Email-Worm.Win32.Warezov.qy

Technical Details

This worm spreads via email. The worm does not place a copy of itself in the attachment to infected emails, but a component which is able to download other malicious programs via the Internet.

Infected messages will be sent to all email addresses harvested from the victim machine.

The worm itself is a Windows PE EXE file. It is 123,392 bytes in size. It is packed using UPX. The unpacked file is approximately 150KB in size.

Installation

When launched, the worm copies its executable file to the Windows system directory as "w32tcomr.exe":

It drops the following file, which is 110,592 bytes in size.

The worm also creates the following system registry key:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\w32tcomr.exe]
"DllName" = "%System%\w32tcomr.exe"
"Startup" = "WlxStartupEvent"
"Shutdown" = "WlxShutdownEvent"
"Impersonate" = dword:00000000
"Asynchronous" = dword:00000000

Propagation via email

The worm harvests email addresses from the Windows address books.

The worm uses its own SMTP engine to send infected messages.

Infected messages:

Message subject:

Message body:

Attachment name:

The attachment contains a component of the worm which is capable of downloading other malicious programs via the Internet. This file has the following name:

Payload

Payload of main component

The worm is able to terminate a range of processes, and to delete services related to antivirus solutions and firewalls.

The worm’s main executable file will download other malicious programs from the remote malicious user’s site and install them to the victim machine.

The worm will search all files on the hard disk for email addresses, and send them to the remote malicious user's site.

Payload of component mailed as attachment

This component will download other files from the Internet without the knowledge or consent of the user.

The component will download the most recent variant of the worm from a specified site. The link to the site is coded into the component's body.

The downloaded file will be saved to the Windows temporary directory under a random name. The file will then be launched for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the backdoor process.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry).
   [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\w32tcomr]
4. Delete the following files:

   %System%\w32tcomr.exe
   %System%\w32tcomr.dll

5. Delete all infected messages from all mail folders.
6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).