Email-Worm.Win32.Warezov.mx

Technical Details

This worm is a Windows PE EXE file, which is 89,116 bytes in size, and packed using Upack. The unpacked file is approximately 237KB in size.

Installation

When launching, the worm creates the following files:

%System%\msjidpmo.dll
%System%\msssmsda.dll
%System%\msssmsda.exe

It also creates the following system registry key:

Propagation

This worm uses ICQ to spread. The link below is sent with the message "Try it".

http://***.cuhasefunjinksa.com/1/6696/

When the user opens the link in the web browser, s/he will be asked if he wants to download and launch a file called "flash.exe" which actually contains the latest version of the worm.

Payload

The worm injects its component %System%\msjidpmo.dll into the following processes:

services.exe
zlclient.exe
iexplore.exe
mpftray.exe
svchost.exe
outpost.exe
firefox.exe
ccapp.exe
zapro.exe
opera.exe
tsmc.exe

The worm will disable antivirus and firewall applications on the victim machine.

It may also download other malicious programs from the remote malicious user’s site and launch them for execution on the victim machine.

Removal instructions

An urgent antivirus database update to detect this program was released.

If you are using Kaspersky Anti-Virus 6.0, enable Proactive Protection, and this malicious program will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Taske Manager to delete the process associated with the original worm file.
2. Delete the original worm file (its location will depend on how it originally penetrated the computer).
3. Manually delete the following files from the Windows system directory:

   %System%\msjidpmo.dll
   %System%\msssmsda.dll
   %System%\msssmsda.exe

4. Delete the following registry key:

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msssmsda]

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).