The most award-winning anti-spyware software

Get serious about removing spyware with Spy Sweeper - the award-winning anti-spyware software trusted by millions of home computer users.

$29.95

Spyware & Virus Directory

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

W32.Darker.Worm

Risk Level 1: Very Low

Discovered: November 4, 2003

Updated: November 5, 2003 10:24:09 AM PST

Also Known As: Worm.P2P.Darker.b [Kaspersky]

Type: Worm

Infection Length: 37,376 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

SUMMARY

W32.Darker.Worm is a worm that attempts to spread through file-sharing networks and can contact an IRC server, waiting for commands from a hacker.

The worm can also spread via email if it receives a specific command from a hacker.

The email has the following characteristics:

Subject: Microsoft Windows OutLook Express urgent updates
Attachment: SVCHOST.EXE

W32.Darker.Worm is written in Borland Delphi and is packed with UPX.

Protection

Virus Definitions (LiveUpdate™ Weekly) November 5, 2003
Virus Definitions (Intelligent Updater) November 5, 2003

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Moderate

Damage

Damage Level: Medium
Payload: Allows unauthorized remote access to an infected computer.
Large Scale E-mailing: N/A
Deletes Files: N/A
Modifies Files: N/A
Releases Confidential Info: N/A
Degrades Performance: N/A
Causes System Instability: N/A
Compromises Security Settings: Attempts to terminate various processes, including those associated with security related programs.

Distribution

Distribution Level: Medium
Subject of Email: Microsoft Windows OutLook Express urgent updates
Name of Attachment: SVCHOST.EXE
Size of Attachment: 37,376 bytes
Ports: TCP 6667
Shared Drives: Attempts to spread itself through the KaZaA, Morpheus, Grogster file-sharing networks.
Target of Infection: N/A
Time Stamp of Attachment: N/A

TECHNICAL DETAILS

When W32.Darker.Worm is executed, it does the following:

Copies itself to the %Windir% folder as SVCHOST.EXE.
Adds the value:

