Worm.Dorkbot

Worm.Dorkbot is a malicious worm which spreads through instant messaging services such as Windows Live and Yahoo! Messenger, and removable drives. This malicious worm also contains backdoor functionality, which will grant complete access to remote attackers to the infected PC. Worm.Dorkbot also operates under various aliases, one of which is:

Trojan.Win32.Scar.drih

This worm was first released on 9 March 2011, and has gone on to infect thousands of PCs across the globe. What makes it even more dangerous is the fact that Worm.Dorkbot does not present any obvious symptoms, and the only symptoms that would indicate the presence of the worm on the PC will come from installed security software. This will make it much more difficult for the user to detect and remove Worm.Dorkbot from the system.

After Worm.Dorkbot enters the system, it will execute itself and copy itself to the %AppData% directory using randomly generated 6 letter file names, as an example ozkqke.exe. It will modify the following entry to execute this file at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: ""
With data: "%appdata%\.exe"

One running, Worm.Dorkbot will inject its code into explorer.exe, as well as into many other running processes on the infected PC. The number of processes Worm.Dorkbot is able to inject into depends on whether it has been run with administrator privileges.

Worm.Dorkbot will connect to particular IRC servers, joining channels and waiting for further commands from its developers. Following is a list of servers Worm.Dorkbot has been known to connect to without the user’s knowledge:

shuwhyyu.com
lovealiy.com
yegyege.com

Developers behind Worm.Dorkbot can instruct the worm to obtain the affected PC’s IP address and location by connecting to api.wipmania.com. It will then collect the infected PC’s operating system type, current user privilege level and locale.

The worm will also be instructed to stop the user from viewing or altering its files. This is done by hooking the following functions inside which it is injected:

NtQueryDirectoryFile
NtEnumerateValueKey
CopyFileA/W
DeleteFileA/W

The worm will also block the user’s access to the following security websites:

avast.
avg.
avira.
bitdefender.
bullguard.
clamav.
comodo.
emsisoft.
eset.
fortinet.
f-secure.
garyshood.
gdatasoftware.
heck.tc
iseclab.
jotti.
kaspersky.
lavasoft.
malwarebytes.
mcafee.
necare.live.
norman.
norton.
novirusthanks
onlinemalwarescanner.
pandasecurity.
precisesecurity.
sophos.
sunbeltsoftware.
symantec

In order to get rid of Worm.Dorkbot, and limit the damage this malicious threat will be able to cause your PC destroy Worm.Dorkbot with the help of a powerful security tool, which will also adequately protect your PC against similar attacks in future.