Congratulations to Ddunk who discovered this Virus; It has been processed by Segosa and myself.
W32.Velkbot.A is a worm with back door capabilities that spreads through MSN Messenger, Yahoo Messenger and AOL Instant Messenger.
quote:
Originally posted by Symantec Security Response
When W32.Velkbot.A is executed, it performs the following actions:
Sends the following message to all the MSN Messenger, Yahoo Messenger and AOL Instant Messenger contacts on the compromised computer:
Title: rofl
Body: [domain removed]com/pictures.php /r [email address]
Notes:
If the recipient clicks on the above link, a copy of the worm is downloaded. This file is called [email address].
[email address] is an email address specified by the worm.
Copies itself as %System%\winmsg.exe.
Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Adds the value:
"Windows Messenger Messenger" = "winmsg.exe"
to the registry subkeys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
so that W32.Velkbot.A runs every time Windows starts.
Creates a mutex "hedlp32a" to ensure that only one instance of the worm is executed on the computer.
Disables the functionality of the following programs:
Taskmanager
Registry editor
Connects to an IRC server on the afil.canadiangov.info domain and waits for commands from a remote attacker. The remote attacker can perform any of the following actions:
Steals system information
Steals network information
Logs keystrokes
Sends IM message
Downloads a file from internet and executes it
Download: W32.Velkbot.A Removal Tool Developed by Messenger Plus! Zone
Download: Symantec RapidRelease Beta Definitions (Covers this threat)
/ 
Virus Alert! W32.Velkbot.A@mm