"Service Process"="%Windir%SVCHOST.EXE"
to the registry key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Attempts to spread through the KaZaA, Morpheus, and Grogster file-sharing networks by coping itself as the following file names:
- C:Program FilesMorpheusMy Shared FolderAdobe_crack_.exe
- C:Program FilesMorpheusMy Shared Folderlive_fuck_tv(v2).exe
- C:Program FilesMorpheusMy Shared FolderTeen sex Having her breasts fucked and blowjob.exe
- C:Program FilesMorpheusMy Shared FolderXP crack setup.exe
- C:Program FilesMorpheusMy Shared FolderXmusic Ultimate porn , games , movies Search engine.exe
- C:Program FilesMorpheusMy Shared FolderPorn_Search_engine.exe
- C:Program FilesMorpheusMy Shared Foldercrack_database(1000scracks).exe
- C:Program FilesMorpheusMy Shared FolderMp3_Mixer(v3).exe
- C:Program FilesMorpheusMy Shared FolderJay z - crazy in love.mov.exe
- C:Program FilesMorpheusMy Shared FolderPasswordCracker.exe
- C:Program FilesMorpheusMy Shared FolderSlimShady Game.exe
- C:Program FilesMorpheusMy Shared FolderDmx - Who the let the dogs out(funny).exe
- C:Program FilesMorpheusMy Shared FolderHotMail_password_hack(NEW!!!).exe
- C:Program FilesMorpheusMy Shared FolderPornWebsite_Pass_crack_v1.23beta.exe
- C:Program FilesMorpheusMy Shared FolderMsn_instant_messager_pass_crack.exe
- C:Program FilesMorpheusMy Shared FolderPassword_cracker(doesnt_work_on_nt).exe
- C:Program FilesKaZaAMy Shared FolderHotMail_password_hacker.exe
- C:Program FilesKaZaAMy Shared FolderCrackdatabase(1000scracks).exe
- C:Program FilesKaZaAMy Shared FolderPorn_Search_engine.exe
- C:Program FilesKaZaAMy Shared FolderAdobe_crack_.exe
- C:Program FilesKaZaAMy Shared FolderTit_test(Porn_game).exe
- C:Program FilesKaZaAMy Shared FolderKill backstreet boys(Eminem game).exe
- C:Program FilesKaZaAMy Shared FolderJenna jameson Tit Fuck Sex Ultimate porn movie.mpeg.exe
- C:Program FilesKaZaAMy Shared FolderMp3_Mixer.exe
- C:Program FilesKaZaAMy Shared FolderPassWordCracker.exe
- C:Program FilesKaZaAMy Shared FolderHotmail_Hacker.exe
- C:Program FilesKaZaAMy Shared FolderDjSoftware.exe
- C:Program FilesKaZaAMy Shared FolderHot Pink Pussy Very tight chick fucking her boyfriend on the bed. Great sex clip.exe
- C:Program FilesKaZaAMy Shared FolderWindows Xp Crack.exe
- C:Program FilesKaZaAMy Shared FolderTeen fucking hard.avi.exe
- C:Program FilesKaZaAMy Shared FolderMp3Mixer(good).exe
- C:Program FilesKaZaAMy Shared FolderPornWebsite_Pass_crack_v1.23beta.exe
- C:Program FilesKaZaAMy Shared FolderMsn_instant_messager_pass_crack.exe
- C:Program FilesKaZaAMy Shared FolderPassword_cracker(doesnt_work_on_nt).exe
- C:Program FilesGroksterMy GroksterHotMail_password_hacker(NEW!!!).exe
- C:Program FilesGroksterMy GroksterPorn_search_engine(2003edition).exe
- C:Program FilesGroksterMy GroksterCrack_hack_database(1000sCracksHacks).exe
- C:Program FilesGroksterMy GroksterAdobe_crack_.exe
- C:Program FilesGroksterMy GroksterHalf_life_walk_through_walls_proxy.exe
- C:Program FilesGroksterMy GroksterMp3_Mixer_.exe
- C:Program FilesGroksterMy GroksterHalfLife.exe
- C:Program FilesGroksterMy GroksterWindows Xp crack.exe
- C:Program FilesGroksterMy GroksterPornWebsite_Pass_crack_v1.23beta.exe
- C:Program FilesGroksterMy GroksterMsn_instant_messager_pass_crack.exe
- C:Program FilesGroksterMy GroksterPassword_cracker(doesnt_work_on_nt).exe
- C:Program FilesKaZaA LiteMy Shared FolderHotMail_password_hacker(NEW!!!).exe
- C:Program FilesKaZaA LiteMy Shared FolderCrackdatabase(1000scracks).exe
- C:Program FilesKaZaA LiteMy Shared FolderPorn_Search_engine.exe
- C:Program FilesKaZaA LiteMy Shared FolderAdobe_crack_.exe
- C:Program FilesKaZaA LiteMy Shared FolderJenna jameson Tit Fuck Sex Ultimate porn movie.mpeg.exe
- C:Program FilesKaZaA LiteMy Shared FolderMp3_Mixer.exe
- C:Program FilesKaZaA LiteMy Shared Folderdr dre & nwa - fuck the police.mp3.exe
