Win32.Worm.Downadup.Gen

W32.Downadup, W32/Worm.AHGV, Net-Worm.Win32.Kido.bg

SYMPTOMS:

Connection times out while trying to access various antivirus related websites.
Windows Update has been disabled.
Presence of autorun.inf files in the root of mapped drives pointing to a .dll file inside the RECYCLER folder of  the drive.

Win32.Worm.Downadup is a worm that relies on the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (MS08-67) in order to spread on other computers in the local network. The authors took various approaches to make this malware especially fast spreading and hard to remove.

This malware always comes wrapped in an obfuscated layer which aims at deterring analysis. The layer can be in two flavors, either packed with UPX or not packed, but it is always obfuscated and uses various rarely used apis to break emulators. The real malware is contained inside in an encrypted form. It is packed with a standard upx version, but to deter unpacking it is never written on disk and it doesn’t have the PE header which makes it appear as an invalid executable. This has the side effect of being undetectable when injected into another process, it just looks as standard memory allocated page.

A computer can be infected by possible three means:
* if not patched with the latest security updates (in this case if MS08-67 vulnerability is not patched), by an already infected computer in the local network
* if the administrator account of the computer has a weak password (brute force dictionary attack against administrator password is used)
* if the computer has the Autoplay feature enabled and an infected mapped/removable drive stick is attached.

Once gained execution this worm does the following actions:
* hooks NtQueryInformationProcess from ntdll.dll inside the running process
* creates a named Mutex based on the computer name
* injects intself into one of the following processes:
* explorer.exe
* svchost.exe

* uses the following registry key to hide the files with hidden attributes:
* HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL”CheckedValue” = “0”

* executes the following command, which disables auto-tuning (details) option under Windows Vista :
* netsh interface tcp set global autotuninglevel=disabled

* copies itself into one or more of the following locations:
* %Program Files%Internet Explorer[Random Name].dll
* %Program Files%Movie Maker[Random Name].dll
* %Documents and Settings%All UsersApplication Data[Random Name].dll
* %Temp%[Random Name].dll
* %System32%[Random Name].dll

* if residing into services.exe application (Win2K) it hooks on the following apis:
* NetpwPathCanonicalize from netapi32.dll – this api is used to avoid reinfection of the local machine from other infected computers
* sendto from ws2_dll.dll

* if residing into svchost.exe it hooks the following apis
* NetpwPathCanonicalize from netapi32.dll – this api is used to avoid reinfection of the local machine from other infected computers
* DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, Query_Main from dnsapi.dll – this apis are hooked to restrict access to various sites related to antivirus companies.

* it sets maximum number of simultaneous connections allowed by doing one of the following
* patching tcpip.sys driver, using a driver it drops itself (contained in an unencrypted form)
* setting HKLMSYSTEMCurrentControlSetServicesTcpipParameters”TcpNumConnections” to “00FFFFFE”

* injects itself into services.exe (Win2K)

* it sets the following registry keys (if they are not set already), probably as an infection marker:
* HKCUSoftwareMicrosoftWindowsCurrentVersionApplets”dl” = “0”
* HKLMSOFTWAREMicrosoftWindowsCurrentVersionApplets”dl” = “0”
* HKCUSoftwareMicrosoftWindowsCurrentVersionApplets”ds” = “0”
* HKLMSOFTWAREMicrosoftWindowsCurrentVersionApplets”ds” = “0”

* Disabled the following Windows services:
* Background Intelligent Transfer Service (BITS)
* Windows Automatic Update Service (wuauserv)

* sets the following registry key to hide files with hidden attribute:
* HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL”CheckedValue” = “0”

* The worm protects itself from deletion by removing all NTFS file permissions,except execute and directory traversal, from all users.

Full Removal instructions:

Any questions, comments or suggestions may be left in the comments box below ! Thanks