W32/Culler-A

Please follow the instructions for removing worms.

W32/Culler-A is a worm for the Windows platform that spreads via MSN Messenger.

W32/Culler-A includes functionality to access the internet and communicate with a remote server via HTTP.

W32/Culler-A attempts to terminate and disable various security software applications and Windows processes such as Task Manager, regedit and cmd.exe.

When first run, W32/Culler-A will display the following error message:

'Component "COMDLG32.OCX" or one of its dependencies no correctly registered a file is missing or invalid.'

It then copies itself to:

\Avconsol.exe
\Zap.exe
\Hide32.exe
\Ttt.exe

W32/Culler-A attempts to download and execute files from a remote location. At the time of writing, these files were unavailable for download.

The worm sets the following registry entries to run at system startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AVantivirus
\Avconsol.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicewin
\Hide32.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System
\Zap.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinService
\Ttt.exe

W32/Culler-A sets the following registry entry:

HKCU\Software\VB and VBA Program Settings\SysUpdate\sistema
Marcar
1