Content

W32/Specx.worm

Type
Virus
SubType
Internet Worm
Discovery Date
06/18/2003
Length
27,483
Minimum DAT
4273 (06/25/2003)
Updated DAT
4307 (12/03/2003)
Minimum Engine
5.1.00
Description Added
06/20/2003
Description Modified
11/17/2005 4:39 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This is an internet worm that propagates via KaZaA and iMesh peer-to-peer network.

When run, the worm displays a fake error message box as shown below:

The worm copies itself into %WinDir%/system32 directory as the following file:

  • iexplore32.exe

It creates the following registry key in order to load itself as Windows startup:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "IELoader32" = "iexplore32.exe"

The worm adds/modifies the following registry keys to enable P2P file sharing:

  • HKEY_CURRENT_USER\Software\iMesh\Client\LocalContent
    "Dir0" = 012345:C:\WINNT\System32\drivers32\
  • HKEY_CURRENT_USER\Software\KAZAA\LocalContent
    "Dir0" = 012345:C:\WINNT\System32\drivers32\

It creates the following directory:

  • %Windir%\system32\drivers32

It copies itself into the directory as various files. The file names include the following:

  • ACDSee 2.4.x Crack.exe
  • ACDSee 2.4.x Serial Generator.exe
  • Ad-aware 6.0 Crack.exe
  • Ad-aware 6.0 Serial Generator.exe
  • Adobe Acrobat 5.x Crack.exe
  • Adobe Acrobat 5.x Serial Generator.exe
  • Adobe Photoshop 7.x Crack.exe
  • Adobe Photoshop 7.x Serial Generator.exe
  • Adobe Photoshop 8.x Crack.exe
  • Adobe Photoshop 8.x Serial Generator.exe
  • Age of Mythology - The Titans No-Cd Crack.exe
  • Age of Mythology - The Titans Serial Generator.exe
  • Age of Wonders II - Shadow Magic No-Cd Crack.exe
  • Age of Wonders II - Shadow Magic Serial Generator.exe
  • Alpha Communicator 5.0 Crack.exe
  • Alpha Communicator 5.0 Serial Generator.exe
  • Armor2net Personal Firewall 3.1 Crack.exe
  • Armor2net Personal Firewall 3.1 Serial Generator.exe
  • Battlefield 1942 - Secret Weapons of World War II No-Cd Crack.exe
  • Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe
  • Battlefield 1942 - The Road to Rome No-Cd Crack.exe
  • Battlefield 1942 - The Road to Rome Serial Generator.exe
  • Black & White 2 No-Cd Crack.exe
  • Black & White 2 Serial Generator.exe
  • Chrome No-Cd Crack.exe
  • Chrome Serial Generator.exe
  • Civilization III - Conquest No-Cd Crack.exe
  • Civilization III - Conquest Serial Generator.exe
  • CloneCD 4.x Crack.exe
  • CloneCD 4.x Serial Generator.exe
  • CloneCD 5.0 Crack.exe
  • CloneCD 5.0 Serial Generator.exe
  • Command & Conquer Generals No-Cd Crack.exe
  • Command & Conquer Generals Serial Generator.exe
  • Commandos 3 - Destination Berlin No-Cd Crack.exe
  • Commandos 3 - Destination Berlin Serial Generator.exe
  • Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe
  • Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe
  • Counter-Strike - Condition Zero No-Cd Crack.exe
  • Counter-Strike - Condition Zero Serial Generator.exe
  • DAP Plus 5.3 Crack.exe
  • DAP Plus 5.3 Serial Generator.exe
  • Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe
  • Dark Age of Camelot - Trials of Atlantis Serial Generator.exe
  • Delta Force - Black Hawk Down No-Cd Crack.exe
  • Delta Force - Black Hawk Down Serial Generator.exe
  • Direct Connect 1.x Crack.exe
  • Direct Connect 1.x Serial Generator.exe
  • Divx 5.x Crack.exe
  • Divx 5.x Serial Generator.exe
  • DOOM 3 No-Cd Crack.exe
  • DOOM 3 Serial Generator.exe
  • DOOM III No-Cd Crack.exe
  • DOOM III Serial Generator.exe
  • Download Accelerator Plus 5.3 Crack.exe
  • Download Accelerator Plus 5.3 Serial Generator.exe
  • Easy CD-DA Extractor 5.1 Crack.exe
  • Easy CD-DA Extractor 5.1 Serial Generator.exe
  • Easy CD-DA Extractor 5.x Crack.exe
  • Easy CD-DA Extractor 5.x Serial Generator.exe
  • Elder Scrolls III - Tribunal No-Cd Crack.exe
  • Elder Scrolls III - Tribunal Serial Generator.exe
  • Etherlords II No-Cd Crack.exe
  • Etherlords II Serial Generator.exe
  • EverQuest 2 No-Cd Crack.exe
  • EverQuest 2 Serial Generator.exe
  • F1 2002 No-Cd Crack.exe
  • F1 2002 Serial Generator.exe
  • FIFA Soccer 2003 No-Cd Crack.exe
  • FIFA Soccer 2003 Serial Generator.exe
  • FIFA Soccer 2004 No-Cd Crack.exe
  • FIFA Soccer 2004 Serial Generator.exe
  • FireStarter No-Cd Crack.exe
  • FireStarter Serial Generator.exe
  • FlashFXP 1.4 Crack.exe
  • FlashFXP 1.4 Serial Generator.exe
  • FlashFXP 1.x Crack.exe
  • FlashFXP 1.x Serial Generator.exe
  • FlashGet 1.3 Crack.exe
  • FlashGet 1.3 Serial Generator.exe
  • FlashGet 1.x Crack.exe
  • FlashGet 1.x Serial Generator.exe
  • Flight Simulator - Century of Flight No-Cd Crack.exe
  • Flight Simulator - Century of Flight Serial Generator.exe
  • Freedom - Soldiers of Liberty No-Cd Crack.exe
  • Freedom - Soldiers of Liberty Serial Generator.exe
  • GeoWhere 2.11 Crack.exe
  • GeoWhere 2.11 Serial Generator.exe
  • GeoWhere 2.x Crack.exe
  • GeoWhere 2.x Serial Generator.exe
  • GetRight 5.0 Crack.exe
  • GetRight 5.0 Serial Generator.exe
  • GetRight 5.x Crack.exe
  • GetRight 5.x Serial Generator.exe
  • GetRight 6.x Crack.exe
  • GetRight 6.x Serial Generator.exe
  • Grand Theft Auto - Vice City No-Cd Crack.exe
  • Grand Theft Auto - Vice City Serial Generator.exe
  • Half-Life 2 No-Cd Crack.exe
  • Half-Life 2 Serial Generator.exe
  • Half-Life II No-Cd Crack.exe
  • Half-Life II Serial Generator.exe
  • Half-Life No-Cd Crack.exe
  • Half-Life Serial Generator.exe
  • Halo No-Cd Crack.exe
  • Halo Serial Generator.exe
  • Harry Potter - Quidditch World Cup No-Cd Crack.exe
  • Harry Potter - Quidditch World Cup Serial Generator.exe
  • Hex Workshop Hex Editor 4.1 Crack.exe
  • Hex Workshop Hex Editor 4.1 Serial Generator.exe
  • Hitman 2 No-Cd Crack.exe
  • Hitman 2 Serial Generator.exe
  • Hitman 3 No-Cd Crack.exe
  • Hitman 3 Serial Generator.exe
  • Hitman II No-Cd Crack.exe
  • Hitman II Serial Generator.exe
  • Hitman III No-Cd Crack.exe
  • Hitman III Serial Generator.exe
  • IconPackager 2.12 Crack.exe
  • IconPackager 2.12 Serial Generator.exe
  • IconPackager 2.x Crack.exe
  • IconPackager 2.x Serial Generator.exe
  • ICUII 5.7 Crack.exe
  • ICUII 5.7 Serial Generator.exe
  • ICUII 5.x.exe
  • IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe
  • IL-2 Sturmovik - Forgotten Battles Serial Generator.exe
  • Internet Download Manager 3.15 Crack.exe
  • Internet Download Manager 3.15 Serial Generator.exe
  • Internet Download Manager 3.x Crack.exe
  • Internet Download Manager 3.x Serial Generator.exe
  • Internet Turbo 2003 5.4 Crack.exe
  • Internet Turbo 2003 5.4 Serial Generator.exe
  • Internet Turbo 2003 5.x Crack.exe
  • Internet Turbo 2003 5.x Serial Generator.exe
  • KaZaA Speedup 3.03 Crack.exe
  • KaZaA Speedup 3.03 Serial Generator.exe
  • KaZaA Speedup 3.x Crack.exe
  • KaZaA Speedup 3.x Serial Generator.exe
  • Kings of War No-Cd Crack.exe
  • Kings of War Serial Generator.exe
  • Knights of the Temple No-Cd Crack.exe
  • Knights of the Temple Serial Generator.exe
  • LingoWare 3.0 Crack.exe
  • LingoWare 3.0 Serial Generator.exe
  • Lord of the Rings - The Two Towers No-Cd Crack.exe
  • Lord of the Rings - The Two Towers Serial Generator.exe
  • Lord of the Rings - War of the Ring No-Cd Crack.exe
  • Lord of the Rings - War of the Ring Serial Generator.exe
  • Lords of EverQuest No-Cd Crack.exe
  • Lords of EverQuest Serial Generator.exe
  • Lords of the Realm III No-Cd Crack.exe
  • Lords of the Realm III Serial Generator.exe
  • Macromedia Flash MX 6.x Crack.exe
  • Macromedia Flash MX 6.x Serial Generator.exe
  • Madden NFL 2003 No-Cd Crack.exe
  • Madden NFL 2003 Serial Generator.exe
  • Madden NFL 2004 No-Cd Crack.exe
  • Madden NFL 2004 Serial Generator.exe
  • Max Payne 2 - The Fall of Max Payne No-Cd Crack.exe
  • Max Payne 2 - The Fall of Max Payne Serial Generator.exe
  • MechWarrior 3 No-Cd Crack.exe
  • MechWarrior 3 Serial Generator.exe
  • MechWarrior 4 No-Cd Crack.exe
  • MechWarrior 4 Serial Generator.exe
  • MechWarrior 5 No-Cd Crack.exe
  • MechWarrior 5 Serial Generator.exe
  • MechWarrior III No-Cd Crack.exe
  • MechWarrior III Serial Generator.exe
  • MechWarrior IV No-Cd Crack.exe
  • MechWarrior IV Serial Generator.exe
  • MechWarrior V No-Cd Crack.exe
  • MechWarrior V Serial Generator.exe
  • Medal of Honor - Allied Assault Breakthrough No-Cd Crack.exe
  • Medal of Honor - Allied Assault Breakthrough Serial Generator.exe
  • Metal Gear Solid 2 No-Cd Crack.exe
  • Metal Gear Solid 2 Serial Generator.exe
