Piggi.A, a variant of Piggi, is an email worm. Piggi.A mass mails itself and collects email addresses. Piggi.A kills processes belonging to antivirus and security software and has a rootkit functionality.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Upon execution, Piggi.A creates the following registry entries so as to start automatically with Windows:
It also drops a file named msfsr.sys in the Windows system directory and another random .sys file on C:\WINDOWS\system32\drivers\ and starts them as a service.
These are the registry keys for the services Piggi.A creates:
It will also copy itself to "C:\Program Files\Internet Explorer\iexplore.exe". The original iexplore.exe will be moved to the folder:
It also creates copies of itself to folders with the following strings:
The filename is any of the following:
The file name includes any of the following extensions:
Examples:
Piggi.A also stops running antivirus services with the following names:
Then copies itself to the following folders:
This is to ensure that these antivirus applications cannot perform an automatic update.
This malware hides its own process and files using two kernel-mode drivers.
These are:
The worm collects email addresses from the infected computer. It locates the WAB (Windows Address Book) file and Temporary Internet files. The following are the details:
The worm sends itself as attachment to the gathered email addresses using the following format:
The From field may use any of these addresses:
The filenames of the attachment may contain any of these strings:
This malware uses a pool of strings to search and combine to create the body of the email. The following are some of the strings that can be found in the email's body:
Below are examples of the the possible string combinations that can be found in the body of the email:
Piggi.A also continues queries to the site mi5.gov.uk.
This malware comes packed with Yoda Protector 1.03.3