- C:Program FilesKaZaA LiteMy Shared Folderritney spears tit game (funny as hell).exe
- C:Program FilesKaZaA LiteMy Shared FolderWindows Xp Crack.exe
- C:Program FilesKaZaA LiteMy Shared FolderAsian-porn-finder.exe
- C:Program FilesKaZaA LiteMy Shared FolderPassWordCracker.exe
- C:Program FilesKaZaA LiteMy Shared FolderHotmail_Hacker.exe
- C:Program FilesKaZaA LiteMy Shared FolderXscan setup(Windows Hacker).exe
- C:Program FilesKaZaA LiteMy Shared FolderDjSoftware.exe
- C:Program FilesKaZaA LiteMy Shared FolderHalfLife Counter strike Auto Aim-v4.3.exe
- C:Program FilesKaZaA LiteMy Shared FolderMp3Mixer(good).exe
- C:Program FilesKaZaA LiteMy Shared FolderGreat Sex Movie Viewier NO Credit Cards (LESBIAN , HARDCORE , TEENSEX , FUCK ,BLOWJOB).exe
- C:Program FilesKaZaA LiteMy Shared FolderPornWebsite_Pass_crack_v1.23beta.exe
- C:Program FilesKaZaA LiteMy Shared FolderMsn_instant_messager_pass_crack.exe
- C:Program FilesKaZaA LiteMy Shared FolderPassword_cracker(doesnt_work_on_nt).exe
Attempts to contact a predetermined IRC server and waits for commands from a hacker. The commands include, but are not limited to, the following:
- Downloading and executing files on the remote machine
- Sending system information back to a hacker
- Logging keystrokes
- Terminating antivirus software
- Sending itself through email
The hacker can terminate any processes that have these names:
- ACKWIN32.EXE
- ADVXDWIN.EXE
- AGENTSVR.EXE
- AHNSD.EXE
- ALERTSVC.EXE
- ALOGSERV.EXE
- AMON9X.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATUPDATER.EXE
- ATWATCH.EXE
- AUPDATE.EXE
- AUTODOWN.EXE
- AUTODOWN.exe
- AUTOTRACE.EXE
- AUTOUPDATE.EXE
- AVCONSOL.EXE
- AVGCC32.EXE
- AVGCTRL.EXE
- AVGSERV.EXE
- AVGSERV9.EXE
- AVGW.EXE
- AVKPOP.EXE
- AVKSERV.EXE
- AVKSERVICE.EXE
- AVKWCL9.EXE
- AVKWCTL9.EXE
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
- AVPEXEC.EXE
- AVPINST.EXE
- AVPM.EXE
- AVPUPD.EXE
- AVRESCUE.EXE
- AVSYNMGR.EXE
- AVSYNMGR.exe
- AVWINNT.EXE
- AVXMONITOR9X.EXE
- AVXMONITORNT.EXE
- AVXQUAR.EXE
- AVXQUAR.EXE.EXE
- AVXW.EXE
- AckWin32.exe
- Alerter
- AutoDown.exe
- AutoTrace.exe
- AvSynMgr
- AvgServ
- Avgctrl.exe
- AvkServ.exe
- Avsched32.exe
- BD_PROFESSIONAL.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- BORG2.EXE
- BS120.EXE
- BlackICE.exe
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- CFIAUDIT.EXE
- CFINET.EXE
- CFINET32.EXE
- CLAW95.EXE
- CLAW95CF.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CONNECTIONMONITOR.EXE
- CPD.EXE
- CPDCLNT.EXE
- CPDClnt.exe
- CPF9X206.EXE
- CPFNT206.EXE
- CSINJECT.EXE
- CSINSM32
- CSS1631.EXE
- CTRL.EXE
- CV.EXE
- CWNB181.EXE
- CWNTDWMO.EXE
- Claw95.exe
- Claw95cf.exe
- DEFSCANGUI.EXE
- DEFWATCH.EXE
- DEPUTY.EXE
- DOORS.EXE
- DPF.EXE
- DRWATSON.EXE
- DRWEB32.EXE
- DVP95.EXE
- DVP95_0.EXE
- EFPEADM.EXE
- EFPEADM.exe
- ENT.EXE
- ESCANH95.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- ETRUSTCIPE.EXE
- ETRUSTCIPE.exe
- EVPN.EXE
- EVPN.exe
- EXANTIVIRUS-CNET.EXE
- EXPERT.EXE
- F-AGNT95.EXE
- F-PROT.EXE
- F-PROT95.EXE
- F-STOPW.EXE
- FAMEH32.EXE
- FAST.EXE
- FCH32.EXE
- FIH32.EXE
- FIREWALL.EXE
- FIX-IT.EXE
- FLOWPROTECTOR.EXE
- FNRB32.EXE
- FP-WIN.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAA.EXE
- FSAV.EXE
- FSAV32.EXE
- FSAV530STBYB.EXE
- FSAV530WTBYB.EXE
- FSAV95.EXE
- FSAVE32.EXE
- FSGK32.EXE
- FSM32.EXE
- FSMA32.EXE
- FSMB32.EXE
- FWENC.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GENERICS.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- IAMSTATS.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- IFACE.EXE
- IFW2000.EXE
- IOMON98.EXE
- IPARMOR.EXE
- IRIS.EXE
- ISRV95.EXE
- JAMMER.EXE
- JEDI.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDNETMON.EXE
- LDPRO.EXE
- LDPROMENU.EXE
- LDSCAN.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- LUALL.EXE
- LUAU.EXE
