Internet Security Threats

Email-Worm.Win32.Warezov.lg

RISK LEVEL:2

This modification of Warezov is a component which is used by other variantsin this family. It is a Windows DLL file. It is 364,544 bytes in size.

Installation

When loaded, the file will check which process it is loaded into. If the processis called "winlogon.exe", the following files will be extracted to the Windowssystem directory:

%System%\wmvprf32.dll %System%\wmvstat.dll%System%\confwmv.dll %System%\wmvconf.exe

This files will be detected by Kaspersky Anti-Virus as other modificationsof Warezov: Email-Worm.Win32.Warezov.lf,Email-Worm.Win32.Warezov.lgand Email-Worm.Win32.Warezov.kz.

To ensure that its components are loaded when Windows is rebooted, the wormadds a link to them in the system registry key:

The worm scans open windows for fields where passwords will be entered. Itwill harvest data entered in the fields.

The worm also disables system security components by simulating a click on‘OK’ in the relevant dialogue boxes.

The worm also creates an SMTP proxy server on a random TCP port, and sendsthe IP address of the victim machine and the number of the open port to theremote malicious user’s site. It also sends the information which it harvestedto the site.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Delete the original worm file (the location will depend on howthe program originally penetrated the victim machine).
2. Delete the following files:

   %System%\wmvprf32.dll %System%\wmvstat.dll%System%\confwmv.dll %System%\wmvconf.exe

3. Delete the following system registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "wmvdiag" = "<path and name of worm executable file>"
4. Delete the strings "confwmv.dll" and "wmvstat.dll" from the followingsystem registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   "AppInit_DLLs"
5. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).