Virus:Email-Worm.Win32.Warezov.jx
Other versions: .at , .bw , .do , .et, .ex, .gl, .iq, .jv, .la , .lb , .lg , .ms , .mx , .nd , .nf , .ns , .nv , .oa , .oi
| Detection added | Jan 18 2007 04:15 GMT |
| Update released | Jan 18 2007 05:24 GMT |
| Description added | Apr 10 2007 |
| Behavior | Email Worm |
| Technical details |
This modification of Warezov is a component which is used by other program versions in the same family.
The component is sent by the worm as an attachment to infected emails. It is a Windows PE EXE file, 16,609 bytes in size, packed using Upack. The unpacked file is approximately 94KB in size.
| Payload |
Examples of infected messages:
The main function of this component is to download and install the latest version of the Warezov worm to the victim machine.
When launching, Warezov.jx causes the following message to be displayed on the screen:
It then downloads a file from the following link:
http://www6.badesugerwakirpos.com/***/907/nt.exe(At the moment of writing this link was not working.)
This file will be saved to the Windows temporary directory and launched for execution.
| Removal instructions |
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
- Use Task Manager to terminate the worm process.
- Delete the original worm file (its location will depend on how it originally penetrated the victim machine).
- Delete the contents of %Temp%.
- Delete all infected messages from all mail folders.
- Update your antivirus databases and perform a full scan of the victim machine ( download a trial version of Kaspersky Anti-Virus).