  • Metal Gear Solid 3 No-Cd Crack.exe
  • Metal Gear Solid 3 Serial Generator.exe
  • Metal Gear Solid III No-Cd Crack.exe
  • Metal Gear Solid III Serial Generator.exe
  • Metal Gear Solid No-Cd Crack.exe
  • Metal Gear Solid Serial Generator.exe
  • Microangelo 5.58 Crack.exe
  • Microangelo 5.58 Serial Generator.exe
  • Microangelo 5.x Crack.exe
  • Microangelo 5.x Serial Generator.exe
  • Microangelo 6.x Crack.exe.exe
  • Microangelo 6.x Serial Generator.exe.exe
  • Midtown Madness 2 No-Cd Crack.exe
  • Midtown Madness 2 Serial Generator.exe
  • Midtown Madness 3 No-Cd Crack.exe
  • Midtown Madness 3 Serial Generator.exe
  • Midtown Madness II No-Cd Crack.exe
  • Midtown Madness II Serial Generator.exe
  • Midtown Madness III No-Cd Crack.exe
  • Midtown Madness III Serial Generator.exe
  • mIRC 6.03 Crack.exe
  • mIRC 6.03 Serial Generator.exe
  • mIRC 6.x Crack.exe
  • mIRC 6.x Serial Generator.exe
  • MusicMatch Jukebox 8.0 Crack.exe
  • MusicMatch Jukebox 8.0 Serial Generator.exe
  • MusicMatch Jukebox 8.x Crack.exe
  • MusicMatch Jukebox 8.x Serial Generator.exe
  • MVP Baseball 2003 No-Cd Crack.exe
  • MVP Baseball 2003 Serial Generator.exe
  • NASCAR Racing 2003 No-Cd Crack.exe
  • NASCAR Racing 2003 Serial Generator.exe
  • NASCAR Thunder 2003 No-Cd Crack.exe
  • NASCAR Thunder 2003 Serial Generator.exe
  • NASCAR Thunder 2004 No-Cd Crack.exe
  • NASCAR Thunder 2004 Serial Generator.exe
  • NBA Live 2003 No-Cd Crack.exe
  • NBA Live 2003 Serial Generator.exe
  • NBA Live 2004 No-Cd Crack.exe
  • NBA Live 2004 Serial Generator.exe
  • NCAA Football 2003 No-Cd Crack.exe
  • NCAA Football 2003 Serial Generator.exe
  • NCAA Football 2004 No-Cd Crack.exe
  • NCAA Football 2004 Serial Generator.exe
  • Need for Speed Underground No-Cd Crack.exe
  • Need for Speed Underground Serial Generator.exe
  • Nero Burning ROM 5.5.x Crack.exe
  • Nero Burning ROM 5.5.x Serial Generator.exe
  • Nero Burning ROM 6.x Crack.exe
  • Nero Burning ROM 6.x Serial Generator.exe
  • NetPumper 1.03 Crack.exe
  • NetPumper 1.03 Serial Generator.exe
  • Network Cable e ADSL Speed 1.0.6 Crack.exe
  • Network Cable e ADSL Speed 1.0.6 Serial Generator.exe
  • Network Cable e ADSL Speed 1.x Crack.exe
  • Network Cable e ADSL Speed 1.x Serial Generator.exe
  • Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe
  • Neverwinter Nights - Shadows of Undrentide Serial Generator.exe
  • NHL 2002 No-Cd Crack.exe
  • NHL 2002 Serial Generator.exe
  • NHL 2003 No-Cd Crack.exe
  • NHL 2003 Serial Generator.exe
  • Paint Shop Pro 8.x Crack.exe
  • Paint Shop Pro 8.x Serial Generator.exe
  • Paint Shop Pro 9.x Crack.exe
  • Paint Shop Pro 9.x Serial Generator.exe
  • PhotoShow 2.0 Crack.exe
  • PhotoShow 2.0 Serial Generator.exe
  • PhotoShow 2.x Crack.exe
  • PhotoShow 2.x Serial Generator.exe
  • Praetorians No-Cd Crack.exe
  • Praetorians Serial Generator.exe
  • Quake 3 No-Cd Crack.exe
  • Quake 3 Serial Generator.exe
  • Quake 4 No-Cd Crack.exe
  • Quake 4 Serial Generator.exe
  • Quake III No-Cd Crack.exe
  • Quake III Serial Generator.exe
  • Quake IV No-Cd Crack.exe
  • Quake IV Serial Generator.exe
  • QuickTime 6.x Crack.exe
  • QuickTime 6.x Serial Generator.exe
  • Railroad Tycoon III No-Cd Crack.exe
  • Railroad Tycoon III Serial Generator.exe
  • Rainbow Six 3 - Raven Shield No-Cd Crack.exe
  • Rainbow Six 3 - Raven Shield Serial Generator.exe
  • Raven Shield No-Cd Crack.exe
  • Raven Shield Serial Generator.exe
  • RealOne Player 2.0 Crack.exe
  • RealOne Player 2.0 Serial Generator.exe
  • Return to Castle Wolfenstein Enemy Territory No-Cd Crack.exe
  • Return to Castle Wolfenstein Enemy Territory Serial Generator.exe
  • Return to Castle Wolfenstein No-Cd Crack.exe
  • Return to Castle Wolfenstein Serial Generator.exe
  • Shrek 2 No-Cd Crack.exe
  • Shrek 2 Serial Generator.exe
  • Shrek II No-Cd Crack.exe
  • Shrek II Serial Generator.exe
  • Silent Hill 3 No-Cd Crack.exe
  • Silent Hill 3 Serial Generator.exe
  • Silent Hill III No-Cd Crack.exe
  • Silent Hill III Serial Generator.exe
  • SimCity 4 No-Cd Crack.exe
  • SimCity 4 Rush Hour No-Cd Crack.exe
  • SimCity 4 Rush Hour Serial Generator.exe
  • SimCity 4 Serial Generator.exe
  • SimCity IV No-Cd Crack.exe
  • SimCity IV Serial Generator.exe
