FRISK Software International

Summary of VBS/Carewmr
Alias:Carewmr, VBS.AVFake
Discovered: 22 Oct 2002
Definition files: 22 Oct 2002
Risk Level: Low
Jump to:
Brief description
Technical description

Brief Description
VBS/Carewmr is a trojan written with Visual Basic Script. Upon execution the trojan displays three messages

Technical Description
This a simple trojan that, when executed, will show following three messages:

	Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start
	scanning your computer.

	ERROR!, Code error:3212552, please execute this tool in MS-DOS.

	Thank You for prefer Kaspersky Labs Products
At September 1st, it shows an additional message in Spanish:

	Mr.Carew vuelve otra vez!!, jaja
which means in English

	Mr.Carew comes back again!!, jaja
After these messsages, the trojan will open the web page using the default browser.

Next, the trojan attemps to remove a number of registry keys, attempting to disable several security software:

	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoneAlarm Pro
The trojan also creates a number of directories and empty files to the root of the C: drive using for example names of different anti-virus products. It also attempts to delete all files from the C:\Windows directory.

Finally the trojan creates a text file to the current directory "CLRAV_Report.log" with the following content:

	Due an error, Code error:3212552, CLRAV has not disinfect your
	computer For Support please send a e-mail to
	and please indicate the Code Error.
The trojan has the following comment in the beginning:

'VBS.CarewMR.a By Jadraquer Killer (Mr.Carew) 
F-Prot Antivirus detects this trojan with latest virus signature files.

[Analysis: Katrin Tocheva and Sami Rautiainen; translation: Ero Carrera; F-Secure Corp.; October 22th, 2002.]

Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:


perComp Verlag
(in German)