Internet Security Threats

Email-Worm.Win32.Warezov.ms

RISK LEVEL:2

This worm spreads via the Internet as an attachment to infected messages.The attachment does not contain a copy of the worm, but a component which downloadsother malicious programs via the Internet.

Infected messages will be sent to all email addresses harvested from the victimmachine.

The worm itself is a Windows PE EXE file. The size of the worm componentsvaries from 19KB to 130KB in size.

Installation

When launching, the worm causes an error message to be displayed:

During installation, the worm copies its executable file to the Windows systemdirectory under the following name:

%System%\iasnx9tc.exe

It then creates the following file:

%System%\iasnx9tc.dll

This file is 113 895 bytes in size.

The worm also creates the following system registry key:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iasnx9tc]
"DllName"="%System%\iasnx9tc.dll"
"Startup"="WlxStartupEvent"
"Shutdown"="WlxShutdownEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

Propagation via email

The worm harvests email addresses from the Windows address books.

The worm uses its own SMTP engine to send infected messages.

Infected messages

The attachment is a worm component which is capable of downloading other maliciousprograms via the Internet.

The worm’s main executable file downloads other malicious programs fromthe remote malicious user’s site and installs them to the victim machine.

Payload of component mailed as attachment

This component will be sent by the worm's main component. It will downloadother files from the Internet without the knowledge or consent of the user.

This component downloads a file from the following link:

http://***eradesunme.com/ntsrv32.exe

At the moment of writing, the latest version of the worm’s executablefile was placed on this link.

This file will be saved to the Windows temporary directory with a temporaryname, and then launched for execution.

Detection for this version of the worm were added to the Kaspersky Anti-Virusdatabases as an urgent update.

If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled,this worm will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the process associated with theoriginal worm file.
2. Delete the original worm file.
3. Manually delete the files listed below from the Windows systemdirectory:

   %System%\iasnx9tc.exe%System%\iasnx9tc.dll

4. Delete the following registry key:

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iasnx9tc]

5. Delete all infected messages from all mail folders.
6. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).