Net-Worm.Win32.Kido.ir

Technical Details
Payload
Removal instructions

Technical Details

The kido worm family creates files autorun.inf and RECYCLED\{SID<....>}\RANDOM_NAME.vmx on removable drives (sometimes on public network shares)

Net-Worm.Win32.kido.ir is a windows startup script (AUTORUN.INF file). The size of the file is between 59,284 to 95,034 bytes. Not packed.

Payload

When an infected removable storage media is connected to an autorun enabled computer, this script starts the kido worm.

The content of the autorun script is obfuscated with a ransom set of characters.

Once unobfuscated, the autorun script looks like this:

[AUTorUN] AcTION = Open folder to view files icon =% 
syStEmrOot% \ sySTEM32 \ 
sHELL32.Dll, 4 OpEn = RunDll32.EXE. \ RECYCLER \ S-5-3-42-
2819952290-8240758988-
879315005-3665 \ jwgkvsq. vmx, ahaezedrn sHEllExECUTe = 
RUNdLl32.ExE. \ RECYCLER \
S-5-3-42-2819952290-8240758988-879315005-3665 \ 
jwgkvsq.vmx, ahaezedrn useAuTopLAY = 1

We learn from this script that the original worm dll is located in the following folder on the removable media:

. \ RECYCLER \ S-5-3-42-2819952290-8240758988-879315005-
3665 \ jwgkvsq.vmx

The autorun script displays the following sentence "Open folder to view files" on an english Windows.

Removal instructions

If your computer does not have an up-to-date antivirus solution, or does not have an antivirus solution at all, you can either use a special removal tool (which can be found here or follow the instructions below:

1. Delete the files shown below from all removable storage media:

   <X>:\autorun.inf
   <X>:\RECYCLER\S-<%d%>-<%d%>-%d%>-%d%>-%d%>-%d%>-%d%>\<rnd>.vmx,
   

2. Download and install updates for the operating system:
   http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
3. Disable Autorun on the computer.
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).