Featured removal tool
This virus comes by e-mail, spoofing the sender address, and is packed with MEW, an executable file compressor.
Once executed, the worm does the following:
1. Creates the mutex, in order to have only one instance of itself running in memory: H-3-1-1-B-0-T-3-F-1-X-3
2. Copies itself as %SYSTEM%\Lien Van de Kelder.exe
3. Creates/modifies the following registry keys:
"http://www.lienvandekelder.be" = "%SYSTEM%\Lien Van de Kelder.exe"
"http://www.lienvandekelder.be" = "%SYSTEM%\\Lien Van de Kelder.exe"
"Start" = "4"
4. Starts harvesting e-mail addresses, searchin in folder "Temporary Internet Files", the current outlook e-mail account files, and from files matching
searching in drives C: to Y:
it avoids certain e-mail addresses, by comparing the address with an internal list of substrings.
5. The worm uses its own SMTP engine to send itself to the harvested email addresses, attempts to use the default e-mail account settings also to reconstruct the smtp server by prepending the following strings to the harvested email's domain names:
The email format is:
From (spoofed, has a big list of names)
Subject (one of the following):
Notice: **Last Warning**
*DETECTED* Online User Violation
Your Email Account is Suspended For Security Reasons
*WARNING* Your Email Account Will Be Closed
Email Account Suspension
Notice of account limitation
Body (one of the following):
Once you have completed the form in the attached file , your account records will not be interrupted and will continue as normal.
The original message has been included as an attachment.
We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.
We attached some important information regarding your account.
Please read the attached document and follow it's instructions.
Attachment (may begin with):
followed by double extension (.tmp .doc .htm .txt) .exe .src .pif .zip
6. Prevents/terminates execution of many security related products (executables)
7. Blocks access to several security related sites, by modifying the system HOSTS file
8. Has backdoor capabilities (irc bot):
Connects to the IRC server irc.blackcarder.net and joins channel ##hb3f1x3
Once connected, listens for commands issued by an possible attacker. The commands may allow the attacker to:
download/execute/update files (including the worm itself)
gain information about the operating system and computer configuration
stop the worm [...] [...]