This worm spreads via the Kazaa and iMesh file-sharing networks, and also
via IRC.
The worm itself is a Windows PE EXE file, approximately 12KB in size.
Installation
Once launched, the worm creates a folder called "Sys32i" in the Program
Files directory, and copies itself to this file as "Scran.exe".
This file is registered in the system registry as a key to enable
autorun:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
W32.Scran = %ProgramDir%\sys32i\Scran.exe
This ensures that the worm will be launched each time the system is
rebooted.
The worm creates several more copies of itself under the following names:
Age of Empires crack.exe
Age of Empires.exe
CD Key.exe
Counter Strike 6.exe
Counter Strike.exe
Grand Theft Auto 3 CD2 ISO.exe
Half-Life.exe
Hotmail account cracker.exe
Hotmail Hack.exe
KeyGen.exe
Microsoft Office.exe
Norton Anti Virus 2004.exe
Norton Anti Virus 2005.exe
Norton Anti Virus Crack.exe
Norton Firewall.exe
Norton Internet Security 2004.exe
Partition Magic 8.exe
Playstation 2.exe
Resident Evil.exe
Scran.cpl
Tomb Raider.exe
Trojan Remover.exe
Windows XP Home.exe
Yahoo Hack.exe
ZoneAlarm Firewall Pro.exe
This folder will be shown in the system registry as Local Content for
Kazaa and iMesh:
[HKCU\Software\Kazaa\LocalContent]
[HKCU\Software\Kazaa\Transfer]
"dir0" = "012345:%ProgramDir%\sys32i"\
[HKCU\Software\iMesh\Client\LocalContent]
"dir0" = "012345:%ProgramDir%\sys32i\"
These files will then be accessible to other users of the P2P networks.
The worm creates an identifier "W32.Scran-Worm" to flag its presence in the system.
Propagation via IRC
The worm searches the victim machine for an IRC client. If it detects one,
it will change the contents of the "script.ini" file so that the worm will be passed to all
users who enter IRC channels used by the infected machine.
Other
The worm will download a file named "botnet.jpg" from http://www.freewebs.
com. This file will be saved in the C: root directory as "botnet.exe". This file contains
the latest version of Backdoor.Win32.Rbot.gen.
On the 1st January, the worm will cause a dialogue box containing the
following text to be displayed on the screen:
Ha?
Happy New Year W32.Scran!!
Check out if we have free
removal tool for this virus
