Detection added	Dec 27 2007 08:29 GMT
Update released	Dec 27 2007 11:51 GMT
Description added	Apr 18 2008
Behavior	Internet Worm

• Technical details
• Payload
• Removal instructions

This worm creates copies of itself on removable storage media. It is a Windows PE EXE file. It is 115760 bytes in size.

Installation

Once launched, the worm copies its executable file to the Windows system directory:

In order to ensure that the worm is launched automatically each time the system is restarted, the worm adds a link to its executable file to the system registry:

The worm also extracts the following file from its body:

This file is 89088 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-PSW.Win32.OnLineGames.mbs.

Propagation

The worm copies its executable file to the root of each partition under the following name:

In addition to its executable file, the worm also places the file shown below in the root directory of every disk:

<X> indicates the relevant partition.

This file will launch the worm's executable file each time the user opens the infected partition using Explorer.

The worm loads the .dll file to all active processes.

The worm also intercepts mouse and keyboard events if one of the processes listed below has been launched:

The worm harvests account data relating to the following games:

Harvested data is sent to the remote malicious user's site.

The worm also modifies the following system registry key parameter values:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Reboot the computer.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following system registry key parameter values:
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "kava" = "%System%\kavo.exe"
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidde
   n\SHOWALL]
   "CheckedValue" = "0"
   [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   "Hidden" = "2"
   [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   "ShowSuperHidden" = "0"
   [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Pocilies\Explorer]
   "NoDriveTypeAutoRun" = "0x91"
4. Delete the following files:
   %Temp%\<rnd>.dll
   %System%\kavo0.dll
5. Delete the following files from all removable disks:
   <X>:\XAdeIect.com
   <x>:\autorun.inf

   <X> stands for the letter of the removable disk.

6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).