Detection added	Jan 07 2008 06:44 GMT
Update released	Jan 07 2008 10:10 GMT
Description added	Oct 07 2008
Behavior	Internet Worm

• Technical details
• Payload
• Removal instructions

This worm propagates by creating copies of itself on local disks and write-accessible network resources. It is a Windows PE EXE file. It is 46592 bytes in size. It is packed using UPX. The unpacked file is approximately 107MB in size.

Installation

The worm copies its executable file to the Windows system directory:

In order to ensure that the worm is launched automatically each time the system is booted, it adds a link to its executable file in the system registry:

The worm extracts a rootkit library from its body and saves it to the Windows temporary directory:

This files masks the worm process in the system.

Propagation

The worm copies its executable file to the root of each drive as follows:

In addition to its executable file, the worm also places the file shown below in the root directory of every disk:

This file will launch the worm's executable file each time the user opens the infected disk using Explorer.

The worm modifies the following system registry key parameter to make it impossible to write to it:

The worm contains a Trojan component designed to steal account data for the online game Perfect World. The program searches the system for a process called "elementclient.exe". If it finds this process, it searches the directory for the following file:

It then harvests the following parameter values:

It also reads the "elementclient.exe" process memory and harvests the following variables:

• User name
• Password
• Sum of virtual money

Harvested data is sent in an HTTP request to the following servers:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the malicious program’s process.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following system registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Rising" = "<path to worm file>"
4. Delete the copy of the worm from all removable disks:
   <X>\<rnd1>[<:rnd2>].exe
   <X> stands for the letter of the removable disk.
5. Empty the temporary directory (%Temp%).
6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).