Alias:Maya Gold, Auric
Type:Worm 
Size:238,592 bytes 
Origin:Canada 
Date:06-23-2003 
Damage:mass mailer 
VDF Version:6.20.00.15 
Danger:Low 
Distribution:Medium 

SymptomsWindows applications take longer to load.

Distribution- Email
- P2P (Peer-to-Peer) networks

Technical DetailsWorm/Magold.E has a 238,592 bytes file size, is packed with UPX. When activated, it will create the following files:
* C:\%WinDIR%\dread.exe
* C:\%WinDIR%\maya gold.scr
* C:\%WinDIR%\Dread\maya gold.scr
* C:\%WinDIR%\%SysDIR%\wdread.exe
* C:\%Programme%\Limeware\share\maya gold.scr
* C:\%Programme%\Gnucleus\downloads\maya gold.scr
* C:\%Programme%\Shareaza\downloads\maya gold.scr
* C:\%Programme%\Bearshare\shared\maya gold.scr
* C:\%Programme%\Edonkey2000\maya gold.scr
* C:\%Programme%\Edonkey2000\incoming\maya gold.scr
* C:\%Programme%\Morpheus\my shared folder\maya gold.scr
* C:\%Programme%\Grokster\my grokster\maya gold.scr
* C:\%Programme%\Icq\shared files\maya gold.scr

By changing the following entries, the worm will be activated when the files with extensions .EXE, .COM, .BAT, .PIF, and .SCR are opened:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

The worm also makes the following entry in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Run]
"raVe"="C:\\WINNT\\dreAd.exe"

Worm/Magold.E spreads itself exclusively on Windows NT/2000/XP systems.

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:
* C:\%WinDIR%\dread.exe
* C:\%WinDIR%\maya gold.scr
* C:\%WinDIR%\Dread\maya gold.scr
* C:\%WinDIR%\%SysDIR%\wdread.exe
* C:\%Programme%\Limeware\share\maya gold.scr
* C:\%Programme%\Gnucleus\downloads\maya gold.scr
* C:\%Programme%\Shareaza\downloads\maya gold.scr
* C:\%Programme%\Bearshare\shared\maya gold.scr
* C:\%Programme%\Edonkey2000\maya gold.scr
* C:\%Programme%\Edonkey2000\incoming\maya gold.scr
* C:\%Programme%\Morpheus\my shared folder\maya gold.scr
* C:\%Programme%\Grokster\my grokster\maya gold.scr
* C:\%Programme%\Icq\shared files\maya gold.scr

Start "regedit" after that and change the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

and delete the following:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Run]
"raVe"="C:\\WINNT\\dreAd.exe"

Restart your computer.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .