W32/Tanexor.A Worm

 Information about the W32/Tanexor.A Worm:

W32/Tanexor.A is a worm. The worm will infect Windows systems and spreads through removable storage devices.

Upon execution, the worm copies itself as down.exe in the Window System folder. It also creates down.exe and autorun.inf in all the local drives including removable drives.

It also creates a service with the following characteristics:

Service name: power1_k
Display name: Provisioning Service Transaction

The worm modifies registry at the following locations;

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\power1_k
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

It attempts to download a file from: http://tenax.com.cn/i(Removed)

The worm stops the AVP and wscsvc services.

It also terminates the following processes, some of which are related to security applications:

avp.exe
kavsvc.exe
Ravmon.exe
RavmonD.exe

It also opens a back door connection on TCP port 8002 to power1k.3322.org and sends version information and the hardware description to a remote user. It then awaits for commands form the remote attacker.

It allows the remote attacker to perform the following;

FLOOD (including syn/udp/get/icmp)
REMOVE
DOWNLOAD
STOPATTACK
UPDATEDATA

This worm first appeared on December 21, 2006.

 Other names of W32/Tanexor.A Worm:

This Worm is also known as W32.Tanexor.A.