Worm.Win32.Soriw

Summary

• Performs potentially dangerous activity

Technical details

File size of 235779 bytes.

Installation

Makes copies of itself with the following names once launched:

• Windows directory (usually, C:\Windows)%Windir%\system\Services.exe

Creates the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\Temp\D2J0D2NEOIDJFEM7.PT2

Malicious activity

Checks for Dial-Up connections on the infected computer

Creates unique identifiers to flag its presence in the system

• MAIN SERVICES

Uses the masks shown below to search for files on the victim machine:

• *.*

Other activities

Runs the following files (commands):

• netstat -a
• nbtstat -s
• tasklist
• schtasks
• systeminfo
• Windows directory (usually, C:\Windows)%Windir%\system\Services.exe

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters ] "TrapPollTimeMilliSecs" = "0x3A98"

Deletes the following files on an infected computer:

• Windows directory (usually, C:\Windows)%Windir%\Temp\B2EDEFBEP2H7TW8L.V7F
• Windows directory (usually, C:\Windows)%Windir%\Temp\SN1H9AXYQP1W67DL.AGN
• Windows directory (usually, C:\Windows)%Windir%\Temp\KT063Y8L7EBQE4YW.N16
• Windows directory (usually, C:\Windows)%Windir%\Temp\7645JKKHT504S99R.1WT
• Windows directory (usually, C:\Windows)%Windir%\Temp\AWGIJDBNDGD8G87Y.IFD