  • SnagIt 6.2.2 Crack.exe
  • SnagIt 6.2.2 Serial Generator.exe
  • Sniper Elite - Berlin 1943 No-Cd Crack.exe
  • Sniper Elite - Berlin 1943 Serial Generator.exe
  • SolSuite 2003 Crack.exe
  • SolSuite 2003 Serial Generator.exe
  • Soul Reaver 3 No-Cd Crack.exe
  • Soul Reaver 3 Serial Generator.exe
  • Soul Reaver III No-Cd Crack.exe
  • Soul Reaver III Serial Generator.exe
  • Splinter Cell No-Cd Crack.exe
  • Splinter Cell Serial Generator.exe
  • Star Trek - Elite Force II No-Cd Crack.exe
  • Star Trek - Elite Force II Serial Generator.exe
  • Star Wars - Knights of the Old Republic No-Cd Crack.exe
  • Star Wars - Knights of the Old Republic Serial Generator.exe
  • Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe
  • Star Wars Jedi Knight - Jedi Academy Serial Generator.exe
  • SWiSH 2.0 Crack.exe
  • SWiSH 2.0 Serial Generator.exe
  • SWiSH 2.x Crack.exe
  • SWiSH 2.x Serial Generator.exe
  • The Sims Superstar No-Cd Crack.exe
  • The Sims Superstar Serial Generator.exe
  • Thief 2 No-Cd Crack.exe
  • Thief 2 Serial Generator.exe
  • Thief 3 No-Cd Crack.exe
  • Thief 3 Serial Generator.exe
  • Thief II No-Cd Crack.exe
  • Thief II Serial Generator.exe
  • Thief III No-Cd Crack.exe
  • Thief III Serial Generator.exe
  • Tiger Woods PGA TOUR 2002 No-Cd Crack.exe
  • Tiger Woods PGA TOUR 2002 Serial Generator.exe
  • Tiger Woods PGA TOUR 2003 No-Cd Crack.exe
  • Tiger Woods PGA TOUR 2003 Serial Generator.exe
  • Tomb Raider - The Angel of Darkness No-Cd Crack.exe
  • Tomb Raider - The Angel of Darkness Serial Generator.exe
  • Tony Hawk's Pro Skater 4 No-Cd Crack.exe
  • Tony Hawk's Pro Skater 4 Serial Generator.exe
  • Train Simulator 2 No-Cd Crack.exe
  • Train Simulator 2 Serial Generator.exe
  • Train Simulator II No-Cd Crack.exe
  • Train Simulator II Serial Generator.exe
  • Trinity No-Cd Crack.exe
  • Trinity Serial Generator.exe
  • Ulead GIF Animator 5.x Crack.exe
  • Ulead GIF Animator 5.x Serial Generator.exe
  • Ulead GIF Animator 6.x Crack.exe
  • Ulead GIF Animator 6.x Serial Generator.exe
  • Ulead PhotoImpact 8.x Crack.exe
  • Ulead PhotoImpact 8.x Serial Generator.exe
  • Ulead PhotoImpact 9.x Crack.exe
  • Ulead PhotoImpact 9.x Serial Generator.exe
  • UltraEdit-32 10.00b Crack.exe
  • UltraEdit-32 10.00b Serial Generator.exe
  • UltraEdit-32 10.x Crack.exe
  • UltraEdit-32 10.x Serial Generator.exe
  • Unreal Tournament 2003 No-Cd Crack.exe
  • Unreal Tournament 2003 Serial Generator.exe
  • Unreal Tournament 2004 No-Cd Crack.exe
  • Unreal Tournament 2004 Serial Generator.exe
  • UT 2003 No-Cd Crack.exe
  • UT 2003 Serial Generator.exe
  • UT 2004 No-Cd Crack.exe
  • UT 2004 Serial Generator.exe
  • Warcraft 3 No-Cd Crack.exe
  • Warcraft 3 Serial Generator.exe
  • Warcraft III - The Frozen Throne No-Cd Crack.exe
  • Warcraft III - The Frozen Throne Serial Generator.exe
  • Warcraft III No-Cd Crack.exe
  • Warcraft III Serial Generator.exe
  • Warlords 4 No-Cd Crack.exe
  • Warlords 4 Serial Generator.exe
  • Warlords IV - Heroes of Etheria No-Cd Crack.exe
  • Warlords IV - Heroes of Etheria Serial Generator.exe
  • WinAce 2.2 Crack.exe
  • WinAce 2.2 Serial Generator.exe
  • WinAce 2.x Crack.exe
  • WinAce 2.x Serial Generator.exe
  • Winamp 2.91 Crack.exe
  • Winamp 2.91 Serial Generator.exe
  • Winamp 3.x Crack.exe
  • Winamp 3.x Serial Generator.exe
  • WindowBlinds 4.0 Crack.exe
  • WindowBlinds 4.0 Serial Generator.exe
  • WindowBlinds 4.x Crack.exe
  • WindowBlinds 4.x Serial Generator.exe
  • WinRAR 3.11 Crack.exe
  • WinRAR 3.11 Serial Generator.exe
  • WinRAR 3.12 Crack.exe
  • WinRAR 3.12 Serial Generator.exe
  • WinZip 8.0 Crack.exe
  • WinZip 8.0 Serial Generator.exe
  • WinZip 8.1 Crack.exe
  • WinZip 8.1 Serial Generator.exe
  • WinZip 9.x Crack.exe
  • WinZip 9.x Serial Generator.exe
  • World War II - Frontline Command No-Cd Crack.exe
  • World War II - Frontline Command Serial Generator.exe
  • WS_FTP 5.x Crack.exe
  • WS_FTP 5.x Serial Generator.exe
  • Xenus No-Cd Crack.exe
  • Xenus Serial Generator.exe
  • ZoneAlarm 3.7.143 Crack.exe
  • ZoneAlarm 3.7.143 Serial Generator.exe
  • ZoneAlarm 3.8x Crack.exe
  • ZoneAlarm 3.8x Serial Generator.exe
  • ZoneAlarm 3.x Crack.exe
  • ZoneAlarm 3.x Serial Generator.exe

