W32/Kalel-B

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Kalel-B is a mass-mailing worm and backdoor Trojan that also targets peer-to-peer file sharing utilities.

W32/Kalel-B runs continuously in the background, providing a backdoor server, which allows a remote intruder to gain access and control over the computer.

W32/Kalel-B displays a message box displaying the following fake error message:

Fatal Error: Exception Code=C00000005
Called from - frmimportwizard.pageframe1.page2.command1.click line 70
Called from - mail line 613

W32/Kalel-B contacts the sites www.google.com and search.yahoo.com in order to harvest email addresses. The worm sends itself as an email attachment to these email addresses.

Messages are sent with the following subject line:

**WARNING** Mailbox Suspension

The message text is as follows:

This message was created automatically by mail delivery software (TMDA) - do not reply.

In order to safeguard your mailbox from unexpected termination, please read the attached document.

++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com W32/Kalel-B is a mass-mailing worm and backdoor Trojan that also targets peer-to-peer file sharing utilities.

W32/Kalel-B runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.

W32/Kalel-B displays a message box displaying the following fake error message:

Fatal Error: Exception Code=C00000005
Called from - frmimportwizard.pageframe1.page2.command1.click line 70
Called from - mail line 613

W32/Kalel-B contacts the sites www.google.com and search.yahoo.com in order to harvest email addresses. The worm sends itself as an email attachment to these email addresses.

Messages are sent with the following subject line:

**WARNING** Mailbox Suspension

The message text is as follows:

This message was created automatically by mail delivery software (TMDA) - do not reply.
In order to safeguard your mailbox from unexpected termination, please read the attached document.

++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com

When first run W32/Kalel-B copies itself to the following locations:

<Windows>\system\lsass.exe
<Windows>\system\services.exe
<Windows>\system\smss.exe

W32/Kalel-B may copy itself to any of the following folders:

C:\My Downloads\
C:\My Shared Folder\
C:\program files\Ares\My Shared Folder\
C:\program files\BearShare\Shared\
C:\program files\direct connect\received files\
C:\program files\eDonkey2000\incoming\
C:\program files\eMule\Incoming\
C:\program files\gnucleus\downloads\
C:\program files\gnucleus\downloads\incoming\
C:\program files\grokster\my grokster\
C:\program files\grokster\my shared folder\
C:\program files\icq\shared files\
C:\program files\KaZaa Lite\My Shared Folder\
C:\program files\KaZaa\My Shared Folder\
C:\program files\KMD\my shared folder\
C:\program files\limeWire\shared\
C:\program files\Morpheus\my shared folder\
C:\program files\rapigator\share\
C:\program files\shareaza\downloads\
C:\program files\StreamCast\Morpheus\my shared folder\
C:\programmi\Ares\My Shared Folder\
C:\programmi\BearShare\Shared\
C:\programmi\direct connect\received files\
C:\programmi\eDonkey2000\incoming\
C:\programmi\eMule\Incoming\
C:\programmi\gnucleus\downloads\
C:\programmi\gnucleus\downloads\incoming\
C:\programmi\grokster\my grokster\
C:\programmi\grokster\my shared folder\
C:\programmi\icq\shared files\
C:\programmi\KaZaa Lite\My Shared Folder\
C:\programmi\KaZaa\My Shared Folder\
C:\programmi\KMD\my shared folder\
C:\programmi\limeWire\shared\
C:\programmi\Morpheus\my shared folder\
C:\programmi\rapigator\share\
C:\programmi\shareaza\downloads\
C:\Programmi\StreamCast\Morpheus\my shared folder\
C:\shared\

W32/Kalel-B drops the following ZIP files, each containing a copy of the worm:

<Windows>\system\rockefeller64.zip
<Windows>\system\rockefeller65.zip
<Windows>\system\rockefeller66.zip

W32/Kalel-B drops the following files, each containing a copy of one of the above ZIP files in uuencoded format:

<Windows>\system\rundll16.ref
<Windows>\system\rundll32.ref
<Windows>\system\rundll64.ref

W32/Kalel-B drops a text file ROCKEFELLER.DAT in the folder <Windows>\system. This contains the following text:

W32.Rockerfeller@MM+P2P+BACKDOOR+KEYLOGGER

W32/Kalel-B may create further files with the following names:

<Windows>\system\rfdriver32.dll
<Windows>\system\mouse_drv16.ref
<Windows>\system\mouse_drv32.ocx
<Windows>\system\mouse_drv64.dat

The following registry entries are created to run the worm on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Controller
<Windows>\system\services.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS Security Authority Service
<Windows>\system\lsass.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Windows Session Manager Subsystem
<Windows>\system\smss.exe