W32/Culler.A Worm

 Information about the W32/Culler.A Worm:

W32/Culler.A is a worm. The worm will infect Windows systems and spreads through MSN Instant Messenger.

Upon execution, the worm copies itself as Avconsol.exe, zap.exe, hide32.exe and ttt.exe in the Windows System folder.

It modifies the registry at the following locations;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system

It also tries to terminate any window containing the following strings:

AD_Aware
AntiVir
antivirus
Antivirus
avast
AVG
BitDefender
Dr.Web
eSafe
ewido
HiJack
hijack
Kaspersky
Malware
malware
McAfee
Panda
Scanner
Spybot
spyware
Spyware
virus
Virus

The worm then displays a dialog box with the following text message;

Component "COMDLG32.OCX" or one of its dependencies no correctly registered a file is missing or invalid.

The worm also tries to access pages under the following URLs:

http://99contador99.(Blocked)
http://sino7777.go(Blocked)
http://zapallo99.go(Blocked
http://game122.goo(Blocked)

This worm first appeared on February 24, 2007.

 Other names of W32/Culler.A Worm:

This Worm is also known as W32.Culler.A.