WORM_KILLAV.VTG

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Program Files%\Common Files\realteck\geoidx.pif

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It creates the following folders:

• %Program Files%\Common Files\realteck
• %User Profile%\Microsoft\Dr Watson

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other System Modifications

This worm deletes the following files:

• %System%\CeJb.dzn

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
FaultCount = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
FaultTime = b63

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
LogSessionName = "stdout"

(Note: The default value data of the said registry entry is stdout.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
Active = 1

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
ControlFlags = 1

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi\ImapiSvc
Guid = "8107d8e9-e323-49f5-bba2-abc35c243dca"

(Note: The default value data of the said registry entry is 8107d8e9-e323-49f5-bba2-abc35c243dca.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi\ImapiSvc
BitNames = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

(Note: The default value data of the said registry entry is ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DrWatson
NumberOfCrashes = 1

(Note: The default value data of the said registry entry is 0.)

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
IEAK\GroupPolicy\PendingGPOs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PCHealth\ErrorReporting\DW

Dropping Routine

This worm drops the following files:

• %System%\42203.DIL
• %System%\CeJb.dzn
• %Temp%\mem0wye0.TMP
• %User Profile%\Dr Watson\drwtsn32.log
• %User Profile%\Dr Watson\user.dmp

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

This report is generated via an automated analysis system.