Home Malware Programs Worms Worm.Rorpian.E

Worm.Rorpian.E

Posted: September 30, 2011

Threat Metric

Threat Level: 5/10
Infected PCs: 69
First Seen: September 30, 2011
OS(es) Affected: Windows

Worm.Rorpian.E is a malicious computer worm that proliferates via network shares and by exploiting the Domain Name System (DNS) Server Service vulnerability. Worm.Rorpian.E also downloads and installs additional malware infections on the infected computer system. Worm.Rorpian.E makes some system changes, that is, contacts a particular IP address to download some files and modifies the registry. Worm.Rorpian.E replicates by enumerating all network shares; copying itself to the share, together with numerous other files. Worm.Rorpian.E also creates an 'autorun.inf' file that initiates Worm.Rorpian.E executable when the share is accessed, and a shortcut .lnk file which exploits the certain vulnerability. Worm.Rorpian.E does a network scan in order to find exploitable computers, copying itself to the computer if it is vulnerable. Delete Worm.Rorpian.E as early as possible from the affected machine.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



mexcore4.jpg File name: mexcore4.jpg
Size: 45.03 KB (45034 bytes)
MD5: 99621a5bfd631668152881504a7daf00
Detection count: 86
Mime Type: unknown/jpg
Group: Malware file
Last Updated: October 3, 2011
mexcore4.jpg File name: mexcore4.jpg
Size: 41.05 KB (41054 bytes)
MD5: 6930688a9bd13c2a5453fb47a37b7426
Detection count: 82
Mime Type: unknown/jpg
Group: Malware file
Last Updated: October 3, 2011
mexcore4.jpg File name: mexcore4.jpg
Size: 39.79 KB (39794 bytes)
MD5: ca48e9f36ca1eecc9ba391e13eb70c4e
Detection count: 77
Mime Type: unknown/jpg
Group: Malware file
Last Updated: October 3, 2011
mexcore4.jpg File name: mexcore4.jpg
Size: 41.44 KB (41448 bytes)
MD5: f6dd892067970d117bc2b782a44ba439
Detection count: 76
Mime Type: unknown/jpg
Group: Malware file
Last Updated: October 3, 2011
mexcore4.jpg File name: mexcore4.jpg
Size: 38.96 KB (38968 bytes)
MD5: b213998570638b78fded10f371d5b0fc
Detection count: 75
Mime Type: unknown/jpg
Group: Malware file
Last Updated: October 3, 2011
%TEMP%\srv8E0.tmp File name: %TEMP%\srv8E0.tmp
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file
%TEMP%\srv8E0.ini File name: %TEMP%\srv8E0.ini
Mime Type: unknown/ini
Group: Malware file
setup.fon File name: setup.fon
Mime Type: unknown/fon
Group: Malware file
setup.lnk File name: setup.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
myporno.avi.lnk File name: myporno.avi.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
pornmovs.lnk File name: pornmovs.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file
autorun.inf File name: autorun.inf
Mime Type: unknown/inf
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKLM\system\currentcontrolset\services\srv\"imagepath"="%systemroot%\system32\svchost.exe -k netsvcs"HKLM\system\currentcontrolset\services\srv\parameters\"servicedll"="\\?\globalroot\device\harddiskvolume1\%TEMP%\srv.tmp"HKLM\software\microsoft\windows nt\currentversion\svchost\"netsvcs"= "srv"HKLM\system\currentcontrolset\control\safeboot\minimal\srv\"(default)"="service"
Loading...