Scrapkut.worm

Virus Name

Risk Assessment

Win32/Scrapkut.worm

Low

Discovery Date

Min DAT

02/03/2008

5243

Type

SubType

Virus

Worm

Virus Characteristics

The downloader component of the worm has the following attributes:

File size: 239,616 bytes
FileName: flashx_p.exe

Upon execution, the worm shows the following window.

Then it downloads the following files from the remote site "ifastnet.com."

%Windir%\logservicess.exe (420,148 bytes)
%Windir%\system32\maindwxp.exe (420,148 bytes)
%Windir%\win32chekupdate.exe (1,107,789 bytes)
%Windir%windosremote.exe (3,665,995 bytes)

The worm injects a thread into the process Internet Explorer and monitors accesses to orkut.com.
It sends the scraps containing the link to the "flashx_p.exe" to all contacts listed in the addressbook.

Symptoms

Method Of Infection


The worm attempts to spread itself by sending orkut users scraps that contains the link to the worm itself.

Removal Instructions


Use specified engine and DAT files for detection and removal. This threat will be cleaned if you have this combination.


			<% if Request.querystring("retry") = "member" or Request.cookies("logged") <> "" then %> <%= Request.cookies("logged")%> <%else Response.Redirect "../default.asp" end if %>