Threat behavior
Worm:Win32/SillyShareCopy.AC is a worm that spreads by dropping copies of itself in all writeable drives. It may also delete music files from removable drives.
Installation
When executed, Worm:Win32/SillyShareCopy.AC attempts to drop a copy of itself as the file C:\music.exe.
It then attempts to create the following files:
- %windir%\backup.reg - creates registry autostart entry (see below)
- %windir%\runreg.bat - executes backup.reg
The dropped file backup.reg may then create the following registry entry to enable the dropped copy of this virus to run every time Windows starts:
Adds value: "music"
With data: "c:\music.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Spreads Via...
Logical Drives
Worm:Win32/SillyShareCopy.AC attempts to spreads by creating a copy of itself in the root of each drive as music.exe, for example, D:\music.exe. It also drops the hidden file autorun.inf, which ensures that if the Autorun option is enabled, the worm copy is automatically run when the drive is accessed. It performs this routine every minute to ensure that newly-inserted removable drives are reinfected.
In addition, this worm also creates copies of itself as <folder name>.exe in the folders and subfolder of removable drives. For example, if a removable drive has a folder named My Pictures, this worm creates a copy of itself as My Pictures.exe using a folder icon. This may trick a user into thinking that a folder is being opened, when the worm copy is actually run.
Payload
Deletes Files
Worm:Win32/SillyShareCopy.AC searches for and deletes files with the MP3 extension in all removable drives.
Analysis by Patrik Vicol
Prevention
