveType and drops files into the root of drives found:
game.exe
zjbs.exe (sets file attributes system, hidden, read-only)
autorun.inf (sets file attributes system, hidden, read-only)
The startup configuration file autorun.inf contains instructions to autorun the file zjbs.exe using the Windows application "Windows Picture and Fax Viewer" - Modifies the Windows domain name server resolution file HOSTS to redirect Web browser connections for various security-related Web sites to random IP addresses, as in these examples:
…
152.33.175.124 www.symantec.comsecurityresponse.symantec.com
106.68.249.248 pandasoftware.com
127.86.43.21 www.pandasoftware.com
18.9.227.56 sophos.com
158.164.230.187 www.sophos.com
255.248.27.63 mcafee.com
212.150.219.68 www.mcafee.com
41.63.104.247 downloads-us1.kaspersky-labs.com - Locates running process Skype in all Windows sessions and when found
- composes messages using this list of text
(happy)
sky
ops
pala biski
as net nezinau ka tavo vietoj daryciau.
matai :D
geras ane ?
patinka?
kas cia tavim taip isderge ? =]]
cia biski su photoshopu pazaidziau bet bet irgi gerai atrodai :D
cia tu isimetei ?
zek kur tavo foto metos isdergta
(mm) kaip as taves noriu
ziurek kur tavo foto imeciau :D
esi?
labas
what ur friend name wich is in photo ?
this (happy) sexy one
u happy ?
oh sry not for u
oops sorry please don't look there :S
you checked ?
(rofl)
(devil)
really funny
now u populr
haha lol
look what crazy photo Tiffany sent to me,looks cool
I used photoshop and edited it
where I put ur photo :D
your photos looks realy nice
look
how are u ? :)
hey - sends a message to each online contact with a constructed message body
- includes a hyperlink to a remote Web site hosting a copy of the worm
- sets the status of the logged in Skype user to DND
- Enumerates running processes and compares them to this list of partial file names, and terminates matching processes:
ACKWIN32
ADAWARE
ADVXDWIN
AGENTSVR
AGENTW
ALERTSVC
ALEVIR
ALOGSERV
AMON9X
AMON
ANTI-TROJAN
ANTIVIRUS
ANTS
APIMONITOR
APLICA32
APVXDWIN
ARR
ATCON
ATGUARD
ATRO55EN
ATUPDATER
ATUPDATER
ATWATCH
AUPDATE
AUPDATE
AUTODOWN
AUTODOWN
AUTOTRACE
AUTOTRACE
AUTOUPDATE
AUTOUPDATE
AVCONSOL
AVE32
AVGCC32
AVGCTRL
AVGNT
AVGSERV
AVGSERV9
AVGUARD
AVGW
AVKPOP
AVKSERV
AVKSERVICE
AVKWCTl9
AVLTMAIN
AVNT
AVP
AVP32
AVPCC
AVPDOS32
AVPM
AVPTC32
AVPUPD
