Threat description


Category: Malware
Type: Trojan
Platform: VBS


VBS/Carewmr is a trojan written with Visual Basic Script. Upon execution the trojan displays three messages.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

This a simple trojan that, when executed, will show following three messages:

	Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start 	scanning your computer.  	ERROR!, Code error:3212552, please execute this tool in MS-DOS.  	Thank You for prefer Kaspersky Labs Products  

At September 1st, it shows an additional message in Spanish:

	Mr.Carew vuelve otra vez!!, jaja  

which means in English

	Mr.Carew comes back again!!, jaja  

After these messsages, the trojan will open the web page using the default browser.

Next, the trojan attemps to remove a number of registry keys, attempting to disable several security software:

	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SystemTray 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\AVPCC 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAVW32 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TrueVector 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoneAlarm Pro  

The trojan also creates a number of directories and empty files to the root of the C: drive using for example names of different anti-virus products. It also attempts to delete all files from the C:\Windows directory.

Finally the trojan creates a text file to the current directory "CLRAV_Report.log" with the following content:

	Due an error, Code error:3212552, CLRAV has not disinfect your 	computer For Support please send a e-mail to 	and please indicate the Code Error.  

The trojan has the following comment in the beginning:

'VBS.CarewMR.a By Jadraquer Killer (Mr.Carew)


F-Secure Anti-Virus detects this trojan with the current updates.

Technical Details: Katrin Tocheva and Sami Rautiainen; translation: Ero Carrera; F-Secure Corp.; October 22th, 2002


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More