Email-Worm.Win32.Warezov.lb

Technical Details
Payload
Removal instructions

Technical Details

This worm is a Windows PE EXE file. It is 103,459 bytes in size. It is packed using Upack. The unpacked file is approximately 270KB in size.

Installation

When launched, the worm creates the following files:

%System%\msgimp43.dat
%System%\msgimp43.exe
%System%\msgimp43.dll

The worm also creates the following system registry key:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msgimp43]
"DllName" = "%System%\msgimp43.dll"
"Startup" = "WlxStartupEvent"
"Shutdown" = "WlxShutdownEvent"
"Impersonate" = dword:00000000
"Asynchronous" = dword:00000000

Propagation

This worm spreads via ICQ messages.

It sends a message which reads "Check this:” or "My party pics:". The text is followed by a link which leads to the latest modification of the worm. The following links are used:

http://******elasutedios.com/storage/2520/
http://******aterdasetion.com/2/708/
http://******lihuitunhades.com/storage/9677/

If the user opens this link in the browser, s/he will be asked if s/he wants to download and launch a file called "archive.exe”, which is the latest version of the worm. When this file is launched, the worm will be installed to the victim machine.

Payload

The worm will disable a range of antivirus and firewall applications.

The worm is also about to download other malicious programs from the remote malicious user’s site, and launch them for execution on the victim machine.

Removal instructions

Detection for this version of the worm was added to the Kaspersky Anti-Virus databases as an urgent update.

If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled, this malicious program will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the process associated with the original worm file.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Manually delete the files listed below from the Windows system directory:

   %System%\msgimp43.dat
   %System%\msgimp43.exe
   %System%\msgimp43.dll

4. Delete the following registry key:

   [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msgimp43]

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).