AVPUPD
AVSCHED32
AVSYNMGR
AVWIN95
AVWINNT
AVWUPD
AVWUPD32
AVWUPD32
AVWUPSRV
AVXMONITOR9X
AVXMONITORNT
AVXQUAR
AVXQUAR
BACKWEB
BARGAINS
BD_PROFESSIONAL
BEAGLE
BELT
BIDEF
BIDSERVER
BIPCP
BIPCPEVALSETUP
BISP
BLACKD
BLACKICE
BLSS
BOOTCONF
BOOTWARN
BORG2
BPC
BRASIL
BS120
BUNDLE
BVT
CCAPP
CCEVTMGR
CCPXYSVC
CDP
CFD
CFGWIZ
CFIADMIN
CFIAUDIT
CFIAUDIT
CFINET
CFINET32
CLAW95CF
CLEAN
CLEANER
CLEANER3
CLEANPC
CLICK
CMD32
CMESYS
CMGRDIAN
CMON016
CPD
CPF9X206
CPFNT206
CTRL
CWNB181
CWNTDWMO
Claw95
CLAW95CF
DATEMANAGER
DCOMX
DEFALERT
DEFSCANGUI
DEFWATCH
DEPUTY
DIVX
DLLCACHE
DLLREG
DOORS
DPF
DPFSETUP
DPPS2
DRWATSON
DRWEB32
DRWEBUPW
DSSAGENT
DVP95
DVP95_0
ECENGINE
EFPEADM
EMSW
ENT
ESAFE
ESCANH95
ESCANHNT
ESCANV95
ESPWATCH
ETHEREAL
ETRUSTCIPE
EVPN
EXE.AVXW
EXPERT
EXPLORE
F-AGNT95
F-PROT
F-PROT95
F-STOPW
FAMEH32
FAST
FCH32
FIH32
FINDVIRU
FIREWALL
FLOWPROTECTOR
FNRB32
FP-WIN
FP-WIN_TRIAL
FPROT
FRW
FSAA
FSAV
FSAV32
FSAV530STBYB
FSAV530WTBYB
FSAV95
FSGK32
FSM32
FSMA32
FSMB32
GATOR
GBMENU
GBPOLL
GENERICS
GMT
GUARD
GUARDDOG
HACKTRACERSETUP
HBINST
HBSRV
HOTACTIO
HOTPATCH
HTLOG
HTPATCH
HWPE
HXDL
HXIUL
IAMAPP
IAMSERV
IAMSTATS
IBMASN
IBMAVSP
ICLOAD95
ICLOADNT
ICMON
ICSUPP95
ICSUPP95
ICSUPPNT
IDLE
IEDLL
IEDRIVER
IEXPLORER
IFACE
IFW2000
INETLNFO
INFUS
INFWIN
INIT
INTDEL
INTREN
IOMON98
IPARMOR
IRIS
ISASS
ISRV95
ISTSVC
JAMMER
JDBGMRG
JEDI
KAVLITE40ENG
KAVPERS40ENG
KAVPF
KAZZA
KEENVALUE
KERNEL32
LAUNCHER
LDNETMON
LDPRO
LDPROMENU
LDSCAN
LNETINFO
LOADER
LOCALNET
LOCKDOWN
LOCKDOWN2000
LOOKOUT
LORDPE
LSETUP
LUALL
LUALL
LUAU
LUCOMSERVER
LUINIT
LUSPT
MAPISVC32
MCAGENT
MCMNHDLR
MCSHIELD
MCTOOL
MCUPDATE
MCUPDATE
MCVSRTE
MCVSSHLD
MFIN32
MFW2EN
MFWENG3.02D30
MGAVRTCL
MGAVRTE
MGHTML
MGUI
MINILOG
MMOD
MONITOR
MOOLIVE
MOSTAT
MPFAGENT
MPFSERVICE
MPFTRAY
MRFLUX
MSAPP
MSBB
MSBLAST
MSCACHE
MSCCN32
MSCMAN
MSCONFIG
MSDM
MSDOS
MSIEXEC16
MSINFO32
MSLAUGH
MSMGT
MSMSGRI32
MSSMMC32
MSSYS
MSVXD
MU0311AD
MWATCH
N32SCANW
NAV
NAVAP.NAVAPSVC
NAVAPSVC
NAVAPW32
NAVDX
NAVLU32
NAVNT
NAVSTUB
NAVW32
NAVWNT
NC2000
NCINST4
NDD32
NEOMONITOR
NEOWATCHLOG
NETARMOR
NETD32
NETINFO
NETMON
NETSCANPRO
NETSTAT
NETUTILS
NISSERV
NISUM
NMAIN
NOD32
NOD32CC
NOD32M2
NORMIST
NOTSTART
NPFMESSENGER
NPROTECT
NPSCHECK
NPSSVC
NSCHED32
NSSYS32
NSTASK32
NSUPDATE
NTRTSCAN
NTVDM
NTXconfig
NUI
NUPGRADE
NUPGRADE
NVARCH16
NVC95
NVSVC32
NWINST4
NWSERVICE
NWTOOL16
OLLYDBG
ONSRVR
OPTIMIZE
OSTRONET
