McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

VBS/Doli.worm

This page shows details and results of our analysis on the malware VBS/Doli.worm

Threat Detail

Malware Type: Virus

Malware Sub-type: Worm

Discovery Date: 2007-09-05

Next Steps:

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.


Minimum DAT

5113 (2007-09-05)

Updated DAT

5171 (2007-11-26)

 Minimum Engine

4.4.00

File Length

N/A

 Description Added

2007-09-05

Description Modified

2007-11-22

Malware Proliferation

Characteristics

Files

The worm drops the following files:

%Sysdir%\winini.vbs
%Sysdir%\snd44.gif
%Sysdir%\user44.ico
%Sysdir%\VbScr.xml

And it copies itself as:

%Sysdir%\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Temporary Internet Files\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\Application Data\Microsoft\CD Burning\www.MacDonald.com-index.htm
%UserProfile%\Favorites\www.MacDonald.com-index.htm
%UserProfile%\Local Settings\History\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Music\www.MacDonald.com-index.htm
%UserProfile%\My Documents\My Pictures\www.MacDonald.com-index.htm
%UserProfile%\My Documents\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\Programs\www.MacDonald.com-index.htm
%UserProfile%\Start Menu\www.MacDonald.com-index.htm

And it also may copy itself at one of the following locations:

%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#imen_nannou@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#ahlem_3ishk@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amina_kissme@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amel_sousse@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sana_hammamet@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#molka_nabeul@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#noura_sfax@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#amani_staracademy@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sandra_algerie@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#madiha_ariana@yahoo.fr.htm
%UserProfile%\Desktop\e-mail from#sonia_malhat_manar2@yahoo.fr.htm

Moreover, if the worm is executed more than 8 times, it will copy itself 99 times under:
%UserProfile%Desktop\message_sandwich{random number}.htm

It creates a copy of itself in the root of all fixed, removable and network drives it finds (except A:\), using the filename www.MacDonald.com-index.htm.

It may copy itself as {filename}.{ext}.vbs if there are some files with one of the following extensions in the sub-folders of the drives:
*.mp3
*.mpg
*.doc
*.xls
*.jpg
(The decision is made randomly).

It infects all .htm and .html files found in the sub-folders of the fixed, removable and network drives.

Registry

  • The worm modifies the following registry entry to count the number of executions of the script:

HKEY_LOCAL_MACHINE\"shell" = "{counter}"

  • It creates the following registry entries to force the execution of the worm at startup or when Internet Explorer is executed:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\"Start Page" = "%Sysdir%\www.MacDonald.com-index.htm"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Winini.dll" = "C:\WINDOWS\system32\winini.vbs"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SaMail" = "%UserProfile%\Desktop\e-mail from#Sarah_icqGroup@yahoo.fr.htm" (the filename may change. The other possibilities are listed above)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"kernel44.dll" = "taskkill /f /fi "PID ge 0" /im *"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "taskkill /f /fi "PID ge 0" /im *"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys1" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys2" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys3" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys4" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys5" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys6" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys7" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys8" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys9" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys10" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys11" = "freecell"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys12" = "freecell"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys33" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys34" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys35" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys36" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys37" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys38" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys39" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys40" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys41" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys42" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys43" = "winmine"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys44" = "winmine"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys65" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys66" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys67" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys68" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys69" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys70" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys71" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys72" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys73" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys74" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys75" = "iexplore"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"l44sys76" = "iexplore"

  • If the worm is executed more than 6 times, it creates the following subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LIDO44.FILE

  • And it modifies these registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.3gp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ace\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dat\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.frm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gif\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ini\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.jpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mdb\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mov\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp2\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mp3\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpeg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mpg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msg\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ocx\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pdf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ppt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tar\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.txt\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xls\"" = "LIDO44.FILE"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\"" = "LIDO44.FILE"
HKEY_CURRENT_USER\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_USERS\.DEFAULT\Control Panel\International\"sTimeFormat" = "LIDO44 @ NO TIME !!!"
HKEY_CURRENT_USER\Console\"FullScreen" = "1"
HKEY_CURRENT_USER\Console\"ScreenColors" = "4"

  • It disables the taskmanager too:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"

  • And finally, if the worm is executed more than 8 times, it modifies these registry entries:

HKEY_CURRENT_USER\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_USERS\.DEFAULT\Control Panel\Mouse\"SwapMouseButtons" = "1"
HKEY_CURRENT_USER\Control Panel\Colors\"Background" = "200 100 100"
HKEY_CURRENT_USER\Control Panel\Desktop\"Wallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"OriginalWallpaper" = "C:\WINDOWS\system32\snd44.gif"
HKEY_CURRENT_USER\Control Panel\Desktop\"WallpaperStyle" = "2"
HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\"Shell Icon Size" = "72"

Symptoms

  • The presence of the above files and registry entries.
  • Increase in file size for .html and .htm files
  • The following notification may appear in the systray:

  • The startpage is changed and the following webpage appears when Internet Explorer is opened:


Method of Infection

The virus may arrive on the compromised computer through an infected .html page.

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

Variants

United States - English