W32/Motsys Worm

 Information about the W32/Motsys Worm:

W32/Motsys is a worm. The worm will infect Windows systems and spreads by copying itself to removable drives.

Upon execution, the worm creates the following files in the Windows System folder:

auToRun.inf
NeTb.dll
NeTc.dll
NeTv.dll
NeTx.dll
NeTz.dll
Systom.exe
sos.exe

The worm modifies the registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"crsss"

It also modifies the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\"CheckedValue"
HKEY_USERS\S-1-5-21-1150637735-552541835-915212665-500\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr"
HKEY_USERS\S-1-5-21-1150637735-552541835-915212665-500\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\"DisableWindowsUpdateAccess"
HKEY_USERS\S-1-5-21-1150637735-552541835-915212665-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"Hidden"
HKEY_USERS\S-1-5-21-1150637735-552541835-915212665-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"HideFileExt"

The worm tries to connects to the following web sites:

http://www.ip127.cn/lm/xz/(Removed)
http://www.xinyouyu.cn/xxx/(Removed)
http://www.ip127.cn/lm/xz/(Removed)
http://www.ip127.cn/lm/xz/tj.(Removed)

It then deletes all the .GHO files on the infected computer.

The worm copies itself as sos.exe and Systom.exe in the root of all removable drives.

It also copies auToRun.inf in the root of all removable drive so that it executes whenever the drive is accessed.

The worm adds the following <iframe> tag to all .htm files:

<IfrAmE src = http://www.ip127.cn/lm/wm/inde(Removed) width=50 height=0> </IfrAmE>

It also adds the above <iframe> tag to all files with the following names:

index.php
index.asp
default.php
default.asp
conn.asp

This worm first appeared on November 19, 2007.

 Other names of W32/Motsys Worm:

This Worm is also known as W32.Motsys.