Email-Worm.Win32.Warezov.mo

Technical Details

This malicious program is a worm. It was originally mass mailed. It is a Windows PE EXE file. The worm components vary in size from 102KB to 165KB.

Installation

When launching, the worm extracts the following files from its body to the Windows system directory:

%System%\diagisr.dll
%System%\isrprf32.dll
%System%\isrprov.exe
%System%\117X4sHrH5C.dll

In order to ensure that the worm is launched automatically when the system is rebooted, the worm adds a link to its executable file to the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"himem.exe" = "<path to executable worm file> -s"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "%System%\diagisr.dll"

Payload

The worm injects its component, %System%\diagisr.dll into the following processes:

iexplore.exe
services.exe
firefox.exe
opera.exe
zlclient.exe
zapro.exe
smc.exe
ccapp.exe
outpost.exe
mpftray.exe

This component then applies special procedures for evading security software to each of the processes. These procedures vary from process to process, but are all based on imitating the user clicking on a button to allow access to a network or to allow other suspicious activity.

The worm also attempts to disable services relating to the following security software:

Zone Labs Zone Alarm
Sygate Personal Firewall
Symantec Internet Security
Agnitum Outpost Firewall
Kaspersky Anti-Virus Personal

The main worm component harvests contact information from the Microsoft Outlook address book and from the Yahoo Messenger contact list.

The harvested data will be uploaded to one of the remote malicious user’s site:

****kerunskdarun.com
****dinkionkderunjsa.com
****linkdeshkina.com
****ionkertunhasderun.com
****ionkdesunjafunhde.com
****tunjinkderunhasdefun.com
****dunkinmdespish.com
****dinjertiona.com
****erunkiondemfunhas.com
****uiceshkin.com
****etionkasde.com
****onlderunjadesunjerpas.com
****sariomdesin.com
****onjderinjdaserinjde.com
****onmdefunshjin.com
****ionkdesunjadewionsa.com
****defunjdesa.com
****defunhsadefuinn.com
****dasetiondegnas.com
****onkdesunjadefinpiomi.com
****onkdaerinjdefunhsa.com
****onkadesunjionkasde.com
****ndefunhasetrionde.com
****jinpiontunyunde.com
****runjionkdefunhasde.com
****suntiondeunwaserun.com
****sunjiokderunjdaserin.com
****sinlinmaspion.com
****funtionkderunhsa.com
****derionjdepisadrin.com
****dnegunhfaxesun.com
****djeinkdadeisna.com
****nsadehungans.com
****esinjertiopasde.com
****duewnahsuewaa.com
****nmdefuhawuinde.com
****kirationdefun.com
****unkionmasderunhas.com
****ionkdrunjdapolinkdun.com
****npasdinkerinjjas.com
****esunjionderunshishu.com

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the backdoor process.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry).

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "himem.exe" = "<path to executable worm file> -s"

4. Revert the following system registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   "AppInit_DLLs" = "%System%\diagisr.dll"

   to the original value:

   "AppInit_DLLs" = " "
5. Delete all infected messages from all mail folders.
6. Reboot the computer.
7. Delete the following files:
   %System%\diagisr.dll
   %System%\isrprf32.dll
   %System%\isrprov.exe
   %System%\117X4sHrH5C.dll
8. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).