Email-Worm.Win32.Warezov.oi

Technical Details
Payload
Removal instructions

Technical Details

This worm is a Windows PE EXE file. The file is 88,826 bytes in size.

It is packed using Upack. The unpacked file is approximately 237KB in size.

Installation

When launched, the worm creates the following files:

%System%\dmimmsss.dll
%System%\dmimmsss.exe

The worm also creates the following system registry key:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dmimmsss]
"DllName" = "%System%\dmimmsss.dll"
"Startup" = "WlxStartupEvent"
"Shutdown" = "WlxShutdownEvent"
"Impersonate" = dword:00000000
"Asynchronous" = dword:00000000

Propagation

This worm spreads via ICQ messages. Messages contain the following text: "Check this:" or "My party pics:". A link to the executable file of the latest variant of Warezov follows the text.

If the user opens this link in the browser, s/he will be asked if s/he wants to download and launch a file called "photo.pif”. When this file is launched, the worm will be installed to the victim machine.

Payload

The worm loads its component, %System%\ dmimmsss.dll, to the following processes:

services.exe
zlclient.exe
iexplore.exe
mpftray.exe
svchost.exe
outpost.exe
firefox.exe
ccapp.exe
zapro.exe
opera.exe
smc.exe

The worm will disable a range of antivirus and firewall applications.

The worm is also able to download other malicious programs from the remote malicious user’s site, and launch them for execution on the victim machine.

Removal instructions

Detection. Detection for this version of the worm was added to the Kaspersky Anti-Virus databases as an urgent update.
If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled, this malicious program will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the backdoor process.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Manually delete the files listed below from the Windows system directory:

   %System%\dmimmsss.dll
   %System%\dmimmsss.exe

4. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry):

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dmimmsss]

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).