Viruslist.com - Email-Worm.Win32.Zhelatin.a

Detection added	Jan 19 2007 23:23 GMT
Description added	Jan 31 2007
Behavior	Email Worm
Platform	Win32

This worm spreads via the Internet as an attachment to infected messages. Infected messages will be sent to all email addresses harvested from the victim machine.

The worm itself is a Windows PE EXE file. The file size may vary significantly. The file is packed using UPX.

Installation

When installing, the worm copies itself (with the attribute ‘hidden’) to the Windows system directory as “alsys.exe”:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Agent" = "%System%\alsys.exe…"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Agent" = "%System%\alsys.exe…"

This ensures that the worm will be launched each time Windows is booted on the victim machine.

The worm creates a file with a random name in the current directory. This file will be detected by Kaspersky Anti-Virus as Trojan-Proxy.Win32.Lager.dp

%System%\wincom32.ini
%System%\wincom32.sys

wincom32.sys is a Rootkit library which will be loaded as a service driver and which works at kernel level. This program is designed to hide the presence of worm files on the hard disk and to mask entries in the system registry.

The Trojan also creates a unique identifier, “klllekkdkkd” to flag its presence in the system.

The worm also changes the following system registry entry in order to block “Windows Firewall/Internet Connection Sharing (ICS)”:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
[HKLM\System\ControlSet001\Services\SharedAccess]
"Start" = "4"

Propagation via email

Infected messages will be sent to all email addresses harvested from the victim machine.

In order to send messages the worm attempts to establish a direct connection to the recipient's SMTP server.

Infected messages:

Message subject (chosen at random from the list below):

Attachment name (chosen at random from the list below):

The worm attempts to terminate processes if the name of the process contains one of the strings listed below:

If the worm finds files with an .exe or a .scr extension on the victim machine, the worm will copy itself to the directory where the file is located under a randomly generated name with the attribute hidden: <random file name>.t. The worm then infects the file it found by adding its code to this file and changing the entry point, ensuring that when the executable file is launched, the copy of the worm will be launched first.

Detection for this version of the worm were added to the Kaspersky Anti-Virus databases as an urgent update.

If you have Kaspersky Anti-Virus 6.0, and Proactive Protection is enabled, this worm will be detected without the need to update antivirus databases.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

All Threats

Viruses

Hackers

Spam

Email-Worm.Win32.Zhelatin.a

Installation

Propagation via email

Infected messages:

Message subject (chosen at random from the list below):

Attachment name (chosen at random from the list below):