Selected viruses, spyware, and other threats: sorted alphabetically

O
P
Q
R
S
T
U
V
W
X
Y
Z
Glossary

MSIL/Zamog.A

Aliases:	P2P-Worm.MSIL.Lolmehot.a (Kaspersky), W32.SillyFDC.BDL (Symantec), Generic.dx!rxe trojan (McAfee)
Type of infiltration:	Worm
Size:	122034 B
Affected platforms:	Microsoft Windows
Signature database version:	5044 (20100420)

Short description

MSIL/Zamog.A is a worm that spreads via shared folders and removable media.

Installation

When executed the worm copies itself in the following locations:

%temp%svchost.exe
%systemdrive%ntldr.exe
%system%driverstmpp.exe

In order to be executed on system start, the worm sets the following Registry entry:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion
Winlogon]
"Userinit" = "%system%Userinit.exe,%temp%svchost.exe"

The following Registry entries are set:

[HKEY_CURRENT_USERIdentitiesSoftwareMicrosoftOutlook Express
5.0signatures]
"Default Signature" = "C:WINDOWSsystem32.htm/f"
[HKEY_CURRENT_USERSoftwarePatchouMessenger Plus! Live
GlobalSettingsScriptsMSN PLUS]
"background" = "C:WINDOWSsystem32.htm"
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
ExplorerAdvanced]
"Hidden" = 1

Spreading on removable media

The worm copies itself into the root folders of removable drives using the following filename:

ntldr.exe

The worm creates the following file:

%drive%autorun.inf

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The %drive%ntldr.exe, %drive%autorun.inf file(s) may have the System (S) and Hidden (H) attributes present in attempt to hide the file in Windows Explorer.

Spreading via P2P networks

The worm creates copies of itself in folders accesed by the following application:

BearShare
eDonkey2000
eMule
Gnucleus
Grokster
ICQ

The following filename is used:

%username%_naked.exe
%variable%.exe
%variable%.rar
%variable%ea-keygen.exe
%variable%ea-keygen.rar
1000_worm_sources.exe

The %variable% represents a random number.

Spreading via shared folders

The worm searches for computers in the local network. It tries to copy itself in the following folders on a remote machine:

C$
IPC$
Admin$
D$
Print$

The worm tries to copy itself to the available shared network folders.

The following filename is used:

funny.scr
LOOL.pif
STUPID.scr
INSTALL.scr
README.scr
%variable%.scr

The following usernames are used:

administrator
admin
%username%

The following passwords are used:

%username%
admin
administrator
ass
bla
bla123

A string with variable content is used instead of %variable%.

Other information

The worm creates the following files:

%system%launch.bat
%system%launch.vbs
%system%launchh.bat
%system%launchh.vbs
%system%net.vbs
%windir%tmpp.log

The %variable% represents a random number.

The worm tries to download several files from the Internet.

The worm connects to the following addresses: