Piggi.A mass mails itself and collects e-mail addresses. Piggi.A kills processes belonging to anti-virus and security software and has a rootkit functionality.
Usually standalone malware (backdoors, worms, trojans, etc.) is automatically removed by F-Secure Anti-Virus (FSAV) starting from version 5.40. Malware files get automatically renamed by FSAV, so they can not be started any more. In some rare cases, when automatic disinfection is not possible, a user can select disinfection action by him/herself to make FSAV rename or delete an infected file. In some special cases, it is recommended to use specific disinfection tools provided by F-Secure. They can be downloaded from our ftp site:
To manually disinfect standalone malware (backdoors, worms, trojans, etc.) it's usually enough to delete all infected files from a computer and to restart it. Active malware files are usually locked by operating system so different disinfection approaches are required for different operating systems.
Please note that manual disinfection is a risky process, so it is recommended only for advanced users.
If Windows 95, 98 and ME operating system are used, it is recommended to restart a computer from a bootable system diskette and to delete an infected file from the command prompt. For example, if a malicious file named ABC.EXE is located in the Windows folder, it is usually enough to type the following command at the command prompt:
and press Enter. After that, the infected file will be gone. If Windows NT, 2000 or XP are used, a malicious file has to be renamed with a different extension (for example .VIR) and then the system has to be restarted. After restarting, a renamed malicious file will no longer be active and it can be easily to delete manually.
Malware Disinfection Tools
F-Secure provides disinfection tools for certain malware. These tools can be downloaded from this webpage:
If Windows ME or XP are used, it is recommended to disable System Restore features of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore features of these operating systems might save an infected file into the special folder and copy it back to a hard drive every time it has been renamed or deleted by F-Secure Anti-Virus or by a user. Instructions on how to disable the System Restore features are here:
It will also copy itself to "C:\Program Files\Internet Explorer\iexplore.exe". The original iexplore.exe will be moved to the folder:
It also creates copies of itself to folders with the following strings:
my shared folder
The filename is any of the following:
28 Weeks Later
30 Days of Night
30 Rock season 2
Across the Universe
Age of Conan-Hyborian Adventures
Are We Done Yet?
Balls of Fury
Because I Said So
Blades of Glory
Brother & Sisters season 2
Command & Conquer 3-Tiberium Wars
Company of Heroes
Criminal Minds - next season
Dancing with the Stars - next season
Death at a Funeral
Desperados 2-Cooper's Revenge
Desperate Housewives - next season
Dreamfall-The Longest Journey
Dungeons & Dragons Online-Stormreach
Elder Scrolls IV-Oblivion
Enemy Territory-Quake Wars
Fantastic Four 2
Final Fantasy XIV
Fly Me to the Moon
Full Auto 2-Battlelines
Full of It
Gears of War
Ghost Recon-Advanced Warfighter
Gilmore Girls season 8
God Grew Tired of Us
Gran Turismo HD
Grand Theft Auto IV
Heroes of Might & Magic V
His Dark Materials-The Golden Compass
Horton Hears a Who
In the Land of Women
Kidnapped season 2
Kingdom Hearts 2
Kung Fu Panda
La Vie en Rose
Master of Time and Space
Metroid Prime Hunters
Opus-The Last Christmas
Pride & Glory
Prison Break season 3
Prom Night (2007)
Resistance-Fall of Man
Rise of Nations-Rise of Legends
Romeo & Juliet-Sealed with a Kiss
S.T.A.L.K.E.R.-Shadow of Chernobyl
Scrubs - next season
Seven Day Itch
Shoot 'Em Up
South Park season 11
Splinter Cell Essentials
Splinter Cell-Double Agent
Standoff season 2
Star Wars-Empire at War
Stomp the Yard
Talk to Me
The Assassination of Jesse James
The Astronaut Farmer
The Dark Is Rising
The Half Life of Timofey Berezin
The Ice at the Bottom of the World
The Last Legion
The Last Sin Eater
The Lives of Others
The Lord of the Rings-The Battle for Middle-earth II
The Nine season 2
The Number 23
The OC season 5
The Office season 4
The Spiderwick Chronicles
The TV Set
The Ultimate Gift
Til Death season 2
Trick 'r Treat
Ugly Betty season 2
Vanguard Saga of Heros
Veronica Mars - next season
Without a Trace - next season
World of Warcraft-The Burning Crusade
The file name includes any of the following extensions:
World of Warcraft-The Burning Crusade - Keygen.exe
World of Warcraft-The Burning Crusade.mp4.com
Stops Antivirus Services
Piggi.A also stops running antivirus services with the following names:
Then copies itself to the following folders:
This is to ensure that these antivirus applications cannot perform an automatic update.
This malware hides its own process and files using two kernel-mode drivers.
msfsr.sys - dropped in the Windows system directory and run as service. This creates a device, so that user-mode can communicate with it and allows the user-mode component to hide any process_id it wants.
[random_name].sys - dropped in %windir%\system32\drivers\ and run as service. This hides any files that are defined in the created c:\zyxwvuts.log file. Below is an example of the string inside the said file:
Spreading via E-mail
The worm collects e-mail addresses from the infected computer. It locates the WAB (Windows Address Book) file and Temporary Internet files. The following are the details:
The worm sends itself as attachment to the gathered e-mail addresses using the following format:
[Gathered e-mail address]
The From field may use any of these addresses:
They may use any of these domain names:
Data format error.
Destination host is not responding.
Mail quota exceeded.
Mail transaction failed.
Mail transaction failed. Data format error.
Mail transaction failed. Mail quota exceeded.
Mail transaction failed. Message is too large.
Mail transaction failed. Partial message is available.
Mail transaction failed. Service unavailable.
Mail transaction failed. Session aborted.
Message is too large.
The subject may use any of the following strings:
Your message could not be delivered.
Your message is undeliverable.
Your message was not delivered.
The filenames of the attachment may contain any of these strings:
Alien vs. Predator 2
Command & Conquer 3: Tiberium Wars
Dungeons & Dragons Online: Stormreach
Enemy Territory: Quake Wars
Extreme Ghouls n' Ghosts
Final Fantasy XIII
Full Auto 2: Battlelines
Ghost Recon: Advanced Warfighter
Grey's Anatomy - next season
Half-Life 2: Aftermath
Heroes season 2
Indiana Jones 4
Jericho season 2
Live Free or Die Hard
Lost season 4
Metal Gear: Subsistence
Neverwinter Nights 2
Rainbow Six: Vegas
Resident Evil 3
Resident Evil 5
Resistance: Fall of Man
Rush Hour 3
Shark season 2
Six Degrees season 2
Smith season 2
Splinter Cell: Double Agent
Star Trek: Legacy
Star Wars: Empire at War
Studio 60 on the Sunset Strip season 2
The Hills Have Eyes II
Unreal Tournament 2007
Virtua Fighter 5
Warhammer Online Age Of Reckoning
your bank account details
your financial details
your financial information
your personal details
your personal information
your SSN etc
your tax returns
With any of the following extensions:
Half-Life 2: Aftermath.gif
Neverwinter Nights 2.wav
Star Wars: Empire at War.jpeg
This malware uses a pool of strings to search and combine to create the body of the e-mail. The following are some of the strings that can be found in the e-mail's body:
[Hi | Hello]
[We discovered this | I discovered this | We saw this | We found this | I saw this | I found this]
[shot | picture | photo]
(attached) of you on
[Flickr. | the web. | the net. | somebody's blog. | a web site.]
[Maybe you should | You should | You have to | I think you should | You need to]
[open it | see it | look at it]
[straight away. | right now. | immediately.]
[That's unnatural! | That's offensive! | That shouldn't be allowed! | That's disgusting! | I can't believe you would publish that yourself. | That should be private! | You shouldn't be doing that. | I can't believe you would do that. | I can't believe that is you.]
[Maybe you should | You should | You have to | I think you should | You need to]
[A free | This is a limited time | This is a limited | This is a one time | This is a once only]
[deal. | offer.]
[A | A brand new | Your own]
[laptop | Sat Nav | MP3 player | plasma TV | LCD TV | notebook | digital camera | cell phone | Nokia cell phone | iRiver Clix | Sony PSP | Nintendo DS Lite | Creative Zen V Plus | Creative Zen Vision:M | Sony Laptop | Apple MacBook Pro | Toshiba Gigabeat | iPod | Motorola Q cell phone | Canon PowerShot | Microsoft Zune |Sony PlayStation 3 | Nintendo Wii | Vista upgrade]
[completely free | totally free | for nothing | for free]
[Instructions attached. | Details attached. | Just open the attachment for details. | Look at the attachment. | See the attachment.]
Below are examples of the the possible string combinations that can be found in the body of the email:
I found this picture (attached) of you on somebody's blog.
Maybe you should look at it straight away. I can't believe you would publish that yourself.
I saw this amazing free deal on the web. This is a one time offer. Your own Nintendo Wii totally free.
Just open the attachment for details.
Piggi.A also continues queries to the site mi5.gov.uk.
This malware comes packed with Yoda Protector 1.03.3
F-Secure Anti-Virus detects this malware with the following updates: