W32/Culler-A is a worm for the Windows platform that spreads via MSN Messenger.
W32/Culler-A includes functionality to access the internet and communicate with a remote server via HTTP.
W32/Culler-A attempts to terminate and disable various security software applications and Windows processes such as Task Manager, regedit and cmd.exe.
When first run, W32/Culler-A will display the following error message:
'Component "COMDLG32.OCX" or one of its dependencies no correctly registered a file is missing or invalid.'
It then copies itself to:
<Windows>\Avconsol.exe
<Windows>\Zap.exe
<System>\Hide32.exe
<System>\Ttt.exe
W32/Culler-A attempts to download and execute files from a remote location. At the time of writing, these files were unavailable for download.
The worm sets the following registry entries to run at system startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AVantivirus
<Windows>\Avconsol.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicewin
<Windows>\Hide32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System
<Windows>\Zap.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinService
<Windows>\Ttt.exe
W32/Culler-A sets the following registry entry:
HKCU\Software\VB and VBA Program Settings\SysUpdate\sistema
Marcar
1