P2P-Worm.Win32.Harex.b

0 0

Harex.b (aka Genky) is about 4KB when compressed by FSG. The virus file is 33KB when uncompressed.

Installing
When installing, the worm creates a sub directory called 'windows' within the Windows directory and writes itself to this sub directory under the following names:

Ipswich Town Official Management Game - Update.exe
Ipswich Town Official Management Game - CD Crack.exe
Ipswich Town Official Management Game - Update Crack.exe
Ipswich Town Official Management Game - Cd Key Changer.exe
Ipswich Town Official Management Game - CD Key Generator.exe
Ipswich Town Official Management Game - CD Keygen.exe
Ipswich Town Official Management Game - Keygen.exe
Ipswich Town Official Management Game - NoCd.exe
Bridge Baron 13 - Update.exe
Bridge Baron 13 - CD Crack.exe
Bridge Baron 13 - Update Crack.exe
Bridge Baron 13 - Cd Key Changer.exe
Bridge Baron 13 - CD Key Generator.exe
Bridge Baron 13 - CD Keygen.exe
Bridge Baron 13 - Keygen.exe
Bridge Baron 13 - NoCd.exe
American Conquest - Update.exe
American Conquest - CD Crack.exe
American Conquest - Update Crack.exe
American Conquest - Cd Key Changer.exe
American Conquest - CD Key Generator.exe
American Conquest - CD Keygen.exe
American Conquest - Keygen.exe
American Conquest - NoCd.exe
Grom - Update.exe
Grom - CD Crack.exe
Grom - Update Crack.exe
Grom - Cd Key Changer.exe
Grom - CD Key Generator.exe
Grom - CD Keygen.exe
Grom - Keygen.exe
Grom - NoCd.exe
Alex Ferguson's Player Manager 2003 - Update.exe
Alex Ferguson's Player Manager 2003 - CD Crack.exe
Alex Ferguson's Player Manager 2003 - Update Crack.exe
Alex Ferguson's Player Manager 2003 - Cd Key Changer.exe
Alex Ferguson's Player Manager 2003 - CD Key Generator.exe
Alex Ferguson's Player Manager 2003 - CD Keygen.exe
Alex Ferguson's Player Manager 2003 - Keygen.exe
Alex Ferguson's Player Manager 2003 - NoCd.exe
Command and Conquer Generals - Update.exe
Command and Conquer Generals - CD Crack.exe
Command and Conquer Generals - Update Crack.exe
Command and Conquer Generals - Cd Key Changer.exe
Command and Conquer Generals - CD Key Generator.exe
Command and Conquer Generals - CD Keygen.exe
Command and Conquer Generals - Keygen.exe
Command and Conquer Generals - NoCd.exe
Nascar Racing 2003 Season - Update.exe
Nascar Racing 2003 Season - CD Crack.exe
Nascar Racing 2003 Season - Update Crack.exe
Nascar Racing 2003 Season - Cd Key Changer.exe
Nascar Racing 2003 Season - CD Key Generator.exe
Nascar Racing 2003 Season - CD Keygen.exe
Nascar Racing 2003 Season - Keygen.exe
Nascar Racing 2003 Season - NoCd.exe
Eonix Realm Of Hepmia - Update.exe
Eonix Realm Of Hepmia - CD Crack.exe
Eonix Realm Of Hepmia - Update Crack.exe
Eonix Realm Of Hepmia - Cd Key Changer.exe
Eonix Realm Of Hepmia - CD Key Generator.exe
Eonix Realm Of Hepmia - CD Keygen.exe
Eonix Realm Of Hepmia - Keygen.exe
Eonix Realm Of Hepmia - NoCd.exe
I Was An Atomic Mutant - Update.exe
I Was An Atomic Mutant - CD Crack.exe
I Was An Atomic Mutant - Update Crack.exe
I Was An Atomic Mutant - Cd Key Changer.exe
I Was An Atomic Mutant - CD Key Generator.exe
I Was An Atomic Mutant - CD Keygen.exe
I Was An Atomic Mutant - Keygen.exe
I Was An Atomic Mutant - NoCd.exe
Fetish Fighters - Update.exe
Fetish Fighters - CD Crack.exe
Fetish Fighters - Update Crack.exe
Fetish Fighters - Cd Key Changer.exe
Fetish Fighters - CD Key Generator.exe
Fetish Fighters - CD Keygen.exe
Fetish Fighters - Keygen.exe
Fetish Fighters - NoCd.exe
Battlefield 1942 The Road to Rome - Update.exe
Battlefield 1942 The Road to Rome - CD Crack.exe
Battlefield 1942 The Road to Rome - Update Crack.exe
Battlefield 1942 The Road to Rome - Cd Key Changer.exe
