W32/Tibick-A

Please follow the instructions for removing worms.

You will also need to edit the following registry entries. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Restore = svcnet.exe

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\CurrentVersion\
Run\System Restore = svcnet.exe

and delete it if it exists.

Close the registry editor.

• Check your computer for anything that the worm may have downloaded.
• If you use Morpheus, replace the file 'MorphConfig.ini' from backup.
• If you use Warez, replace the file 'Shared Folders.txt' from backup.
• If you use eMule, replace the file 'shareddir.dat' from backup.
• If you use DC++, replace the file 'DCPlusPlus.xml' from backup.
• If you use KaZaA, uninstall, delete the registry key HKCU\Software\Kazaa, then reinstall.
• If you use iMesh, uninstall, delete the registry key HKCU\Software\iMesh, then reinstall.

W32/Tibick-A is a peer-to-peer (P2P) worm that spreads via a number of different P2P networks.

W32/Tibick-A also contains IRC backdoor Trojan functionality and can download and execute files from remote websites if instructed to do so. W32/Tibick-A is a peer-to-peer worm.

W32/Tibick-A copies itself to the Windows system folder with the filename SVCNET.EXE and sets the following registry entries so as to run itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Restore =
svcnet.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
System Restore =
svcnet.exe

W32/Tibick-A may attempt to copy itself to the subfolder MSVIEW of the Windows folder with some of the following filenames, appending different numbers of zero bytes to the end of each to give them different filesizes:

