MD5: 6e963b4521b280362f3a3f80e43b23fd
SHA1: a3379cd5573f286f0a4295d014d4b664a162f8a1
SHA256: 3807e2c7dc5bc23db9ebe175b1f6c34dd939827b96387aa3ed330b2f85a255f5
SSDeep: 6144:GKWFPj0Xw6smbqBH1gzcvWYoqxXCI/uNNDUtOIfpz:Gxa9qbwnYoqxE0J
Size: 289792 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: SummerSoft
Created at: 2012-11-27 08:24:36

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

reg.exe:388
reg.exe:384
reg.exe:1692
reg.exe:864
6e963b4521b280362f3a3f80e43b23fd.exe:1872

The Worm injects its code into the following process(es):

cvtres.exe:408

File activity

The process cvtres.exe:408 makes changes in a file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\keys (33 bytes)
%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe (35 bytes)

The process 6e963b4521b280362f3a3f80e43b23fd.exe:1872 makes changes in a file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe (35 bytes)

Registry activity

The process reg.exe:388 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A B4 FA 2F 93 F1 39 7C C7 D4 38 EB 93 F8 E6 80"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

The process reg.exe:384 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 B0 5D 46 AC 11 D8 39 62 F5 82 7E A5 34 AF 53"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"I3KV032IKW.exe" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe:*:Enabled:Windows Messanger"

The process reg.exe:1692 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 9E BD 9A 4A BF B3 18 69 D9 EF A4 CA 6B EC 27"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"cvtres.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe:*:Enabled:Windows Messanger"

The process reg.exe:864 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 20 19 47 5F 95 21 9F EC 0A AC CD 99 43 40 C8"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

The process cvtres.exe:408 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 FD 7A 5E F6 FA CA 86 C0 4D 85 C7 65 A7 98 9E"

[HKCU\Software\Microsoft\Active Setup\Installed Components\{DF9E44FA-4EED-F62E-EEDF-3C770D2DBFDF}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"SXGJ275OCC" = "September 17, 2013"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{DF9E44FA-4EED-F62E-EEDF-3C770D2DBFDF}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"SXGJ275OCC" = "omegle"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

The process 6e963b4521b280362f3a3f80e43b23fd.exe:1872 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 12 B5 64 7F 0D 4D 18 40 09 43 A7 78 A3 68 F3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   reg.exe:388
   reg.exe:384
   reg.exe:1692
   reg.exe:864
   6e963b4521b280362f3a3f80e43b23fd.exe:1872

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Application Data\keys (33 bytes)
   %Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe (35 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.