The virus copies itself to the Windows directory as avserve2.exe and creates a registry run key to load itself at startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve2.exe" = C:\WINDOWS\avserve2.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068. It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.
A file named win2.log is created on the root of the C: drive. This file contains an IP address.
Copies of the worm are created in the Windows System directory as #_up.exe.
Examples
c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
-
Manual Removal Instructions To remove this virus "by hand", follow these steps:
Reboot the system into Safe Mode
(hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE2.EXE from your WINDOWS directory
(typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve2" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Reboot the system into Default Mode
Registry Removal Editing:
Windows98/ME/NT/2000/XP
1. Click the START button, then RUN
2. Type REGEDIT and hit ENTER
http://vil.nai.com/vil/SystemHelpDocs/images/Regedit1.gif
3. Click the + signs next to the desired folder to expand the folder tree branch
http://vil.nai.com/vil/SystemHelpDocs/images/Regedit4.gif
4. Once the desired folder path is visible, double-click on the value name on the right side of the screen (Default in this case)
http://vil.nai.com/vil/SystemHelpDocs/images/Regedit5.gif
5. Enter the desired value and click OK
6. Exit the Registry Editor by clicking on the X in the upper right corner of the Window
7. reboot into normal user mode
Don't format...
Remove it, update Windows and her AV application DAT files...
then scan that sucker...
and do it again...
