Virus:Email-Worm.Win32.Warezov.ex

• Technical details
• Payload
• Removal instructions

This Warezov variant is a component which is used by other variants of the Warezov family. It is a Windows DLL file. The file is 9,216 bytes in size.

Installation

This malicious program will be installed on the victim machine by another malicious program.

The worm stops and deletes the following services:

The program also checks the victim machine for the following file:

If this file is present, the worm adds a link to its executable file in the following system registry parameter:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the following registry key value:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   "AppInit_DLLs" = "<path to worm file> "
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).