Ad-aware.exe
Ad-aware Professional.exe
Spybot - Search & Destroy.exe
ICQ 4.exe
WinZip.exe
WinZip 9.x Crack.exe
WinZip All KeyGen.exe
iMesh.exe
LimeWire.exe
ICQ Pro 2003b.exe
DivX Player (with DivX Codec).exe
DivX Player Crack.exe
Morpheus.exe
RealPlayer.exe
RealPlayer Crack.exe
Download Accelerator Plus.exe
WinRAR.exe
WinRAR 3.x Crack.exe
WinRAR All KeyGen.exe
Webroot Spy Sweeper.exe
Webroot Spy Sweeper Crack.exe
Avant Browser.exe
WinMX.exe
Warez P2P.exe
Trillian.exe
Adobe Acrobat Reader.exe
HijackThis.exe
Nero 6 Ultra Edition.exe
Nero 6 Ultra Edition Crack.exe
Nero 6 Ultra Edition KeyGen.exe
eMule.exe
Spyware Doctor.exe
Spyware Doctor Crack.exe
Ares Galaxy.exe
Kazaa Download Accelerator Pro.exe
NetPumper.exe
NetPumper Crack.exe
SpyHunter.exe
SpyHunter Crack.exe
ZoneAlarm.exe
All-in-One Secretmaker.exe
MSN Toolbar.exe
dBpowerAmp Music Converter.exe
MyIE2.exe
VirtualLab Data Recovery.exe
Registry Mechanic.exe
Registry Mechanic Crack.exe
Shockwave Player.exe
Mozilla Firefox.exe
QuickTime.exe
JetAudio Basic.exe
MSN Messenger (Windows XP).exe
Yahoo Messenger.exe
AOL Instant Messenger (AIM).exe
LimeWire (International).exe
Microsoft Windows Media Player.exe
BitComet.exe
SpywareBlaster.exe
Grokster.exe
RoboForm.exe
Ares Lite.exe
Winamp Full.exe
ZeroSpyware Lite.exe
SolSuite 2004 - Solitaire Card Games Suite.exe
SolSuite 2004 - Solitaire Card Games Suite Crack.exe
Snood.exe
Snood Crack.exe
Need for Speed Underground Crack.exe
Unreal Tournament 2004 Crack.exe
Dope Wars Crack.exe
Gunbound Trainer.exe
RollerCoaster Tycoon NO CD Crack (Including Attractions Pack).exe
Macromedia Flash 5 Crack.exe
Virtuosa Phoenix Edition Crack.exe
Windows XP SP2 KeyGen.exe
CloneCD All Version KeyGen.exe
CloneCD 2.x Crack.exe
CloneCD 3.x Crack.exe
Quake 3 - The Arena NO CD Crack.exe
Dr Divx Crack.exe
FrontPage XP 2002 Crack.exe
LOTR NO CD Crack.exe
Winace 2.x Crack.exe
Half-Life 2 NO CD Crack.exe
Half-Life 2 Keygen.exe
Doom 3 NO CD Crack.exe
Max Payne 2 NO CD Crack.exe
Jedi Academy NO CD Crack.exe
Hidden and Dangerous 2 NO CD Crack.exe
Counter-Strike Condition Zero Keygen.exe
Deus Ex Invisible War NO CD Crack.exe
Battlefield Vietnam Multiplayer Online Crack.exe
The Sims - Vacation Expansion Pack no cd crack.exe
Dungeon Siege no cd crack.exe
Star Wars Jedi Knight II - Jedi Outcast no cd crack.exe
Heroes of Might and Magic IV no cd crack.exe
The Sims no cd crack.exe
The Sims - Hot Date Expansion Pack no cd crack.exe
Medal Of Honor - Allied Assault no cd crack.exe
Freedom Force no cd crack.exe
Tom Clancys Ghost Recon - Desert Siege no cd crack.exe
Starcraft - Battlechest no cd crack.exe
Soldier of Fortune II- Double Helix no cd crack.exe
Grand Theft Auto III no cd crack.exe
The Sims- Vacation no cd crack.exe
Star Wars Jedi Knight II- Jedi Outcast no cd crack.exe
Harry Potter and the Sorcerers Stone no cd crack.exe
Medal of Honor- Allied Assault no cd crack.exe
Zoo Tycoon- Dinosaur Digs no cd crack.exe
Zoo Tycoon no cd crack.exe
Star Wars Galactic Battlegrounds- Clone Campaigns no cd crack.exe
The Sims - Unleashed Expansion Pack no cd crack.exe
Battlefield 1942 no cd crack.exe
Warcraft III - Reign Of Chaos no cd crack.exe
Unreal Tournament 2003 no cd crack.exe
The Sims Deluxe no cd crack.exe
Roller Coaster Tycoon no cd crack.exe
Mafia no cd crack.exe
MS Zoo Tycoon no cd crack.exe
Medieval - Total War no cd crack.exe
Icewind Dale 2 no cd crack.exe
Sponge Bob Square Pants - Operation Krabby Patty no cd crack.exe
Madden NFL 2003 no cd crack.exe
Harry Potter and The Sorcerers Stone no cd crack.exe
Sim Theme Park World no cd crack.exe
Backyard Baseball 2003 no cd crack.exe
Grand Theft Auto 3 no cd crack.exe
Halo - Combat Evolved - Microsoft no cd crack.exe
Final Fantasy XI - Square Enix USA no cd crack.exe
Max Payne 2 Fall Of Max Payne no cd crack.exe
Dark Age Of Camelot - Trials Of Atlantis no cd crack.exe
Age Of Mythology - The Titans no cd crack.exe
