W32.HLLW.Bodiru

1. Attempts to copy itself as the following files:
   • C:\W32.rudeboi.exe
   • A:\Home Work.doc.pif
   • C:\Norton Anitivirus 2004.exe
   • C:\Rude Boi(Full Screen Saver).scr
   • C:\Windows\System\Windows Tools.exe
   • C:\Windows\System\W32.rudeboi.exe
   • C:\WINNT\System32\Windows Tools.exe
   • C:\WINNT\System32\W32.rudeboi.exe
   • C:\Windows\System32\Darkness_Krew (OWnZ ya).exe
   • C:\Windows\System\Live update.pif
   • C:\WINNT\System32\Windows Update.exe
   • C:\Windows\System32\Windows Update.pif
   • C:\Win98\Start menu\Programs\Startup\Windows Update.exe
   • C:\Win95\Start menu\Programs\Startup\Config.pif
   • C:\WinMe\Start menu\Programs\Startup\System.scr
   • C:\Windows\Start menu\Programs\Startup\Help.exe
   • C:\Documents and Settings\All Users\Start menu\Programs\Startup\Windows Update.exe
   • C:\Documents and Settings\Administrator\Start menu\Programs\Startup\Config.pif
   • C:\Documents and Settings\Default User\Start menu\Programs\Startup\Windows Update.exe
   • C:\WINNT\Profiles\All Users\Start menu\Programs\Startup\windows Update.exe
   • C:\WINNT\Profiles\Administrator\Start menu\Programs\Startup\windows Update.exe
     
     In each case, the attempt will fail if the folder does not exist.
     
     
2. Attempts to make several hundred copies of itself in the following folders:
   • C:\Program Files\eMule\Incoming\
     
     Refer to the "Additional information" section for the file names under which the worm copies itself into these folders. In each case, the attempt will fail if the folder does not exist.
     
     
   • C:\Program Files\Kazaa\My shared folder
   • C:\Program Files\Kazaa Lite K++\My shared folder
   • C:\Program Files\eDonkey2000\Incoming\
     
     
3. Creates the following files:
   • <original folder>\W32.DARKNESS_KREW.exe
   • <original folder>\1nfected.exe
   • \Darkness_Krew
     
     These three files are identical. They are severely damaged versions of the worm and do not pose a threat. However, Symantec antivirus products detect them.
     
     
   • \[Darkness_Krew].txt (a harmless text file which is not detected by Symantec antivirus products)
   • C:\Administrator (a harmless text file which is not detected by Symantec antivirus products).
     
     
4. Attempts to prepend the first 28,672 bytes of the worm code to the following files, and thus, corrupts them:
   • C:\Program Files\Winzip\WINZIP32.exe
   • C:\Program Files\Norton AntiVirus\Navw32.exe
   • C:\Program Files\MSN Messenger\Msnmsgr.exe
   • C:\Windows\Wscript.exe
   • C:\Windows\Rundll.exe
   • C:\Windows\Rundll32.exe
   • C:\Winnt\Regedit.exe
   • C:\Windows\System\Underwater.scr
   • C:\Windows\Regedit.exe
   • C:\Winnt\Regedit.exe
   • C:\Winnt\System32/Regedit.exe (this file cannot exist because the filename is illegal)
     
     If any file in this list does not exist but the folder does (for example, the file C:\Windows\System\Underwater.scr does not exist but the folder C:\Windows\System does), then the worm will create the file with a length of zero bytes before prepending the contents of W32.DARKNESS_KREW.exe to the file.
     
     
5. Uses the ping program to send ICMP Echo Request packets (of size 65,500 bytes) to the hosts symantec.com and mess.be in an attempted DoS attack. The worm starts four instances of the ping program (two for each host pinged), and each instance sends ICMP Echo Request packets at a rate of one per second.
   
