My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Win32.Worm.Lewor.S

VERY LOW
VERY LOW
23038

Symptoms

Presence of the following files: - %windir%\sonudmon.exe - %sysdir%\dsek.exe  Startpage changed in IE to a XXX site.

Removal instructions:

Please let BitDefender disinfect/delete your files.

Analyzed By

Daniel Ionita, virus researcher.

Technical Description:

This is actually a trojan written in Delphi that modifies the start page in IE and tries to download and install other malware.

At startup, it modifies the start page, URL history and search URL in IE to point to a XXX site (www.mmmmmm.net). It registers itself under the HKCU \Software\Microsoft\Windows\CurrentVersion\Run key in the system registry. It copies itself in the Windows and System32 directories under the filenames listed under "Symptoms". It attempts to download and start a file named "tmdown.exe" from a XXX site, but the file no longer exists there and the virus exits with error (the downloaded file is not executable, but it is run anyway).

It creates several timers which have various functions:

- one of them keeps an eye on the IE settings, reseting the startpage to his own if the user modifies it
- another one tries to download and start more malware
- there is also a timer which scans for various program windows (under the names QQKav, QQAV, TKillqqvir, ThunderRT6FormDC, Upiea, joyiex, ddqxyz a.o.) and sends them the WM_QUIT message (thereby ending those programs).
The virus also disables the "Task Manager" shortcut that is shown when rightclicking the system bar, trying in this manner to prevent its own termination. It associates itself with the default action for text files (.txt extension) in the registry, so that whenever a text file is open, the virus is run.

The trojan also registers itself as an service process.