OTFIX
OUTPOST
OUTPOST
OUTPOSTINSTALL
PADMIN
PANIXK
PATCH
PAVCL
PAVPROXY
PAVSCHED
PAVW
PCC2002S902
PCC2K_76_1436
PCCIOMON
PCCNTMON
PCCWIN97
PCCWIN98
PCDSETUP
PCFWALLICON
PCIP10117_0
PCSCAN
PDSETUP
PENIS
PERISCOPE
PERSFW
PERSWF
PF2
PFWADMIN
PGMONITR
PINGSCAN
PLATIN
POP3TRAP
POPROXY
POPSCAN
PORTDETECTIVE
PORTMONITOR
POWERSCAN
PPINUPDT
PPTBC
PPVSTOP
PRIZESURFER
PRMT
PRMVR
PROCDUMP
PROCESSMONITOR
PROGRAMAUDITOR
PROPORT
PROTECTX
PSPF
PURGE
PUSSY
PVIEW95
QCONSOLE
QSERVER
RAPAPP
RAV7
RAV7WIN
RAV8WIN32ENG
RAY
RB32
RCSYNC
REALMON
REGED
REGEDIT
REGEDT32
RESCUE
RESCUE32
RRGUARD
RSHELL
RTVSCAN
RTVSCN95
RULAUNCH
RUN32DLL
RUNDLL
RUNDLL16
RUXDLL32
SAFEWEB
SAHAGENT
SAVE
SAVENOW
SBSERV
SCAM32
SCAN32
SCAN95
SCANPM
SCRSCAN
SCRSVR
SCVHOST
SERV95
SERVICE
SERVLCE
SERVLCES
SETUPVAMEEVAL
SFC
SGSSFW32
SHELLSPYINSTALL
SHN
SHOWBEHIND
SMC
SMS
SMSS32
SOAP
SOFI
SPERM
SPF
SPHINX
SPOLER
SPOOLCV
SPOOLSV32
SPYXX
SREXE
SRNG
SS3EDIT
SSGRATE
SSG_4104
ST2
START
STCLOADER
SUPFTRL
SUPPORT
SUPPORTER5
SVC
SVCHOSTC
SVCHOSTS
SVSHOST
SWEEP95
SYMPROXYSVC
SYMTRAY
SYSEDIT
SYSTEM
SYSTEM32
SYSUPD
TASKMG
TASKMO
TASKMON
TAUMON
TBSCAN
TCA
TCM
TDS-3
TDS2-98
TDS2-NT
TEEKIDS
TFAK
TFAK5
TGBOB
TITANIN
TITANINXP
TRACERT
TRICKLER
TRJSCAN
TRJSETUP
TROJANTRAP3
TSADBOT
TVMD
TVTMD
UNDOBOOT
UPDAT
UPDATE
UPDATE
UPGRAD
UTPOST
VBCMSERV
VBCONS
VBUST
VBWIN9X
VBWINNTW
VCSETUP
VET32
VET95
VETTRAY
VFSETUP
VIR-HELP
VNLAN300
VNPC3000
VPC32
VPC42
VPFW30S
VPTRAY
VSCAN40
VSCENU6.02D30
VSCHED
VSECOMR
VSHWIN32
VSISETUP
VSMAIN
VSMON
VSSTAT
VSWIN9XE
VSWINNTSE
VSWINPERSE
W32DSM89
W9X
WATCHDOG
WEBDAV
WEBSCANX
WEBTRAP
WFINDV32
WGFE95
WHOSWATCHINGME
WIMMUN32
WIN-BUGSFIX
WIN32
WIN32US
WINACTIVE
WINDOW
WINDOWS
WININETD
WININIT
WININITX
WINLOGIN
WINMAIN
WINNET
WINPPR32
WINRECON
WINSERVN
WINSSK32
WINSTART
WINSTART001
WINTSK32
WINUPDATE
WKUFIND
WNAD
WNT
WRADMIN
WRCTRL
WSBGATE
WUPDATER
WUPDT
XPF202EN
ZAPRO
ZAPSETUP3001
ZATUTOR
ZONALM2601
ZONEALARM
_AVP32
_AVPCC
_AVPM
HIJACKTHIS
F-AGOBOT
OLLYDBG
W32DSM89
TCPVIEW
REGCLEANER
RERGCLEANR
APORTS
BCW
FPORT
PMON
53ARCH
PEDASM
SRIN
CRACKER
PMDUMP
DUMP
LOADER
CLIENT
ARMKILLER
IISLOCKD
TEST
CONDOM
WINDBG
LOGGER
HONEYD
LOGVIEWER
FRHED
WINDUMP
KAV
KAVSVC
NOD32KRN
NOD32KUI
pexplorer
PROCEXP
ICESWORD - Connects to remote Web sites and attempts to download either index.htm or index.php, potentially downloading additional programs or malware
Prevention