Virus:Email-Worm.Win32.Warezov.nv

Other versions: .at , .bw , .do , .et, .ex, .gl, .iq, .jv, .jx, .la, .lb, .lg, .mf, .mx, .nd, .ns , .ns, .oa , .oi

Detection added May 17 2007 09:08 GMT
Update released May 17 2007 09:35 GMT
Description added May 23 2007
Behavior Email Worm
Technical details

This worm is a Windows PE EXE file. It is 40,960 bytes in size.

Installation

When launched, the worm creates the following files:

%System%\dnsamqut.dll
%System%\sdhccard.dll

The worm modifies the following system registry key value:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs = "dnsamqut.dll sdhccard.dll"

Propagation

This worm spreads via ICQ messages. Messages contain the following text: "Check this:" or "My party pics:". A link to the executable file of the latest variant of Warezov follows the text.

If the user opens this link in the browser, s/he will be asked if s/he wants to download and launch a file called "archive.exe”. When this file is launched, the worm will be installed to the victim machine.

Payload

The worm loads its component, %System%\dnsamqut.dll, to the following processes:

services.exe
zlclient.exe
iexplore.exe
mpftray.exe
svchost.exe
outpost.exe
firefox.exe
ccapp.exe
zapro.exe
opera.exe
smc.exe

The worm will disable a range of antivirus and firewall applications.

The worm is also about to download other malicious programs from the remote malicious user's site, and launch them for execution on the victim machine.

Removal instructions

Detection. Detection for this version of the worm was added to the Kaspersky Anti-Virus databases as an urgent update.
If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled, this malicious program will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

  1. Use Task Manager to terminate the backdoor process.
  2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
  3. Manually delete the files listed below from the Windows system directory:
    %System%\dnsamqut.dll
    %System%\sdhccard.dll
  4. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry):
    [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    AppInit_DLLs = "dnsamqut.dll sdhccard.dll"
  5. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).
HOME