FRISK Software International


Summary of VBS/Carewmr
Alias:Carewmr, VBS.AVFake
Discovered: 22 Oct 2002
Definition files: 22 Oct 2002
Risk Level: Low
Distribution:Low
 
Jump to:
Brief description
Technical description

Brief Description
VBS/Carewmr is a trojan written with Visual Basic Script. Upon execution the trojan displays three messages


Technical Description
This a simple trojan that, when executed, will show following three messages:


	Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start
	scanning your computer.


	ERROR!, Code error:3212552, please execute this tool in MS-DOS.


	Thank You for prefer Kaspersky Labs Products
At September 1st, it shows an additional message in Spanish:


	Mr.Carew vuelve otra vez!!, jaja
which means in English


	Mr.Carew comes back again!!, jaja
After these messsages, the trojan will open the web page http://www.avp.ru using the default browser.

Next, the trojan attemps to remove a number of registry keys, attempting to disable several security software:


	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SystemTray
	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\AVPCC
	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAVW32
	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TrueVector
	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoneAlarm Pro
The trojan also creates a number of directories and empty files to the root of the C: drive using for example names of different anti-virus products. It also attempts to delete all files from the C:\Windows directory.

Finally the trojan creates a text file to the current directory "CLRAV_Report.log" with the following content:


	Due an error, Code error:3212552, CLRAV has not disinfect your
	computer For Support please send a e-mail to support@kaspersky.com
	and please indicate the Code Error.
The trojan has the following comment in the beginning:

'VBS.CarewMR.a By Jadraquer Killer (Mr.Carew) 
F-Prot Antivirus detects this trojan with latest virus signature files.


[Analysis: Katrin Tocheva and Sami Rautiainen; translation: Ero Carrera; F-Secure Corp.; October 22th, 2002.]
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is