Problem: |
WORM_DOWNAD is capable of doing the following:
|
•
|
Connects to various time servers to determine the current date and time
|
|
•
|
Registers itself as a system service to ensure auto execution every startup
|
|
•
|
Deletes a registry key to prevent system startup in safe mode
|
|
•
|
Terminates security-related processes (i.e. procexp, regmon, autoruns, gmer etc.)
|
|
•
|
Blocks access to security and antivirus websites
|
|
•
|
Generates 50,000 malicious URLs and attempts to connect to around 500 random generated URLs at a time
|
|
•
|
Disables services such as Windows Automatic Update Service (wuauserv)
|
|
•
|
Causes high traffic on affected system's port 445 upon successful exploitation
|
|
•
|
Creates [random filename].dll and autorun.inf in all mapped drives
|
|
•
|
Creates [random filename].dll and autorun.inf on internet explorer and movie maker folder under program files directory
|
|
•
|
Hides hidden files in Folder Options
|
|
•
|
Attempts to connect to several URLs to download a file that indicates the location of the affected system
|
|
•
|
Users cannot login using their windows credentials because it is locked out
|
|
| |