Win32.Worm.Lolol.A

( W32.HLLW.Lolol (NAV), Worm.P2P.Lolol (F-Prot) )

SYMPTOMS:

- File "winsys.exe" in %system%
- Registry key "LM\Software\Microsoft\Windows\CurrentVersion\Run"
contains "Configuration Loader"
- Many executables in Kazaa shared directory (as shown below)

TECHNICAL DESCRIPTION:

It is a classical case of Peer-to-Peer (P2P) worm, designed for Win32. It spreads over the Kazaa file sharing utility using many trap files created in the Kazaa's shared folder with many different names such as:
- combinations of "age of empires 3", "nba2003", "warcraft 3", etc. and "crack", "serial", etc.
- combinations of "virtual girl -" and different girl names.
- etc.
The worm contains a backdoor, which allows an attacker to connect and run
certain commands on victim's computer.

Removal instructions:

- manual removal: delete all infected files
- automatic removal: let BitDefender delete files found infected

ANALYZED BY:

Mircea Ciubotariu BitDefender Virus Researcher