Virus:Email-Worm.Win32.Warezov.ns

• Technical details
• Payload
• Removal instructions

This worm spreads via the Internet as an attachment to infected messages. The attachment does not contain a copy of the worm, but a component which downloads other malicious programs via the Internet.

Infected messages will be sent to all email addresses harvested from the victim machine.

The worm itself is a Windows PE EXE file. It is packed using UPX. Modifications of this program may vary in size, from 14KB to 98KB.

Installation

When launched, the worm causes the following message to be displayed:

The worm then copies its executable file to the Windows system directory as "xvidusrc.exe":

It creates the following files, which is 98,304 bytes in size:

The worm also creates the following system registry key:

Propagation via email

The worm harvests email addresses from the Windows address books.

The worm uses its own SMTP engine to send infected messages.

Example of an infected message:

The attachment contains a component of the worm which is capable of downloading other malicious programs via the Internet. Attachment name:

Payload of main component

The worm is able to terminate a range of processes, and to delete services related to antivirus solutions and firewalls.

The worm's main executable file will download other malicious programs from the remote malicious user's site and install them to the victim machine.

Payload of component mailed as attachment

This component will be sent by the worm's main component. It will download other files from the Internet without the knowledge or consent of the user.

This component downloads a file from the following link:

At the moment of writing, the most recent version of the worm's executable file was located on this link.

The downloaded file will be saved to the Windows temporary directory under a random name. The file will then be launched for execution.

Detection. Detection for this version of the worm was added to the Kaspersky Anti-Virus databases as an urgent update.
If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled, this worm will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the backdoor process.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Manually delete the files listed below from the Windows system directory:
   %System%\xvidusrc.dll
   %System%\xvidusrc.exe
4. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry):
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hotpmsta]
5. Delete all infected messages from all mail folders.
6. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).