Win32.MSNWorm.Rodok.A

( Worm.Win32.Fleming (Kaspersky) )

SYMPTOMS:

- a process called \"BR2002\" running (it can be seen by right-clicking the taskbar and launching Task Manager).

TECHNICAL DESCRIPTION:

This worm spreads by by maliciously inviting the user\'s MSN Messenger contacts to download it; it was written in Visual Basic.
The virus is disguised as a CD-key generator for the great Half-Life/CounterStrike games; when run, it invites the user to click the \"Generate\" button, but the resulting \"keys\" are just random digits:


The virus actually steals the user\'s CD-keys for Half-Life and CounterStrike. The keys are read from the following registry keys:
- HKCU\\Software\\Valve\\CounterStrike\\Settings\\Key
- HKCU\\Software\\Valve\\Half-Life\\Settings\\Key
and sent to styggefolk@hotmail.com; the sent message looks like this:
I have loaded the ur CDKEY Generator 1.3! CS: HL: In order to spread, the worm sends instant messages to the user\'s contacts, inviting them to download and run a program (actually a copy of the virus) from a website:


The virus then attempts to download an executable file from the location http://home.no.net/downl0ad/CS-Keygen.exe and save it as C:\\hehe2397824.exe. If the user receives a message from styggefolk@hotmail.com, it will take a specific action depending on the contents of that message:
- if the message reads \"hey\", the virus will send the CounterStrike/Half-Life CD keys again;
- if the message reads \"hello\", the virus will download a file (probably containing an updated version of the virus) from the location http://home.no.net/downl0ad/Update.exe and save it as C:\\update35784.exe; a message will be sent back to styggefolk@hotmail.com, containing the text \"Updating...\";
- if the message reads \"hi\", the virus will reply with \"Spamming...\" and send virus download invitations again to the user\'s contacts.
The worm runs the downloaded executable files (C:\\hehe2397824.exe, C:\\update35784.exe), if they are found; it will remain resident, waiting for messages from styggefolk@hotmail.com.

Removal instructions:

Manual Removal:
Invoke Task Manager, select the process called \"BR2002\" and click \"End Task\". You should also delete the file \"br2002.exe\" that contains the worm.
Automatic Removal:
Let BitDefender delete/disinfect files found infected.

ANALYZED BY:

Bogdan Dragu
BitDefender Virus Researcher