Threat Description

Carewmr

Details

Category: Malware
Type: Trojan
Platform: VBS
Aliases: Carewmr, VBS/Carewmr, VBS.AVFake

Summary


VBS/Carewmr is a trojan written with Visual Basic Script. Upon execution the trojan displays three messages.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


This a simple trojan that, when executed, will show following three messages:

	Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start 	scanning your computer.  	ERROR!, Code error:3212552, please execute this tool in MS-DOS.  	Thank You for prefer Kaspersky Labs Products  

At September 1st, it shows an additional message in Spanish:

	Mr.Carew vuelve otra vez!!, jaja  

which means in English

	Mr.Carew comes back again!!, jaja  

After these messsages, the trojan will open the web page https://www.avp.ru using the default browser.

Next, the trojan attemps to remove a number of registry keys, attempting to disable several security software:

	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SystemTray 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\AVPCC 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAVW32 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TrueVector 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoneAlarm Pro  

The trojan also creates a number of directories and empty files to the root of the C: drive using for example names of different anti-virus products. It also attempts to delete all files from the C:\Windows directory.

Finally the trojan creates a text file to the current directory "CLRAV_Report.log" with the following content:

	Due an error, Code error:3212552, CLRAV has not disinfect your 	computer For Support please send a e-mail to support@kaspersky.com 	and please indicate the Code Error.  

The trojan has the following comment in the beginning:

'VBS.CarewMR.a By Jadraquer Killer (Mr.Carew)



Detection


F-Secure Anti-Virus detects this trojan with the current updates.



Technical Details:Katrin Tocheva and Sami Rautiainen; translation: Ero Carrera; F-Secure Corp.; October 22th, 2002


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More