Internet threat level: 1
Home→Descriptions→Email-Worm.Win32.Zhelatin.db
Email-Worm.Win32.Zhelatin.db
| Detected | Apr 26 2007 11:27 GMT |
| Released | Jun 24 2007 19:00 GMT |
| Published | Apr 26 2007 11:27 GMT |
Payload
Removal instructions
Technical Details
This email worm is a Windows PE EXE file. The file is 64 000 bytes in size. It is packed using AsPack. The unpacked file is approximately 151KB in size.
Installation
When launching, the worm extracts the following file from its body:
%WinDir%\rsvp32_2.dll - this file is 118784 bytes in size.
Payload
When %WinDir%\rsvp32_2.dll is launched, it will load itself to the following processes:
alg.exe lsass.exe winlogon.exe svchost.exe
Once loaded into a process, the library will attempt to connect to the remote malicious user’s site and download text for a spam mailing, and a list of addresses to which the spam is sent.
The mass mailing is conducted using a multifunctional engine incorporated in the worm. Messages will be sent via the following protocols:
ICQ AIM Yahoo Messenger SMTP Jabber
Removal instructions
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
- Reboot the computer in Safe Mode (at the start of the boot sequence, press and hold F8, then choose Safe Mode from the Windows boot menu).
- Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
- Delete the following file:
%WinDir%\rsvp32_2.dll
- Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website).
In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated.
Email-Worms use a range of methods to send infected emails. The most common are:
- using a direct connection to a SMTP server using the email directory built into the worm’s code
- using MS Outlook services
- using Windows MAPI functions.
Email-Worms use a number of different sources to find email addresses to which infected emails will be sent:
- the address book in MS Outlook
- a WAB address database
- .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses
- emails in the inbox (some Email-Worms even “reply” to emails found in the inbox)
Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.
Email-Worm.
- W32/Nurech.
H. worm (Panda)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.