Email-Worm.Win32.Warezov.mx

• Technical details
• Payload
• Removal instructions

This worm is a Windows PE EXE file, which is 89,116 bytes in size, and packed using Upack. The unpacked file is approximately 237KB in size.

Installation

When launching, the worm creates the following files:

It also creates the following system registry key:

Propagation

This worm uses ICQ to spread. The link below is sent with the message "Try it".

When the user opens the link in the web browser, s/he will be asked if he wants to download and launch a file called "flash.exe" which actually contains the latest version of the worm.

The worm injects its component %System%\msjidpmo.dll into the following processes:

The worm will disable antivirus and firewall applications on the victim machine.

It may also download other malicious programs from the remote malicious user's site and launch them for execution on the victim machine.

An urgent antivirus database update to detect this program was released.

If you are using Kaspersky Anti-Virus 6.0, enable Proactive Protection, and this malicious program will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Taske Manager to delete the process associated with the original worm file.
2. Delete the original worm file (its location will depend on how it originally penetrated the computer).
3. Manually delete the following files from the Windows system directory:
   %System%\msjidpmo.dll
   %System%\msssmsda.dll
   %System%\msssmsda.exe
4. Delete the following registry key:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msssmsda]
5. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).