What's up with this worm?.

[tobacco]

Thought i would mention this because i've seen "wupdmgr1.exe listed in some of the hijackthis logs posted in forums and no mention was made of it.It is malicious, to what extent i don't know but here is the link.



http://www.dslreports.com/forum/remark,15359524

[connarch]

June 2, 2006

It is definitely a worm. I've had it get through twice in 6 months (January 19 2006, and June 2, 2006) through a single open port I use to transfer files with others (P2P).

As the thread in http://www.dslreports.com/forum/remark,15359524 describes it is a self install version of SETIATHOME BOINC that imbeds itself in the ../windows/system32.

I've manually removed it twice because none of the virusscan companies consider it very serious (I guess).

It arrives via Install Source:

C:\DOCUMENTSA AND SETTINGS\(LOCAL USER)\LOCALSETTINGS\Temp\RarSFX0\

and creates a windows installer package:

Local Package:
C:\WINDOWS\Installer\212d53.msi

Goes into the windows registry as:

Modify Rath/Uninstall String:
MsiExec.exe /I{C84AF6B4-168C-4469-B859-7066B037AA02}

After it is installed, the files created in the /system32 folder are:

wupdmgr1.exe this is the executable that runs in the background. It is a customized version of BOINC

boinc.dll the dynamic link library

and data collection files:

stderrdae.txt
stdoutdae.txt
dc1595.xml
client_state.xml
client_state_previous.xml
sched_reply_setiathome.berkely.edu.xml
sched_request_setiathome.berkely.edu.xml
statistics_setiathome.berkely.edu.xml

Except for the wupdmgr1.exe file all the files will be dated the same day the install was done so to find them priopitize by date.

The wupdmgr1.exe is dated 01/19/06

Also, if a complete and clean removal isn't done, the program will re-install itself in different directories.

In the ../windows/system32/projects/setiathome.berkely.edu directory:

stderrdae.txt
stdoutdae.txt (this file is critical to refer to because its a log of activity including when the worm was first installed which will lead to when wupdmgr1.exe was installed)
dc1595.xml
client_state.xml
client_state_previous.xml
sched_reply_setiathome.berkely.edu.xml
sched_request_setiathome.berkely.edu.xml
statistics_setiathome.berkely.edu.xml

In the windows directory
boinc.dll

Also, at one point the application ran as setiathome_4.18_windows_intelx86.exe under a created folder called ../windows/system32/slots/0/

Bottom line is that after you remove these files, you need to run a complete system file (including hidden files) AND registry search for the words:

BOINC
SETIAT

That "should" remove it completely

connarchATyahoo.com