The worm terminates running processes with the following names:

  • nmain.exe
  • nisum.exe
  • serv95.exe
  • mpftray.exe
  • espwatch.exe
  • lookout.exe
  • persfw.exe
  • smc.exe
  • iamserv.exe
  • iamapp.exe
  • cfiadmin.exe
  • cfiaudit.exe
  • cfinet32.exe
  • cfinet.exe
  • pcfwallicon.exe
  • frw.exe
  • _avp32.exe
  • _avpcc.exe
  • _avpm.exe
  • _avp.exe
  • blackd.exe
  • blackice.exe
  • avp32.exe
  • avpcc.exe
  • avpm.exe
  • avp.exe
  • zapro.exe
  • zonealarm.exe
  • netstat.exe
  • msconfig.exe
  • regedit.exe

The worm attempts to connect to this server:

  • threeserver13.mine.nu

The worm contains IRC commands that can perform various backdoor IRC bot activities.

Symptoms

Existence of the registry keys and files mentioned above.

Method of Infection

The worm propagates via KaZaA and iMesh peer-to-peer networks.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

This is an internet worm that propagates via KaZaA and iMesh peer-to-peer network.

When run, the worm displays a fake error message box as shown below:

The worm copies itself into %WinDir%/system32 directory as the following file:

  • iexplore32.exe

It creates the following registry key in order to load itself as Windows startup:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "IELoader32" = "iexplore32.exe"

The worm adds/modifies the following registry keys to enable P2P file sharing:

  • HKEY_CURRENT_USER\Software\iMesh\Client\LocalContent
    "Dir0" = 012345:C:\WINNT\System32\drivers32\
  • HKEY_CURRENT_USER\Software\KAZAA\LocalContent
    "Dir0" = 012345:C:\WINNT\System32\drivers32\

It creates the following directory:

  • %Windir%\system32\drivers32

It copies itself into the directory as various files. The file names include the following:

  • ACDSee 2.4.x Crack.exe
  • ACDSee 2.4.x Serial Generator.exe
  • Ad-aware 6.0 Crack.exe
  • Ad-aware 6.0 Serial Generator.exe
  • Adobe Acrobat 5.x Crack.exe
  • Adobe Acrobat 5.x Serial Generator.exe
  • Adobe Photoshop 7.x Crack.exe
  • Adobe Photoshop 7.x Serial Generator.exe
  • Adobe Photoshop 8.x Crack.exe
  • Adobe Photoshop 8.x Serial Generator.exe
  • Age of Mythology - The Titans No-Cd Crack.exe
  • Age of Mythology - The Titans Serial Generator.exe
  • Age of Wonders II - Shadow Magic No-Cd Crack.exe
  • Age of Wonders II - Shadow Magic Serial Generator.exe
  • Alpha Communicator 5.0 Crack.exe
  • Alpha Communicator 5.0 Serial Generator.exe
  • Armor2net Personal Firewall 3.1 Crack.exe
  • Armor2net Personal Firewall 3.1 Serial Generator.exe
  • Battlefield 1942 - Secret Weapons of World War II No-Cd Crack.exe
  • Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe
  • Battlefield 1942 - The Road to Rome No-Cd Crack.exe
  • Battlefield 1942 - The Road to Rome Serial Generator.exe
  • Black & White 2 No-Cd Crack.exe
  • Black & White 2 Serial Generator.exe
  • Chrome No-Cd Crack.exe
  • Chrome Serial Generator.exe
  • Civilization III - Conquest No-Cd Crack.exe
  • Civilization III - Conquest Serial Generator.exe
  • CloneCD 4.x Crack.exe
  • CloneCD 4.x Serial Generator.exe
  • CloneCD 5.0 Crack.exe
  • CloneCD 5.0 Serial Generator.exe
  • Command & Conquer Generals No-Cd Crack.exe
  • Command & Conquer Generals Serial Generator.exe
  • Commandos 3 - Destination Berlin No-Cd Crack.exe
  • Commandos 3 - Destination Berlin Serial Generator.exe
  • Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe
  • Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe
  • Counter-Strike - Condition Zero No-Cd Crack.exe
  • Counter-Strike - Condition Zero Serial Generator.exe
  • DAP Plus 5.3 Crack.exe
  • DAP Plus 5.3 Serial Generator.exe
  • Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe
  • Dark Age of Camelot - Trials of Atlantis Serial Generator.exe
  • Delta Force - Black Hawk Down No-Cd Crack.exe
  • Delta Force - Black Hawk Down Serial Generator.exe
  • Direct Connect 1.x Crack.exe
  • Direct Connect 1.x Serial Generator.exe
  • Divx 5.x Crack.exe
  • Divx 5.x Serial Generator.exe
  • DOOM 3 No-Cd Crack.exe
  • DOOM 3 Serial Generator.exe
  • DOOM III No-Cd Crack.exe
  • DOOM III Serial Generator.exe
  • Download Accelerator Plus 5.3 Crack.exe
  • Download Accelerator Plus 5.3 Serial Generator.exe
  • Easy CD-DA Extractor 5.1 Crack.exe
  • Easy CD-DA Extractor 5.1 Serial Generator.exe
  • Easy CD-DA Extractor 5.x Crack.exe
  • Easy CD-DA Extractor 5.x Serial Generator.exe
  • Elder Scrolls III - Tribunal No-Cd Crack.exe
  • Elder Scrolls III - Tribunal Serial Generator.exe
  • Etherlords II No-Cd Crack.exe
  • Etherlords II Serial Generator.exe
  • EverQuest 2 No-Cd Crack.exe
  • EverQuest 2 Serial Generator.exe
  • F1 2002 No-Cd Crack.exe
  • F1 2002 Serial Generator.exe
  • FIFA Soccer 2003 No-Cd Crack.exe
  • FIFA Soccer 2003 Serial Generator.exe
  • FIFA Soccer 2004 No-Cd Crack.exe
  • FIFA Soccer 2004 Serial Generator.exe
  • FireStarter No-Cd Crack.exe
  • FireStarter Serial Generator.exe
  • FlashFXP 1.4 Crack.exe
  • FlashFXP 1.4 Serial Generator.exe
  • FlashFXP 1.x Crack.exe
  • FlashFXP 1.x Serial Generator.exe
  • FlashGet 1.3 Crack.exe
  • FlashGet 1.3 Serial Generator.exe
  • FlashGet 1.x Crack.exe
  • FlashGet 1.x Serial Generator.exe
  • Flight Simulator - Century of Flight No-Cd Crack.exe
  • Flight Simulator - Century of Flight Serial Generator.exe
  • Freedom - Soldiers of Liberty No-Cd Crack.exe
  • Freedom - Soldiers of Liberty Serial Generator.exe
  • GeoWhere 2.11 Crack.exe
  • GeoWhere 2.11 Serial Generator.exe
  • GeoWhere 2.x Crack.exe
  • GeoWhere 2.x Serial Generator.exe
  • GetRight 5.0 Crack.exe
  • GetRight 5.0 Serial Generator.exe
  • GetRight 5.x Crack.exe
  • GetRight 5.x Serial Generator.exe
  • GetRight 6.x Crack.exe
  • GetRight 6.x Serial Generator.exe
  • Grand Theft Auto - Vice City No-Cd Crack.exe
  • Grand Theft Auto - Vice City Serial Generator.exe
  • Half-Life 2 No-Cd Crack.exe
  • Half-Life 2 Serial Generator.exe
  • Half-Life II No-Cd Crack.exe
  • Half-Life II Serial Generator.exe
  • Half-Life No-Cd Crack.exe
  • Half-Life Serial Generator.exe
  • Halo No-Cd Crack.exe
  • Halo Serial Generator.exe
  • Harry Potter - Quidditch World Cup No-Cd Crack.exe
  • Harry Potter - Quidditch World Cup Serial Generator.exe
  • Hex Workshop Hex Editor 4.1 Crack.exe
  • Hex Workshop Hex Editor 4.1 Serial Generator.exe
  • Hitman 2 No-Cd Crack.exe
  • Hitman 2 Serial Generator.exe
  • Hitman 3 No-Cd Crack.exe
  • Hitman 3 Serial Generator.exe
  • Hitman II No-Cd Crack.exe
  • Hitman II Serial Generator.exe
  • Hitman III No-Cd Crack.exe
  • Hitman III Serial Generator.exe
  • IconPackager 2.12 Crack.exe
  • IconPackager 2.12 Serial Generator.exe
  • IconPackager 2.x Crack.exe
  • IconPackager 2.x Serial Generator.exe
  • ICUII 5.7 Crack.exe
  • ICUII 5.7 Serial Generator.exe
  • ICUII 5.x.exe
  • IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe
  • IL-2 Sturmovik - Forgotten Battles Serial Generator.exe
  • Internet Download Manager 3.15 Crack.exe
  • Internet Download Manager 3.15 Serial Generator.exe
  • Internet Download Manager 3.x Crack.exe
  • Internet Download Manager 3.x Serial Generator.exe
  • Internet Turbo 2003 5.4 Crack.exe
  • Internet Turbo 2003 5.4 Serial Generator.exe
  • Internet Turbo 2003 5.x Crack.exe
  • Internet Turbo 2003 5.x Serial Generator.exe
  • KaZaA Speedup 3.03 Crack.exe
  • KaZaA Speedup 3.03 Serial Generator.exe