Command & Conquer - Generals Zero Hour no cd crack.exe
Call Of Duty no cd crack.exe
Age Of Mythology no cd crack.exe
Medal Of Honor - Allied Assault BreakThrough no cd crack.exe
The Sims Double Deluxe no cd crack.exe
Star Wars - Jedi Knight - Jedi Academy no cd crack.exe
The Sims - Makin Magic Expansion Pack no cd crack.exe
Sim City 4 Deluxe no cd crack.exe
The Sims - Superstar Expansion Pack no cd crack.exe
Microsoft Flight Simulator 2004 - A Century Of Flight no cd crack.exe
Sim City 4 - Rush Hour no cd crack.exe
Zoo Tycoon - Complete Collection no cd crack.exe
Diablo 2 no cd crack.exe
Command & Conquer - Generals no cd crack.exe
windows server 2003 crack.exe
NeedforspeedUnderground-nocd.exe
Need for speed underground - nocd.exe
Nero Burning ROM v6.x crack.exe
Windows XP Activation Crack.exe
Windows XP Professional crack.exe
Windows XP home edition Activation.exe
Norton AntiVirus 2004 crack.exe
CloneDVD v1.x crack.exe
The Lord of the Rings The Return of The King crack.exe
MaxPayne 2 The Fall Of Max Payne Crack.exe
Adobe Golive v6.0 Keygen.exe
Adobe Illustrator v10.0 Time Limit Crack.exe
Adobe ImageReady v1.0 crack.exe
Adobe PageMaker v7.0 Keygen.exe
Adobe Photoshop all.exe
Adobe Photoshop 7 keygen.exe
Adobe Serial Generator v2.0.exe
Anti-Trojan 4.0.exe
All Macromedia Products Keygen.exe
Macromedia ColdFusion MX crack.exe
Macromedia Director 8 Crack.exe
Macromedia Dreamweaver 4.0 Patch.exe
Macromedia Dreamweaver MX v6.0 crack.exe
Macromedia Dreamweaver UltraDev 4.0 Patch.exe
Macromedia Fireworks 4.0 Patch.exe
Macromedia Flash All Versions keygen.exe
Macromedia Flash SWF-Unprotect v2.0.exe
Macromedia Flash MX v6.0 crack.exe
Macromedia FreeHand v10 Loader.exe
Macromedia Contribute v2.0 crack.exe
Cubase Audio XT 3.X crack.exe
FlashFXP v1.4.1 Crack.exe
FlashFXP v1.4.3 Crack.exe
FlashFXP 2 RC2 Crack.exe
mirc 6.1x reg entries.exe
mIRC 6.X crack.exe
FlashFXP v2.0 Crack.exe
FlashFXP v2.1 crack.exe
FlashFXP v2.2 crack.exe
FlashFXP All Version KeyGen.exe
NBA Live 2004 crack.exe
NBA Live 2003 crack.exe
Need for Speed Hot Pursuit 2 CD KeyGenerator.exe
Need for Speed4 - NOCD.exe
Need For Speed 5 - no cd.exe
CCALG - Credit Card Generator.exe
Matrix Screensaver.exe
Microsoft Office 2000 Regmaker.exe
Microsoft Office XP Professional Serial.exe
Microsoft Office XP Professional Crack.exe
Microsoft Office XP Universal Activator v1.0.exe
Microsoft Office XP Activation Crack.exe
Microsoft Office XP Activation Killer.exe
MS Office XP Activation Crack.exe
WinZip All Versions keygen.exe
WinZip Self-Extractor v2.2 Patch.exe
WinZip Self-Extractor v2.2 keygen.exe
Winzip keygen.exe
WinZip v8.0 Keygen.exe
WinZIP v9.0 Keygen.exe
WinZip v9.0 Registration.exe
Ad-aware Pro Crack.exe
LimeWire server scanner.exe
RealPlayer crack (keygen).exe
WinRAR crack (keygen).exe
MSN Toolbar advert remover.exe
MSN advert remover.exe
FlashGet.exe
Adobe Acrobat Reader crack.exe
Trillian crasher.exe
RoboForm crack.exe
VirtualLab Data Recovery crack.exe
ZoneAlarm crack (keygen).exe
SolSuite 2004 - Solitaire Card Games Suite crack.exe
RYL crack.exe
Snood crack.exe
Need for Speed Underground NO CD crack.exe
Worms Armageddon NO CD crack.exe
Unreal Tournament 2004 NO CD crack.exe
Unreal Tournament 2004 crack (keygen).exe
Civilization III crack.exe
Sonic the Hedgehog 3 crack.exe
Max Payne 2 The Fall of Max Payne NO CD crack.exe
Grand Theft Auto Vice City NO CD crack.exe
Diablo 2 NO CD crack.exe
Age of Empires II The Age of Kings NO CD crack.exe
GTA crack.exe
Tiger Woods PGA Tour 2004 crack.exe
Tony Hawks Underground crack.exe
XBOX X-Fer Ripper and Transfer.exe
Halo 2 crack.exe
Need for Speed Underground 2 NO CD crack.exe
Need for Speed Underground 2 crack.exe
Forgotten Realms - Demon Stone crack.exe
s Splinter Cell Pandora Tomorrow crack.exe
The Sims 2 crack.exe
Grand Theft Auto San Andreas NO CD crack.exe
Madden NFL 2005 EA crack.exe
