W32/Burmec Worm

 Information about the W32/Burmec Worm:

W32/Burmec is a worm. The worm will infect Windows systems and spreads by copying itself to removable and mapped drives.

Upon execution, the worm creates C:\2 July '84.txt that contains the following text:

A PIECE OF OUR LIFE WAS HERE FIND THE OTHER......(N)

The worm creates the following files:

scvhocst.dll and drvdata.dll in the Windows folder,
mmtask.exe in the Windows System folder,
user32.com in the Windows System folder, which is a copy of regedit.exe present in the Windows folder.

The worm copies itself as the following files:

MSGSRV32.COM in the Windows folder,
DDRAWXP.OXC, KERNEL.VDX, CIRRUSX.OXC, RPCSS.VDX, Msconfig.exe, and regwiz.exe in the Windows System folder,
Virtual Girl.com in the Program Files folder.

It modifies the registry at the following locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CLASSES_ROOT\.VDX
HKEY_CLASSES_ROOT\VDXfile
HKEY_CLASSES_ROOT\VDXfile\DefaultIcon
HKEY_CLASSES_ROOT\VDXfile\shell\open\command
HKEY_CLASSES_ROOT\scrfile
HKEY_CLASSES_ROOT\exefile\shell\open\command
HKEY_CLASSES_ROOT\comfile\shell\open\command
HKEY_CLASSES_ROOT\piffile\shell\open\command
HKEY_CLASSES_ROOT\.OXC
HKEY_CLASSES_ROOT\fffile
HKEY_CLASSES_ROOT\fffile\DefaultIcon
HKEY_CLASSES_ROOT\fffile\shell\open\command
HKEY_CLASSES_ROOT\.com
HKEY_CLASSES_ROOT\nffile
HKEY_CLASSES_ROOT\nffile\DefaultIcon
HKEY_CLASSES_ROOT\nffile\shell\open\command
HKEY_CLASSES_ROOT\.exe
HKEY_CLASSES_ROOT\inffile
HKEY_CLASSES_ROOT\inffile\DefaultIcon
HKEY_CLASSES_ROOT\inffile\shell\open\command
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

The worm also lowers security settings and disables antivirus programs.

The worm may spread by copying itself to all drives using the following file names:

sfc.exe
regwiz.exe
Secret!.com
command.com
ACTIVEX.com
'S NOTES.SCR
explorer.exe
scanregw.exe
Anti Brontok.com
~$scued document.tmp
~FILM PORNO ASAL UKSW.scr

This worm first appeared on January 17, 2007.

 Other names of W32/Burmec Worm:

This Worm is also known as W32.Burmec.