IRC-Worm.Randon.I

( N/A )

SYMPTOMS:

Presence of the registry key:
[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\explorer= \"c:\\windows\\system\\expl32.exe\"].

Presence of the following files in Windows\\System folder:
aim.txt
AImIRC.ini
bla.txt
bnc.dll
config.hfg
crazy.exe
cscan.dat
dtkode.txt
empavms.exe
EXPL32.EXE
impvms.dll
innocent
ipservers.txt
lan.bat
Libparse.exe
miconfig.exe
moo.dll
msccl.dll
newuser.bat
nhtml.dll
nicks.txt
nvdrv.ocx
psexec.exe
ratsou.exe
reg.xpl
remote.ini
restart.exe
script1.dll
spig.txt
sysboot.dll
syste32.dll
system.exe
temp
unicod_look
unicod_ready
werty.bat
wincmd34.bat
wind.dll
WININET.DLL

Newer version of the worm will have these instead:

Presence of the registry key:
[HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\lsass=\"%SYSTEM%\\lsass.exe\"]
where %SYSTEM% points to Windows\\System folder.

Presence of the following files in %SYSTEM% folder:
aim.dll
aim.txt
boot.exe
c.dll
dr.exe
empavms.exe
flood.ocx
gt.exe
ipservers.dll
java.dll
lan.bat
Libparse.exe
lsass.exe
miconfig.exe
moo.dll
msccl.dll
msconig.exe
newuser.bat
nhtml.dll
ratsou.exe
regedit.dll
remote.ini
restart.exe
screen.dll
sipg.ocx
start.ocx
sysboot.dll
sysconfig.ocx
syste32.dll
temp
unicod_look
unicod_ready
users.dll
werty.bat
wincmd34.bat
wind.dll
zhid.exe

TECHNICAL DESCRIPTION:

This worm spreads through IRC and is in fact a collection of backdoors, trojans, ddos programs and exploits, all packed in one executable file. The worm arrives as an exe file, through Mirc. Once this file is executed, the aforementioned registry key and files are created, and EXPL32.EXE (or LSASS.EXE for newer version) is run, thus giving the attacker complete control over the infected computer. It can download and install newer versions of itself from an internet address, files GT.EXE or GT2.EXE using its downloader component.

Removal instructions:

1. If you don\'t have BitDefender installed click here to download an evaluation version.


2. Make the following changes in the windows registry:
   
   

   Note: Please make sure to modify only the values that are specified. It is also recommended to backup the windows registry before proceeding with these changes. For more information on backing the registry please read the FAQ.

   
   
   1. Select Run... from Start, then type regedit and press Enter;
      
   2. Delete the following key:
      [HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\lsass=\"%SYSTEM%\\lsass.exe\"]
      where %SYSTEM% points to Windows\\System folder.
   
   
3. Perform a full scan of your system (selecting, from the Action tab, the option Prompt user for action). Choose to delete all the files infected with IRC-Worm.Randon.I

ANALYZED BY:

Patrick Vicol
BitDefender Virus Researcher