   
6. Attempts to end the following processes:
   • _AVP.EXE
   • _AVP32.EXE
   • _AVPM.EXE
   • ANTI-TROJAN.EXE
   • APVXDWIN.EXE
   • AUTODOWN.EXE
   • AVCONSOL.EXE
   • AVE32.EXE
   • AVGCTRL.EXE
   • AVKSERV.EXE
   • AVNT.EXE
   • AVP.EXE
   • AVP32.EXE
   • AVPCC.EXE
   • AVPDOS32.EXE
   • AVPM.EXE
   • AVPMON.EXE
   • AVPNT.EXE
   • AVPTC32.EXE
   • AVPUPD.EXE
   • AVSCHED32.EXE
   • AVWIN95.EXE
   • AVWUPD32.EXE
   • BLACKD.EXE
   • BLACKICE.EXE
   • CCAPP.EXE
   • CFIADMIN.EXE
   • ESAFE.EXE
   • CFIAUDIT.EXE
   • CFIND.EXE
   • CFINET.EXE
   • CFINET32.EXE
   • CLAW95.EXE
   • CLAW95CF.EXE
   • CLAW95CT.EXE
   • CLEANER.EXE
   • CLEANER3.EXE
   • DV95.EXE
   • DV95_O.EXE
   • DVP95.EXE
   • DVP95_0.EXE
   • TerminateEXE
   • ECENGINE.EXE
   • EFINET32.EXE
   • ESPWATCH.EXE
   • F-AGNT95.EXE
   • FINDVIRU.EXE
   • FPROT.EXE
   • F-PROT.EXE
   • FPROT95.EXE
   • F-PROT95.EXE
   • FP-WIN.EXE
   • FRW.EXE
   • F-STOPW.EXE
   • IAMAPP.EXE
   • IAMSERV.EXE
   • IBMASN.EXE
   • IBMAVSP.EXE
   • ICLOAD95.EXE
   • ICLOADNT.EXE
   • ICMON.EXE
   • ICMOON.EXE
   • ICSSUPPNT.EXE
   • ICSUPP95.EXE
   • ICSUPPNT.EXE
   • IFACE.EXE
   • IOMON98.EXE
   • JED.EXE
   • JEDI.EXE
   • KPF.EXE
   • KPFW32.EXE
   • LOCKDOWN2000.EXE
   • LOOKOUT.EXE
   • LUALL.EXE
   • mcafee.exe
   • MOOLIVE.EXE
   • MPFTRAY.EXE
   • N32SCAN.EXE
   • N32SCANW.EXE
   • navapsvc.exe
   • NAVAPW32.EXE
   • NAVLU32.EXE
   • NAVSCHED.EXE
   • NAVW.EXE
   • NAVW32.EXE
   • NAVWNT.EXE
   • NISUM.EXE
   • NMAIN.EXE
   • NORMIST.EXE
   • NUPGRADE.EXE
   • NVC95.EXE
   • OUTPOST.EXE
   • PADMIN.EXE
   • PAVCL.EXE
   • PAVSCHED.EXE
   • PAVW.EXE
   • PCCWIN98.EXE
   • PCFWALLICON.EXE
   • PERSFW.EXE
   • RAV7.EXE
   • RAV7WIN.EXE
   • RESCUE.EXE
   • SAFEWEB.EXE
   • SCAN32.EXE
   • SCAN95.EXE
   • SCANPM.EXE
   • SCRSCAN.EXE
   • SERV95.EXE
   • SMC.EXE
   • SPHINX.EXE
   • SWEEP95.EXE
   • TBSCAN.EXE
   • TCA.EXE
   • TDS2-98.EXE
   • TDS2-NT.EXE
   • VCONTROL.EXE
   • VET32.EXE
   • VET95.EXE
   • VET98.EXE
   • VETTRAY.EXE
   • VSCAN40.EXE
   • VSECOMR.EXE
   • VSHWIN32.EXE
   • vsmon.exe
   • VSSCAN40.EXE
   • VSSTAT.EXE
   • WEBSCAN.EXE
   • WEBSCANX.EXE
   • WFINDV32.EXE
   • zaplus.exe
   • ZAPRO.EXE
   • zonealarm.EXE
     
     
7. Adds the value:
   
   "App.EXEName"="<folder containing the worm>\.exe"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   The author's intention appears to be to have the worm start when Windows starts, but this entry in the registry has no effect.
   
   
8. Ends the processes that have the following strings in the title bar:
   • MS-DOS Prompt
   • Norton Antivirus
   • Registry Editor
   • Windows Task Manager
   • System Configuration Utility

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.
• Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available.
• Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.
• Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.
• If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.
• If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device's visibility is set to "Hidden" so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to "Unauthorized", requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources.
• For further information on the terms used in this document, please refer to the Security Response glossary.