W32/Bizex-A

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sysmon

and delete it if it exists.

Close the registry editor.

W32/Bizex-A is a worm which propagates over ICQ.

The worm appears as an ICQ message prompting the user to visit a website hosted on www.jokeworld.com. The web page downloads a file to the user's computer as startup.wav and runs the file.

Startup.wav contains a script which creates the file WinUpdate.exe in the startup folder. When Windows is next started WinUpdate.exe attempts to download a file named updater.exe to the Windows temp folder as aptgetupd.exe. Aptgetupd.exe is the main component of W32/Bizex-A. The worm copies itself to the sysmon subfolder of the Windows system folder as a file named sysmon.exe and adds the following registry entry to ensure that the worm is run each time Windows starts up:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sysmon

W32/Bizex-A also drops the following DLL files in the Windows system folder
icw_socket.dll, ICQ2003Decrypt.dll, java32.dll and javaext.dll.

The DLL files are used to send ICQ messages to people on the infected user's contact list and to monitor user activity.

W32/Bizex-A monitors user activity and logs keystrokes associated with the following windows:

Acceso a Banca por Internet
Accueil Bred.fr > Espace Bred.fr
American Express UK - Personal Finance
Banamex.com
baNK
Banque
Banque en ligne
Barclaycard Merchant Services
Collegamento a Scrigno
Commercial Electronic Office Sign On
Credit Lyonnais interacti
CyberMUT
e-gold Account Access
E*TRADE Log On
Home Page Banca Intesa
LloydsTSB online - Welcome
Merchant Administration
Page d'accueil
Secure User Area
SUNCORP METWAY
Tous les produits et services
VeriSign Partner Manager
VeriSign Personal Trust Service
Wells Fargo - Small Business Home Page

Logged information is sent via FTP to a remote server.