Carewmr

Threat description

Details

CATEGORYMalware
TYPETrojan

Summary

VBS/Carewmr is a trojan written with Visual Basic Script. Upon execution the trojan displays three messages.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

This a simple trojan that, when executed, will show following three messages:

	Welcome to CLRAV of Kaspersky Labs, press OK or Accept to Start 	scanning your computer.  	ERROR!, Code error:3212552, please execute this tool in MS-DOS.  	Thank You for prefer Kaspersky Labs Products  

At September 1st, it shows an additional message in Spanish:

	Mr.Carew vuelve otra vez!!, jaja  

which means in English

	Mr.Carew comes back again!!, jaja  

After these messsages, the trojan will open the web page https://www.avp.ru using the default browser.

Next, the trojan attemps to remove a number of registry keys, attempting to disable several security software:

	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SystemTray 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\AVPCC 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAVW32 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TrueVector 	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoneAlarm Pro  

The trojan also creates a number of directories and empty files to the root of the C: drive using for example names of different anti-virus products. It also attempts to delete all files from the C:\Windows directory.

Finally the trojan creates a text file to the current directory "CLRAV_Report.log" with the following content:

	Due an error, Code error:3212552, CLRAV has not disinfect your 	computer For Support please send a e-mail to support@kaspersky.com 	and please indicate the Code Error.  

The trojan has the following comment in the beginning:

'VBS.CarewMR.a By Jadraquer Killer (Mr.Carew)

Detection

F-Secure Anti-Virus detects this trojan with the current updates.

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info