Battlefield 1942 The Road to Rome - CD Key Generator.exe
Battlefield 1942 The Road to Rome - CD Keygen.exe
Battlefield 1942 The Road to Rome - Keygen.exe
Battlefield 1942 The Road to Rome - NoCd.exe
The Campaigns of La Grande Armee - Update.exe
The Campaigns of La Grande Armee - CD Crack.exe
The Campaigns of La Grande Armee - Update Crack.exe
The Campaigns of La Grande Armee - Cd Key Changer.exe
The Campaigns of La Grande Armee - CD Key Generator.exe
The Campaigns of La Grande Armee - CD Keygen.exe
The Campaigns of La Grande Armee - Keygen.exe
The Campaigns of La Grande Armee - NoCd.exe
Unreal II The Awakening - Update.exe
Unreal II The Awakening - CD Crack.exe
Unreal II The Awakening - Update Crack.exe
Unreal II The Awakening - Cd Key Changer.exe
Unreal II The Awakening - CD Key Generator.exe
Unreal II The Awakening - CD Keygen.exe
Unreal II The Awakening - Keygen.exe
Unreal II The Awakening - NoCd.exe
The Emperors Mahjong - Update.exe
The Emperors Mahjong - CD Crack.exe
The Emperors Mahjong - Update Crack.exe
The Emperors Mahjong - Cd Key Changer.exe
The Emperors Mahjong - CD Key Generator.exe
The Emperors Mahjong - CD Keygen.exe
The Emperors Mahjong - Keygen.exe
The Emperors Mahjong - NoCd.exe
Sim City 4 - Update.exe
Sim City 4 - CD Crack.exe
Sim City 4 - Update Crack.exe
Sim City 4 - Cd Key Changer.exe
Sim City 4 - CD Key Generator.exe
Sim City 4 - CD Keygen.exe
Sim City 4 - Keygen.exe
Sim City 4 - NoCd.exe
Private Nurse - Update.exe
Private Nurse - CD Crack.exe
Private Nurse - Update Crack.exe
Private Nurse - Cd Key Changer.exe
Private Nurse - CD Key Generator.exe
Private Nurse - CD Keygen.exe
Private Nurse - Keygen.exe
Private Nurse - NoCd.exe
Impossible Creatures - Update.exe
Impossible Creatures - CD Crack.exe
Impossible Creatures - Update Crack.exe
Impossible Creatures - Cd Key Changer.exe
Impossible Creatures - CD Key Generator.exe
Impossible Creatures - CD Keygen.exe
Impossible Creatures - Keygen.exe
Impossible Creatures - NoCd.exe
Slot City 3 - Update.exe
Slot City 3 - CD Crack.exe
Slot City 3 - Update Crack.exe
Slot City 3 - Cd Key Changer.exe
Slot City 3 - CD Key Generator.exe
Slot City 3 - CD Keygen.exe
Slot City 3 - Keygen.exe
Slot City 3 - NoCd.exe
Test Drive - Update.exe
Test Drive - CD Crack.exe
Test Drive - Update Crack.exe
Test Drive - Cd Key Changer.exe
Test Drive - CD Key Generator.exe
Test Drive - CD Keygen.exe
Test Drive - Keygen.exe
Test Drive - NoCd.exe
Shadow of Memories - Update.exe
Shadow of Memories - CD Crack.exe
Shadow of Memories - Update Crack.exe
Shadow of Memories - Cd Key Changer.exe
Shadow of Memories - CD Key Generator.exe
Shadow of Memories - CD Keygen.exe
Shadow of Memories - Keygen.exe
Shadow of Memories - NoCd.exe
World Of Outlaws Sprint Car Racing 2002 - Update.exe
World Of Outlaws Sprint Car Racing 2002 - CD Crack.exe
World Of Outlaws Sprint Car Racing 2002 - Update Crack.exe
World Of Outlaws Sprint Car Racing 2002 - Cd Key Changer.exe
World Of Outlaws Sprint Car Racing 2002 - CD Key Generator.exe
World Of Outlaws Sprint Car Racing 2002 - CD Keygen.exe
World Of Outlaws Sprint Car Racing 2002 - Keygen.exe
World Of Outlaws Sprint Car Racing 2002 - NoCd.exe
Tombstone 1882 - Update.exe
Tombstone 1882 - CD Crack.exe
Tombstone 1882 - Update Crack.exe
Tombstone 1882 - Cd Key Changer.exe
Tombstone 1882 - CD Key Generator.exe
Tombstone 1882 - CD Keygen.exe
Tombstone 1882 - Keygen.exe
Tombstone 1882 - NoCd.exe
Las Vegas Casino Player's Collection - Update.exe
Las Vegas Casino Player's Collection - CD Crack.exe
Las Vegas Casino Player's Collection - Update Crack.exe
Las Vegas Casino Player's Collection - Cd Key Changer.exe
