VBS.Trojan.Carewmr.A

( N/A )

SYMPTOMS:

It creates many 0 bytes size files in \"C:\\\", and some empty folders (also in \"C:\\\").

TECHNICAL DESCRIPTION:

The Trojan display some message boxes with the text:
1. \"Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start scanning your computer. \"
2. \"ERROR!, Code error:3212552, please execute this tool in MS-DOS.\"
3. \"Thank You for prefer Kaspersky Labs Products\"
On September the 1st it also display the message:
\"Mr.Carew vuelve otra vez!!, jaja\"
It tries to delete some registry keys:
\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTray\"
\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AVPCC\"
\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NAVW32\"
\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TrueVector\"
\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZoneAlarm Pro\"
It also tries to connect to the site \"http:\\\\www.avp.ru\".
It creates 0 bytes size files on \"C:\\\":
- \"C:\\Norton2003isbad_preferKAVORAVP\"
- \"C:\\AVP\"
- \"C:\\NAV\"
- \"C:\\CHILE\"
- \"C:\\TEMUCO\"
- \"C:\\MCAFEE\"
- \"C:\\ENTELPCS\"
- \"C:\\GSM1900MHZ\"
- \"C:\\SONYERICSSON\"
- \"C:\\CAREFULLY_WHIT_ME\"
- \"C:\\YOUR_PC_IS_VERY_BAD\"
- \"C:\\I HATE MELINA\"
- \"C:\\VBS.CarewMR.a\"
- \"C:\\Windows is a real virus?\"
- \"C:\\MELINA_TE_ODIO_MUERETE!\"
- \"C:\\WindowsXP\"
- \"C:\\Windows3.11\"
- \"C:\\Windows98SE\"
- \"C:\\WindowsME\"
- \"C:\\Windows 95\"
- \"C:\\WindowsNT\"
- \"C:\\Windows2000\"
- \"C:\\TELLCELL S.A\"
- \"C:\\PORN\"
- \"C:\\ORAL_SEX\"
- \"C:\\BIN_LADEN_FUCKYOU\"
- \"C:\\ICQ\"
- \"C:\\PANDA\"
- \"C:\\NOD32\"
- \"C:\\TREND\"
- \"C:\\PC-CILLIN\"
- \"C:\\AvpM.exe\"
- \"C:\\Kaspersky_AntiVirus_PersonalPRO_THEBEST!!!!!\"
- \"C:\\Norton_thePOOR\"
- \"C:\\Madonna_Sucking_my_dick.avi\"
- \"C:\\Your_system_is_infected_by_a_virus_jajajajajajaja.jajajaja\"
- \"C:\\THE_HEURISTIC_OF_NORTON_IS_VERY_BAD_AND_PRODUCE:POSITIVES-FALSES\"
It also creates the folders:
- \"C:\\Symantec\"
- \"C:\\KasperskyLabs\"
- \"C:\\PandaSoftware\"
- \"C:\\TrendMicro\"
- \"C:\\Eset-Nod-fucked\".
It tries to delete the folder \"C:\\Windows\".
The trojan creates in current folder a file, named \"CLRAV_Report.log\", with an error message:
\"Due an error, Code error:3212552, CLRAV has not disinfect your computer
For Support please send a e-mail to support@kaspersky.com and please indicate the Code Error.\"
Removal:

Removal instructions:

- manual removal: delete all files found infected.
- automatic removal: let BitDefender delete files found infected.

ANALYZED BY:

Mihaela Stoian
BitDefender virus researcher