W32/Dref-L

Please follow the instructions for removing infected executable files.

W32/Dref-L is a mass-mailing worm and parasitic virus with IRC backdoor functionality for the Windows platform.

When first run W32/Dref-L copies itself to <System>\Duel_v2.exe and creates the file <Windows>\Duel.log (which can be safely deleted).

W32/Dref-L will attempt to infect SCR EXE and RAR files then email itself as an attachment to email addresses harvested from the infected computer.

On the 29th day of each month W32/Dref-L will also attempt to destroy files with the following extensions:

WMV ACE JPG ISO MP3 PDF MPG AVI MDB PPT XLS ZIP DOC

The following registry entries are created to run Duel_v2.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32_Duel_v2
<System>\Duel_v2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32_Duel_v2
<System>\Duel_v2.exe

W32/Dref-L sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).

Emails sent by the worm may take the following forms:

Subject Line chosen from:

Love...
Valentine (a little late)
A kiss for a smile
Me and you
True feelings
My heart
Yours forever
Thee and me

Message text chosen from:

I wrote your name in the sky,
but the wind blew it away.
I wrote your name in the sand,
but the waves washed it away.
I wrote your name in my heart,
and forever it will stay.

I love the way you touch me,
Always sending chills down my spine.
I love that you are with me,
And glad that you are mine.

I love the way you make me so happy,
And the ways you show you care.
I love the way you say, I Love You,
And the way you're always there.

I love the way you look at me,
Your eyes so bright and blue.
I love the way you kiss me,
Your lips so soft and smooth.

If I could have just one wish,
I would wish to wake up everyday
to the sound of your breath on my neck,
the warmth of your lips on my cheek,
the touch of your fingers on my skin,
and the feel of your heart beating with mine...
Knowing that I could never find that feeling
with anyone other than you.

My love, I have tried with all my being
to grasp a form comparable to thine own,
but nothing seems worthy;

And though at times a thread may break
A new one forms in its wake
To bind us closer and keep us strong
In a special world, where we belong.

Its fingers spread like fine spun gold
Gently nestling us to the fold
Bonds like this are meant to last.

A special world for you and me
A special bond one cannot see
It wraps us up in its cocoon
And holds us fiercely in its womb.

Attachment name chosen from:

WantsU.exe
My heart.exe
A smile.exe
Forever.exe
My love.exe
My desire.exe
My hope.exe
My wish.exe
The sky.exe