Grand Theft Auto - San Andreas Rockstar Games crack.exe
F.E.A.R. VU Games crack.exe
Knights Apprentice Memoricks Adventures Games crack.exe
Psi-Ops - The Mindgate Conspiracy Midway crack.exe
Shadow Ops - Red Mercury Atari crack.exe
The Chronicles of Riddick - Escape From Butcher Bay VU Games crack.exe
Besieger DreamCatcher Interactive crack.exe
Joint Operations - Typhoon Rising NovaLogic crack.exe
Vampire - The Masquerade - Bloodlines Activision crack.exe
Spider-Man 2 Activision crack.exe
Front Mission 4 Square Enix crack.exe
Blinx 2 - Masters of Time & Space Microsoft crack.exe
Dungeon Lords DreamCatcher Interactive crack.exe
The Elder Scrolls III - Morrowind Game of the Year Edition Bethesda Softworks
crack.exe
Resident Evil 4 GC Adventure Capcom crack.exe
Far Cry Ubisoft crack.exe
McFarlanes Evil Prophecy Konami crack.exe
Snowblind Eidos Interactive crack.exe
Malice Mud Duck Productions crack.exe
Crusader Kings Paradox Entertainment crack.exe
The Legend of Zelda - Four Swords Adventures GC Nintendo crack.exe
ShellShock - Nam 67 Eidos Interactive crack.exe
Gran Turismo 4 SCEA crack.exe
Harry Potter and the Prisoner of Azkaban Adventure EA Games crack.exe
Onimusha 3 - Demon Siege Adventure Capcom crack.exe
Thief - Deadly Shadows Eidos Interactive crack.exe
Enter the Matrix Atari crack.exe
Purge Jihad Freeform Interactive LLC crack.exe
Dragon Ball Z - Supersonic Warriors GBA Atari crack.exe
DRIV3R Atari crack.exe
Tom Clancys Splinter Cell Ubisoft crack.exe
World of Warcraft Blizzard Entertainment crack.exe
Half-Life 2 VU Games crack.exe
Ninja Gaiden Tecmo crack.exe
Forgotten Realms - Demon Stone Atari crack.exe
Mario Pinball Land GBA Puzzle Nintendo crack.exe
Tom Clancys Splinter Cell Pandora Tomorrow Ubisoft crack.exe
The Legend of Zelda (working title) GC Nintendo crack.exe
Full Spectrum Warrior THQ crack.exe
Backyard Wrestling 2 - There Goes the Neighborhood Eidos Interactive crack.exe
Medal of Honor Pacific Assault EA Games crack.exe
WWE SmackDown! vs. Raw THQ crack.exe
Midnight Club 3 - DUB Edition Rockstar Games crack.exe
Second Life Linden Lab crack.exe
Singles - Flirt Up Your Life Eidos Interactive crack.exe
City of Heroes NCsoft crack.exe
Doom 3 Activision crack.exe
Dragon Warrior VIII Square Enix crack.exe
Blitzkrieg - Burning Horizon CDV Software GmbH crack.exe
The Suffering Midway crack.exe
Mario Tennis GC Nintendo crack.exe
Unreal Tournament 2004 Atari crack.exe
Yoshinoya Success crack.exe
Final Fantasy XII Square Enix crack.exe
Metal Gear Solid 3 - Snake Eater Konami crack.exe
Geist GC Nintendo crack.exe
The Legend of Zelda - The Minish Cap GBA Nintendo crack.exe
Final Fantasy VII - Advent Children PSP Square Enix crack.exe
Alias Acclaim crack.exe
NCAA Football 2005 EA crack.exe
ESPN NFL 2K5 Sega crack.exe
Fire Emblem - Seima no Kouseki GBA Nintendo crack.exe
Spider-Man 2 GC Activision crack.exe
Silent Storm - Sentinels _No Company crack.exe
Goblin Commander - Unleash the Horde Jaleco Entertainment crack.exe
Mega Man Anniversary Collection GC Capcom crack.exe
The Lord of the Rings The Battle for Middle-earth EA Games crack.exe
MVP Baseball 2004 EA crack.exe
Fable Microsoft crack.exe
Need for Speed Underground 2 Electronic Arts crack.exe
Command & Conquer - Generals Zero Hour EA Games crack.exe
Metal Gear Acid PSP Konami crack.exe
Red Dead Revolver Rockstar Games crack.exe
WWE Day of Reckoning GC THQ crack.exe
Star Wars Knights of the Old Republic II - The Sith Lords LucasArts crack.exe
Dragon Ball Z - Budokai 3 Atari crack.exe
The Suffering Encore Software Inc. crack.exe
Call of Duty Activision crack.exe
Kingdom Hearts II Square Enix crack.exe
Star Wars - Knights of the Old Republic LucasArts crack.exe
Juiced Acclaim crack.exe
Rise of Nations - Thrones & Patriots Microsoft crack.exe
Battlefield Vietnam EA Games crack.exe
Classic NES Series - The Legend of Zelda GBA Nintendo crack.exe
Dark Matter - The Baryon Proj crack.exe

