Threat Database Worms WORM_STECKCT.EVL

WORM_STECKCT.EVL

By GoldSparrow in Worms

Like most worms, the WORM_STECKCT.EVL worm has the capacity to spread on its own from one machine to another. WORM_STECKCT.EVL in particular has been known to use social networks (like Facebook) and instant messaging programs in order to send copies of itself to other computer users. WORM_STECKCT.EVL is considered a severe threat to a computer's integrity, especially because WORM_STECKCT.EVL can disable the most popular anti-malware programs. However, unlike other malware infections, WORM_STECKCT.EVL does not limit itself to stopping the targeted program's file process, but it goes as far as to delete essential files that help these applications carry out their tasks. Like most worms, WORM_STECKCT.EVL is not only an infection to your computer system but to all computer systems that could have contacted an infected machine direct or indirectly.

The main purposes of WORM_STECKCT.EVL are to install a second worm (WORM_EBOOM.AC) on the victim's computer system, spreading through social networks and instant messaging applications, and creating a backdoor into the infected computer system. Using this backdoor, which is little more than a hole in the infected computer' security protection, WORM_STECKCT.EVL allows criminals to gain access to the infected computer from remote locations. To deal with WORM_STECKCT.EVL, ESG security analysts recommend either disabling WORM_STECKCT.EVL by starting up from an external memory device and then reinstalling your anti-malware program of choice, or using a less popular security program that is not targeted by WORM_STECKCT.EVL.

WORM_STECKCT.EVL Can Delete Files Associated with Anti-Virus Programs

While WORM_STECKCT.EVL behaves like most worms in the way it can propagate through networks and via removable drives, this malware infection has caught the attention of PC security researchers because of its devastating nature when it comes to stopping legitimate security programs on the victim's computer system. Not only will WORM_STECKCT.EVL stop the targeted program's file process, it will also delete that program's files from the infected computer system, making it necessary for the victim to re-install their security software in order to deal with a WORM_STECKCT.EVL Worm infection. Fortunately, WORM_STECKCT.EVL does not target all existing anti-virus programs. It searches for the following files and deletes them if found (each one of these is associated with a major brand of security software): AntiVirService, avgnt.exe, AviraUpgradeService, MsMpSvc, msseces.exe, avp.exe, MSASCui.exe, sMpEng.exe, egui.exe, ekrn.exe, kavsvc.exe, WinDefend, wuauserv, YahooAUService and YahooAUService.exe.

File System Details

WORM_STECKCT.EVL may create the following file(s):
# File Name Detections
1. %Windows%\iqs.exe

Registry Details

WORM_STECKCT.EVL may create the following registry entry or registry entries:
List %Windows%\iqs.exe = "%Windows%\iqs.exe:*:Enabled:MSN Messenger"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Firevall Engine = "%Windows%\iqs.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Firevall Engine = "%Windows%\iqs.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Firevall Engine = "%Windows%\iqs.exe"
List %Windows%\iqs.exe = "%Windows%\iqs.exe:*:Enabled:Microsoft Firevall Engine"

Trending

Most Viewed

Loading...