Worm/Bizex - Worm

See also

Full description

Alias:	Worm.Win32.Bizex, W32/Bizex.worm
Type:	Worm
Size:	86,538 bytes
Origin:	unknown
Date:	02-25-2004
Damage:	Keylogger, sends itself via ICQ
VDF Version:	6.24.00.17 - Tue, 24 Feb 2004 17:23 (GMT+1)
Danger:	Low
Distribution:	Medium

General DescriptionWorm/Bizex spreads over the ICQ instant messenger program, by sending a message containg a link to all users from contact list. It will create the files AVUPDATE.EXE, UPDATER.EXE, ABGETUPD.EXE and SYSMON.EXE.

Symptoms* none provided

Distribution* ICQ

Technical DetailsWorm/Bizex spreads over the ICQ instant messenger program, by sending a message containg a link to all users from contact list.

If the user clicks on this link, a file naimed MEINE.SCM is downloaded and executed. Here it concerns a ICQ sound scheme, which contains the sound file STARTUP.WAV.

Worm/Bizex uses the 'ShowHELP' Microsoft vulnerability by implementing a script in the file IEFUCKER.HTML.

The worm copies itself in one of the following paths:

* C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
* C:\Windows\Start Menu\Programs\Startup\

using the file name WINUPDATE.EXE. This file downloads the file UPDATER.EXE, which is then stored as APTGETUPD.EXE in the temporary folder of Windows.

ABGETUPD.EXE creates the folder SYSMON in the Windows instalation folder and then copies itself into it as SYSMON.EXE.

The file SYSMON.EXE is set as 'hidden', so that it is not visible using Windows default settings.

The following registry entries are provided:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current version \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current Version\Run \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

and the following two DLL files for the key logging are created:

* \%WinDir%\%SystemDir%\JAVA32.DLL
* \%WinDir%\%SystemDir%\JAVAEXT.DLL

Manual Remove Instructions- with Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* C:\Documents and Settings\All Users\Start Menu\Programs\
Startup\WINUPDATE.EXE
* \%WinDir%\%Temp%\APTGETUPD.EXE
* \%WinDir%\%SystemDIR%\Sysmon\Sysmon.exe
* \%WinDir%\%SystemDir%\JAVA32.DLL
* \%WinDir%\%SystemDir%\JAVAEXT.DLL

Start "regedit" after that and delete the following registry entries:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current version \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current Version\Run \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

Restart your computer.

- with Windows 9x/Me:

In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* C:\Windows\Start Menu\Programs\Startup\WINUPDATE.EXE
* \%WinDir%\%Temp%\APTGETUPD.EXE
* \%WinDir%\%SystemDIR%\Sysmon\Sysmon.exe
* \%WinDir%\%SystemDir%\JAVA32.DLL
* \%WinDir%\%SystemDir%\JAVAEXT.DLL

Start "regedit" after that and delete the following registry entries:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current version \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
Current Version\Run \
"sysmon"="\%WinDir%\%SystemDir%\Sysmon\Sysmon.exe"

Restart your computer.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back