  • KaZaA Speedup 3.x Crack.exe
  • KaZaA Speedup 3.x Serial Generator.exe
  • Kings of War No-Cd Crack.exe
  • Kings of War Serial Generator.exe
  • Knights of the Temple No-Cd Crack.exe
  • Knights of the Temple Serial Generator.exe
  • LingoWare 3.0 Crack.exe
  • LingoWare 3.0 Serial Generator.exe
  • Lord of the Rings - The Two Towers No-Cd Crack.exe
  • Lord of the Rings - The Two Towers Serial Generator.exe
  • Lord of the Rings - War of the Ring No-Cd Crack.exe
  • Lord of the Rings - War of the Ring Serial Generator.exe
  • Lords of EverQuest No-Cd Crack.exe
  • Lords of EverQuest Serial Generator.exe
  • Lords of the Realm III No-Cd Crack.exe
  • Lords of the Realm III Serial Generator.exe
  • Macromedia Flash MX 6.x Crack.exe
  • Macromedia Flash MX 6.x Serial Generator.exe
  • Madden NFL 2003 No-Cd Crack.exe
  • Madden NFL 2003 Serial Generator.exe
  • Madden NFL 2004 No-Cd Crack.exe
  • Madden NFL 2004 Serial Generator.exe
  • Max Payne 2 - The Fall of Max Payne No-Cd Crack.exe
  • Max Payne 2 - The Fall of Max Payne Serial Generator.exe
  • MechWarrior 3 No-Cd Crack.exe
  • MechWarrior 3 Serial Generator.exe
  • MechWarrior 4 No-Cd Crack.exe
  • MechWarrior 4 Serial Generator.exe
  • MechWarrior 5 No-Cd Crack.exe
  • MechWarrior 5 Serial Generator.exe
  • MechWarrior III No-Cd Crack.exe
  • MechWarrior III Serial Generator.exe
  • MechWarrior IV No-Cd Crack.exe
  • MechWarrior IV Serial Generator.exe
  • MechWarrior V No-Cd Crack.exe
  • MechWarrior V Serial Generator.exe
  • Medal of Honor - Allied Assault Breakthrough No-Cd Crack.exe
  • Medal of Honor - Allied Assault Breakthrough Serial Generator.exe
  • Metal Gear Solid 2 No-Cd Crack.exe
  • Metal Gear Solid 2 Serial Generator.exe
  • Metal Gear Solid 3 No-Cd Crack.exe
  • Metal Gear Solid 3 Serial Generator.exe
  • Metal Gear Solid III No-Cd Crack.exe
  • Metal Gear Solid III Serial Generator.exe
  • Metal Gear Solid No-Cd Crack.exe
  • Metal Gear Solid Serial Generator.exe
  • Microangelo 5.58 Crack.exe
  • Microangelo 5.58 Serial Generator.exe
  • Microangelo 5.x Crack.exe
  • Microangelo 5.x Serial Generator.exe
  • Microangelo 6.x Crack.exe.exe
  • Microangelo 6.x Serial Generator.exe.exe
  • Midtown Madness 2 No-Cd Crack.exe
  • Midtown Madness 2 Serial Generator.exe
  • Midtown Madness 3 No-Cd Crack.exe
  • Midtown Madness 3 Serial Generator.exe
  • Midtown Madness II No-Cd Crack.exe
  • Midtown Madness II Serial Generator.exe
  • Midtown Madness III No-Cd Crack.exe
  • Midtown Madness III Serial Generator.exe
  • mIRC 6.03 Crack.exe
  • mIRC 6.03 Serial Generator.exe
  • mIRC 6.x Crack.exe
  • mIRC 6.x Serial Generator.exe
  • MusicMatch Jukebox 8.0 Crack.exe
  • MusicMatch Jukebox 8.0 Serial Generator.exe
  • MusicMatch Jukebox 8.x Crack.exe
  • MusicMatch Jukebox 8.x Serial Generator.exe
  • MVP Baseball 2003 No-Cd Crack.exe
  • MVP Baseball 2003 Serial Generator.exe
  • NASCAR Racing 2003 No-Cd Crack.exe
  • NASCAR Racing 2003 Serial Generator.exe
  • NASCAR Thunder 2003 No-Cd Crack.exe
  • NASCAR Thunder 2003 Serial Generator.exe
  • NASCAR Thunder 2004 No-Cd Crack.exe
  • NASCAR Thunder 2004 Serial Generator.exe
  • NBA Live 2003 No-Cd Crack.exe
  • NBA Live 2003 Serial Generator.exe
  • NBA Live 2004 No-Cd Crack.exe
  • NBA Live 2004 Serial Generator.exe
  • NCAA Football 2003 No-Cd Crack.exe
  • NCAA Football 2003 Serial Generator.exe
  • NCAA Football 2004 No-Cd Crack.exe
  • NCAA Football 2004 Serial Generator.exe
  • Need for Speed Underground No-Cd Crack.exe
  • Need for Speed Underground Serial Generator.exe
  • Nero Burning ROM 5.5.x Crack.exe
  • Nero Burning ROM 5.5.x Serial Generator.exe
  • Nero Burning ROM 6.x Crack.exe
  • Nero Burning ROM 6.x Serial Generator.exe
  • NetPumper 1.03 Crack.exe
  • NetPumper 1.03 Serial Generator.exe
  • Network Cable e ADSL Speed 1.0.6 Crack.exe
  • Network Cable e ADSL Speed 1.0.6 Serial Generator.exe
  • Network Cable e ADSL Speed 1.x Crack.exe
  • Network Cable e ADSL Speed 1.x Serial Generator.exe
  • Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe
  • Neverwinter Nights - Shadows of Undrentide Serial Generator.exe
  • NHL 2002 No-Cd Crack.exe
  • NHL 2002 Serial Generator.exe
  • NHL 2003 No-Cd Crack.exe
  • NHL 2003 Serial Generator.exe
  • Paint Shop Pro 8.x Crack.exe
  • Paint Shop Pro 8.x Serial Generator.exe
  • Paint Shop Pro 9.x Crack.exe
  • Paint Shop Pro 9.x Serial Generator.exe
  • PhotoShow 2.0 Crack.exe
  • PhotoShow 2.0 Serial Generator.exe
  • PhotoShow 2.x Crack.exe
  • PhotoShow 2.x Serial Generator.exe
  • Praetorians No-Cd Crack.exe
  • Praetorians Serial Generator.exe
  • Quake 3 No-Cd Crack.exe
  • Quake 3 Serial Generator.exe
  • Quake 4 No-Cd Crack.exe
  • Quake 4 Serial Generator.exe
  • Quake III No-Cd Crack.exe
  • Quake III Serial Generator.exe
  • Quake IV No-Cd Crack.exe
  • Quake IV Serial Generator.exe
  • QuickTime 6.x Crack.exe
  • QuickTime 6.x Serial Generator.exe
  • Railroad Tycoon III No-Cd Crack.exe
  • Railroad Tycoon III Serial Generator.exe
  • Rainbow Six 3 - Raven Shield No-Cd Crack.exe
  • Rainbow Six 3 - Raven Shield Serial Generator.exe
  • Raven Shield No-Cd Crack.exe
  • Raven Shield Serial Generator.exe
  • RealOne Player 2.0 Crack.exe
  • RealOne Player 2.0 Serial Generator.exe
  • Return to Castle Wolfenstein Enemy Territory No-Cd Crack.exe
  • Return to Castle Wolfenstein Enemy Territory Serial Generator.exe
  • Return to Castle Wolfenstein No-Cd Crack.exe
  • Return to Castle Wolfenstein Serial Generator.exe
  • Shrek 2 No-Cd Crack.exe
  • Shrek 2 Serial Generator.exe
  • Shrek II No-Cd Crack.exe
  • Shrek II Serial Generator.exe
  • Silent Hill 3 No-Cd Crack.exe
  • Silent Hill 3 Serial Generator.exe
  • Silent Hill III No-Cd Crack.exe
  • Silent Hill III Serial Generator.exe
  • SimCity 4 No-Cd Crack.exe
  • SimCity 4 Rush Hour No-Cd Crack.exe
  • SimCity 4 Rush Hour Serial Generator.exe
  • SimCity 4 Serial Generator.exe
  • SimCity IV No-Cd Crack.exe
  • SimCity IV Serial Generator.exe
  • SnagIt 6.2.2 Crack.exe
  • SnagIt 6.2.2 Serial Generator.exe
  • Sniper Elite - Berlin 1943 No-Cd Crack.exe
  • Sniper Elite - Berlin 1943 Serial Generator.exe
  • SolSuite 2003 Crack.exe
  • SolSuite 2003 Serial Generator.exe
  • Soul Reaver 3 No-Cd Crack.exe
  • Soul Reaver 3 Serial Generator.exe
  • Soul Reaver III No-Cd Crack.exe
  • Soul Reaver III Serial Generator.exe
  • Splinter Cell No-Cd Crack.exe
  • Splinter Cell Serial Generator.exe
  • Star Trek - Elite Force II No-Cd Crack.exe
  • Star Trek - Elite Force II Serial Generator.exe
  • Star Wars - Knights of the Old Republic No-Cd Crack.exe
  • Star Wars - Knights of the Old Republic Serial Generator.exe
  • Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe
  • Star Wars Jedi Knight - Jedi Academy Serial Generator.exe
  • SWiSH 2.0 Crack.exe
  • SWiSH 2.0 Serial Generator.exe
  • SWiSH 2.x Crack.exe
  • SWiSH 2.x Serial Generator.exe
  • The Sims Superstar No-Cd Crack.exe
  • The Sims Superstar Serial Generator.exe
  • Thief 2 No-Cd Crack.exe
  • Thief 2 Serial Generator.exe
  • Thief 3 No-Cd Crack.exe
  • Thief 3 Serial Generator.exe
  • Thief II No-Cd Crack.exe
  • Thief II Serial Generator.exe
  • Thief III No-Cd Crack.exe
  • Thief III Serial Generator.exe
  • Tiger Woods PGA TOUR 2002 No-Cd Crack.exe
  • Tiger Woods PGA TOUR 2002 Serial Generator.exe
  • Tiger Woods PGA TOUR 2003 No-Cd Crack.exe
  • Tiger Woods PGA TOUR 2003 Serial Generator.exe
  • Tomb Raider - The Angel of Darkness No-Cd Crack.exe
  • Tomb Raider - The Angel of Darkness Serial Generator.exe
  • Tony Hawk's Pro Skater 4 No-Cd Crack.exe
  • Tony Hawk's Pro Skater 4 Serial Generator.exe
  • Train Simulator 2 No-Cd Crack.exe
  • Train Simulator 2 Serial Generator.exe
  • Train Simulator II No-Cd Crack.exe
  • Train Simulator II Serial Generator.exe
  • Trinity No-Cd Crack.exe
  • Trinity Serial Generator.exe
  • Ulead GIF Animator 5.x Crack.exe
  • Ulead GIF Animator 5.x Serial Generator.exe
  • Ulead GIF Animator 6.x Crack.exe
  • Ulead GIF Animator 6.x Serial Generator.exe
  • Ulead PhotoImpact 8.x Crack.exe
  • Ulead PhotoImpact 8.x Serial Generator.exe
  • Ulead PhotoImpact 9.x Crack.exe
  • Ulead PhotoImpact 9.x Serial Generator.exe
  • UltraEdit-32 10.00b Crack.exe
  • UltraEdit-32 10.00b Serial Generator.exe
  • UltraEdit-32 10.x Crack.exe
  • UltraEdit-32 10.x Serial Generator.exe
  • Unreal Tournament 2003 No-Cd Crack.exe
  • Unreal Tournament 2003 Serial Generator.exe
  • Unreal Tournament 2004 No-Cd Crack.exe
  • Unreal Tournament 2004 Serial Generator.exe
  • UT 2003 No-Cd Crack.exe
  • UT 2003 Serial Generator.exe
  • UT 2004 No-Cd Crack.exe
  • UT 2004 Serial Generator.exe
  • Warcraft 3 No-Cd Crack.exe
  • Warcraft 3 Serial Generator.exe
  • Warcraft III - The Frozen Throne No-Cd Crack.exe
  • Warcraft III - The Frozen Throne Serial Generator.exe
  • Warcraft III No-Cd Crack.exe
  • Warcraft III Serial Generator.exe
  • Warlords 4 No-Cd Crack.exe
  • Warlords 4 Serial Generator.exe
  • Warlords IV - Heroes of Etheria No-Cd Crack.exe
  • Warlords IV - Heroes of Etheria Serial Generator.exe
  • WinAce 2.2 Crack.exe
  • WinAce 2.2 Serial Generator.exe
  • WinAce 2.x Crack.exe
  • WinAce 2.x Serial Generator.exe
  • Winamp 2.91 Crack.exe
  • Winamp 2.91 Serial Generator.exe
  • Winamp 3.x Crack.exe
  • Winamp 3.x Serial Generator.exe
  • WindowBlinds 4.0 Crack.exe
  • WindowBlinds 4.0 Serial Generator.exe
  • WindowBlinds 4.x Crack.exe
  • WindowBlinds 4.x Serial Generator.exe
  • WinRAR 3.11 Crack.exe
  • WinRAR 3.11 Serial Generator.exe
  • WinRAR 3.12 Crack.exe
  • WinRAR 3.12 Serial Generator.exe
  • WinZip 8.0 Crack.exe
  • WinZip 8.0 Serial Generator.exe
  • WinZip 8.1 Crack.exe
  • WinZip 8.1 Serial Generator.exe
  • WinZip 9.x Crack.exe
  • WinZip 9.x Serial Generator.exe
  • World War II - Frontline Command No-Cd Crack.exe
  • World War II - Frontline Command Serial Generator.exe
  • WS_FTP 5.x Crack.exe
  • WS_FTP 5.x Serial Generator.exe
  • Xenus No-Cd Crack.exe
  • Xenus Serial Generator.exe
  • ZoneAlarm 3.7.143 Crack.exe
  • ZoneAlarm 3.7.143 Serial Generator.exe
  • ZoneAlarm 3.8x Crack.exe
  • ZoneAlarm 3.8x Serial Generator.exe
  • ZoneAlarm 3.x Crack.exe
  • ZoneAlarm 3.x Serial Generator.exe

The worm terminates running processes with the following names:

  • nmain.exe
  • nisum.exe
  • serv95.exe
  • mpftray.exe
  • espwatch.exe
  • lookout.exe
  • persfw.exe
  • smc.exe
  • iamserv.exe
  • iamapp.exe
  • cfiadmin.exe
  • cfiaudit.exe
  • cfinet32.exe
  • cfinet.exe
  • pcfwallicon.exe
  • frw.exe
  • _avp32.exe
  • _avpcc.exe
  • _avpm.exe
  • _avp.exe
  • blackd.exe
  • blackice.exe
  • avp32.exe
  • avpcc.exe
  • avpm.exe
  • avp.exe
  • zapro.exe
  • zonealarm.exe
  • netstat.exe
  • msconfig.exe
  • regedit.exe

The worm attempts to connect to this server:

  • threeserver13.mine.nu

The worm contains IRC commands that can perform various backdoor IRC bot activities.

Symptoms

Symptoms -

Existence of the registry keys and files mentioned above.

Method of Infection

Method of Infection -

The worm propagates via KaZaA and iMesh peer-to-peer networks.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A