W32/Tibick-A will then set some of the following registry entries to point to the MSVIEW folder to allow the worm to spread via KaZaA and iMesh:

HKCU\Software\Kazaa\LocalContent\
Dir<NUM>
(where <NUM> is in the range 0-100)

HKCU\Software\iMesh\Client\LocalContent\
Dir<NUM>
(where <NUM> is in the range 0-100)

W32/Tibick-A may add a line to the file MorphConfig.ini in the folder found at:

HKLM\SOFTWARE\Morpheus\Install_Dir

pointing to the MSVIEW folder to allow the worm to spread via Morpheus.

W32/Tibick-A may add a line to the file Shared Folders.txt in the Data subfolder of the folder found at HKCR\wareo\shell\open\command, pointing to the MSVIEW folder to allow the worm to spread via Warez.

W32/Tibick-A may add a line to the file shareddir.dat in the Config subfolder of the folder found at HKCU\Software\eMule\Install Path, pointing to the MSVIEW folder to allow the worm to spread via eMule.

W32/Tibick-A may write a long XML string to the file DCPlusPlus.xml found in the folder at HKLM\SOFTWARE\DC++\Install_Dir, ending with a line pointing to the MSVIEW folder to allow the worm to spread via DC++.

W32/Tibick-A may also set some of the following registry entries to help it spread via KaZaA and iMesh:

HKCU\Software\Kazaa\Advanced\
SuperNode =
0

HKCU\Software\Kazaa\Advanced\
ScanFolder =
0

HKCU\Software\Kazaa\LocalContent\
DisableSharing =
0

HKCU\Software\Kazaa\LocalContent\
DisableListFiles =
1

HKCU\Software\Kazaa\ResultsFilter\
firewall_filter =
0

HKCU\Software\Kazaa\ResultsFilter\
virus_filter =
0

HKCU\Software\Kazaa\Transfer\
UploadBandwidth =
0

HKCU\Software\Kazaa\Transfer\
ConcurrentUploads =
0

HKCU\Software\Kazaa\Transfer\
NoUploadLimitWhenIdle =
1

HKCU\Software\Kazaa\
LimitBitrate =
0

HKCU\Software\Kazaa\DontShow\
CloseToSystray =
1

HKCU\Software\Kazaa\InstantMessaging\
IgnoreAll =
1

HKCU\Software\Kazaa\UserDetails\
AutoConnected =
1

HKCU\Software\iMesh\Client\LocalContent\
DisableSharing =
0

HKCU\Software\iMesh\Client\LocalContent\
ConcurrentUploads =
20

W32/Tibick-A also contains IRC backdoor Trojan functionality. W32/Tibick-A will attempt to connecting to main.m00p.org and may attempt to download and execute a file from a specified address to a random filename with an EXE extension in the Windows system folder if instructed to do so.