Worm/Magold.E - Worm

See also

Full description

Alias:	Maya Gold, Auric
Type:	Worm
Size:	238,592 bytes
Origin:	Canada
Date:	06-23-2003
Damage:	mass mailer
VDF Version:	6.20.00.15 - Mon, 23 Jun 2003 13:55 (GMT+1)
Danger:	Low
Distribution:	Medium

SymptomsWindows applications take longer to load.

Distribution- Email
- P2P (Peer-to-Peer) networks

Technical DetailsWorm/Magold.E has a 238,592 bytes file size, is packed with UPX. When activated, it will create the following files:
* C:\%WinDIR%\dread.exe
* C:\%WinDIR%\maya gold.scr
* C:\%WinDIR%\Dread\maya gold.scr
* C:\%WinDIR%\%SysDIR%\wdread.exe
* C:\%Programme%\Limeware\share\maya gold.scr
* C:\%Programme%\Gnucleus\downloads\maya gold.scr
* C:\%Programme%\Shareaza\downloads\maya gold.scr
* C:\%Programme%\Bearshare\shared\maya gold.scr
* C:\%Programme%\Edonkey2000\maya gold.scr
* C:\%Programme%\Edonkey2000\incoming\maya gold.scr
* C:\%Programme%\Morpheus\my shared folder\maya gold.scr
* C:\%Programme%\Grokster\my grokster\maya gold.scr
* C:\%Programme%\Icq\shared files\maya gold.scr

By changing the following entries, the worm will be activated when the files with extensions .EXE, .COM, .BAT, .PIF, and .SCR are opened:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

The worm also makes the following entry in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Run]
"raVe"="C:\\WINNT\\dreAd.exe"

Worm/Magold.E spreads itself exclusively on Windows NT/2000/XP systems.

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:
* C:\%WinDIR%\dread.exe
* C:\%WinDIR%\maya gold.scr
* C:\%WinDIR%\Dread\maya gold.scr
* C:\%WinDIR%\%SysDIR%\wdread.exe
* C:\%Programme%\Limeware\share\maya gold.scr
* C:\%Programme%\Gnucleus\downloads\maya gold.scr
* C:\%Programme%\Shareaza\downloads\maya gold.scr
* C:\%Programme%\Bearshare\shared\maya gold.scr
* C:\%Programme%\Edonkey2000\maya gold.scr
* C:\%Programme%\Edonkey2000\incoming\maya gold.scr
* C:\%Programme%\Morpheus\my shared folder\maya gold.scr
* C:\%Programme%\Grokster\my grokster\maya gold.scr
* C:\%Programme%\Icq\shared files\maya gold.scr

Start "regedit" after that and change the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\
open\command]
@="C:\\WINNT\\dreAd.exe \"%1\" %*"

in @=""%1\" %*"

and delete the following:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Run]
"raVe"="C:\\WINNT\\dreAd.exe"

Restart your computer.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back