Las Vegas Casino Player's Collection - CD Key Generator.exe
Las Vegas Casino Player's Collection - CD Keygen.exe
Las Vegas Casino Player's Collection - Keygen.exe
Las Vegas Casino Player's Collection - NoCd.exe
Airport Tycoon II - Update.exe
Airport Tycoon II - CD Crack.exe
Airport Tycoon II - Update Crack.exe
Airport Tycoon II - Cd Key Changer.exe
Airport Tycoon II - CD Key Generator.exe
Airport Tycoon II - CD Keygen.exe
Airport Tycoon II - Keygen.exe
Airport Tycoon II - NoCd.exe
Filbert Fledgling - Update.exe
Filbert Fledgling - CD Crack.exe
Filbert Fledgling - Update Crack.exe
Filbert Fledgling - Cd Key Changer.exe
Filbert Fledgling - CD Key Generator.exe
Filbert Fledgling - CD Keygen.exe
Filbert Fledgling - Keygen.exe
Filbert Fledgling - NoCd.exe
Apache AH-64 Air Assault - Update.exe
Apache AH-64 Air Assault - CD Crack.exe
Apache AH-64 Air Assault - Update Crack.exe
Apache AH-64 Air Assault - Cd Key Changer.exe
Apache AH-64 Air Assault - CD Key Generator.exe
Apache AH-64 Air Assault - CD Keygen.exe
Apache AH-64 Air Assault - Keygen.exe
Apache AH-64 Air Assault - NoCd.exe
A  Certification Test.exe
Cisco Certification Test.exe
MSCE Certification Test.exe
Unix Certification Test.exe
Windows Nt Certification Test.exe
Serious Sam - Gold Edition - Update.exe
Serious Sam - Gold Edition - CD Crack.exe
Serious Sam - Gold Edition - Update Crack.exe
Serious Sam - Gold Edition - Cd Key Changer.exe
Serious Sam - Gold Edition - CD Key Generator.exe
Serious Sam - Gold Edition - CD Keygen.exe
Serious Sam - Gold Edition - Keygen.exe
Serious Sam - Gold Edition - NoCd.exe
Global Power - Update.exe
Global Power - CD Crack.exe
Global Power - Update Crack.exe
Global Power - Cd Key Changer.exe
Global Power - CD Key Generator.exe
Global Power - CD Keygen.exe
Global Power - Keygen.exe
Global Power - NoCd.exe
IGI-2 Covert Strike - Update.exe
IGI-2 Covert Strike - CD Crack.exe
IGI-2 Covert Strike - Update Crack.exe
IGI-2 Covert Strike - Cd Key Changer.exe
IGI-2 Covert Strike - CD Key Generator.exe
IGI-2 Covert Strike - CD Keygen.exe
IGI-2 Covert Strike - Keygen.exe
IGI-2 Covert Strike - NoCd.exe
Tom Clancy's Splinter Cell - Update.exe
Tom Clancy's Splinter Cell - CD Crack.exe
Tom Clancy's Splinter Cell - Update Crack.exe
Tom Clancy's Splinter Cell - Cd Key Changer.exe
Tom Clancy's Splinter Cell - CD Key Generator.exe
Tom Clancy's Splinter Cell - CD Keygen.exe
Tom Clancy's Splinter Cell - Keygen.exe
Tom Clancy's Splinter Cell - NoCd.exe
Robot Arena Design And Destroy - Update.exe
Robot Arena Design And Destroy - CD Crack.exe
Robot Arena Design And Destroy - Update Crack.exe
Robot Arena Design And Destroy - Cd Key Changer.exe
Robot Arena Design And Destroy - CD Key Generator.exe
Robot Arena Design And Destroy - CD Keygen.exe
Robot Arena Design And Destroy - Keygen.exe
Robot Arena Design And Destroy - NoCd.exe
Freelancer - Update.exe
Freelancer - CD Crack.exe
Freelancer - Update Crack.exe
Freelancer - Cd Key Changer.exe
Freelancer - CD Key Generator.exe
Freelancer - CD Keygen.exe
Freelancer - Keygen.exe
Freelancer - NoCd.exe

The sub directory created by the worm is recorded in the Windows Registry as local content system files for Kazaa and iMesh:

 HKCU\Software\Kazaa\LocalContent
 HKCU\Software\Kazaa\Transfer
  dir0 = 012345:%Windir%\system\windows

 HKCU\Software\iMesh\Client\LocalContent
  dir0 = 012345:%Windir%\system\windows

As a result of these entries, the files become available for download by other P2P network users.

Other
Version 'A' of the virus is downloaded and launched from the server 'cnets.0catch.com'. The virus is contained in a file called 'Kernell116.dll.exe', which resides in a root level directory on the C: drive.