Email-Worm.Win32.Zhelatin.ch

Technical Details
Payload
Removal instructions

Technical Details

This email worm is a Windows PE EXE file. The worm components vary from 7KB to 93KB in size.

Installation

When launched, the worm copies its executable file to the Windows system directory:

%System%\lnwin.exe

In order to ensure that the worm is launched automatically each time Windows is restarted, it adds a link to its executable file to the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"lnwin.exe" = "%System%\lnwin.exe"

The worm also extracts the following files from its body:

• %System%\sporder.dll – this file is 45 056 bytes in size.
• %System%\rsvp32_2.dll – this file is 8 704 bytes in size.

Payload

The worm executes a command which will allows the worm component network activity:

netsh firewall set allowedprogram %System%\lnwin.exe enable

The worm also creates a file and stores its configuration in this file:

C:\peers.ini

Every ten minutes the worm will open the following link:

http://209.123.8.***/files/ctr.php

The worm contacts the following sites belonging to the remote malicious user:

***n.voxgratia.org
***n.ekiga.net
***n.xten.com

The worm gets spam content from these sites, and will send spam to a list of addresses which it also downloads from these sites.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Reboot the computer in Safe Mode (at the start of the boot sequence, press and hold F8, then choose Safe Mode from the Windows boot menu).
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following system registry key parameter:

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "lnwin.exe" = "%System%\lnwin.exe"

4. Delete the following files:

   %System%\lnwin.exe
   %System%\rsvp32_2.dll
   %System%\sporder.dll

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).