- LUCOMSERVER.EXE
- LUINIT.EXE
- LUSPT.exe
- MCAGENT.EXE
- MCMNHDLR.EXE
- MCSHIELD.EXE
- MCTOOL.EXE
- MCUPDATE.EXE
- MCVSRTE.EXE
- MCVSSHLD.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGAVRTCL.EXE
- MGAVRTE.EXE
- MGHTML.EXE
- MGUI.EXE
- MINILOG.EXE
- MONITOR.EXE
- MONSYS32.EXE
- MONSYSNT.EXE
- MONWOW.EXE
- MOOLIVE.EXE
- MPFAGENT.EXE
- MPFSERVICE.exe
- MPFTRAY.EXE
- MRFLUX.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- MWATCH.EXE
- MWATCH.exe
- MXTASK.EXE
- Mcshield.exe
- Monitor.exe
- NAVAuto-Protect
- NAV80TRY.EXE
- NAVAP
- NAVAPSVC.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVENG
- NAVENGNAVEX15
- NAVEX15
- NAVLU32.EXE
- NAVRUNR.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NAVWNT.EXE
- NC2000.EXE
- NCINST4.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NEOWATCHLOG.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NETUTILS.EXE
- NISSERV.EXE
- NISUM.EXE
- NMAIN.EXE
- NORMIST.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NPSSVC.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NTXCONFIG.EXE
- NTXconfig.exe
- NUI.EXE
- NVARCH16.EXE
- NVC95.EXE
- NVLAUNCH.EXE
- NVSVC32
- NWINST4.EXE
- NWSERVICE.EXE
- NWService.exe
- NWTOOL16.EXE
- Navw32.exe
- NeoWatchLog.exe
- Nui.EXE
- Nupgrade.exe
- OFFGUARD.EXE
- OSTRONET.EXE
- OUTPOST.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- PAVPROXY.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCCLIENT.EXE
- PCCGUIDE.EXE
- PCCIOMON.EXE
- PCCNTMON.EXE
- PCCPFW
- PCCWIN97.EXE
- PCCWIN98.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PCSCAN.EXEPDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PERSWF.EXE
- PF2.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- POP3TRAP.EXE
- POPROXY.EXE
- POPSCAN.EXE
- PORTDETECTIVE.EXE
- PORTMONITOR.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCESSMONITOR.EXE
- PROCEXPLORERV1.0.EXE
- PROGRAMAUDITOR.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- PURGE.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV7.EXE
- RAV7WIN.EXE
- RAV8WIN32ENG.EXE
- REALMON.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- Rescue.exe
- SAFEWEB.EXE
- SBSERV.EXE
- SCAN32.EXE
- SCHEDAPP.EXE
- SCRSCAN.EXE
- SD.EXE
- SETUPVAMEEVAL.EXE
- SETUP_FLOWPROTECTOR_US.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SRWATCH.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- SUPPORTER5.EXE
- SWEEP95.EXE
- SWEEPSRV.SYS
- SWNETSUP.EXE
- SYMPROXYSVC.EXE
- SYMTRAY.EXE
- SYSDOC32.EXE
- SYSEDIT.EXE
- Sphinx.exe
- SweepNet
- SymProxySvc.exe
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS-3.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TFAK.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- TRJSCAN.EXE
- TRJSETUP.EXE
- TROJANTRAP3.EXE
- Tmntsrv
- UNDOBOOT.EXE
- UPDATE.EXE
- Uh`S@d
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCCMSERV.EXE
- VCSETUP.EXE
- VET32.EXE
- VET32.exe
- VET95.EXE
- VETTRAY.EXE
- VFSETUP.EXE
- VIR-HELP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC32.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- VSCENU6.02D30.EXE
- VSCHED.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- VVSTAT.EXE
- VbCons.exe
- Vet95.exe
- VetTray.exe
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- WEBTRAP.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- WIMMUN32.EXE
- WINRECON.EXE
- WINROUTE
- WINSFCM.EXE
- WNT.EXE
- WRADMIN.EXE
- WRCTRL.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- WrAdmin.exe
- WrCtrl.exe
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- ZAUINST.EXE
- ZONALM2601.EXE
- ZONEALARM.EXE
- _AVP32.EXE
- _AVPCC.EXE
- _AVPM.EXE
- agentw.exe
- alogserv.exe
- apvxdwin.exe
- avkpop.exe
- avkservice.exe
- avkwctl9.exe
- avpm.exe
- blackd.exe
- ccApp.exe
- ccEvtMgr.exe
- ccPxySvc.exe
- cfgWiz.exe
- cleaner.EXE
- cleaner3.EXE
- cpd.exe
- defalert.exe
- defscangui.exe
- f-stopw.exe
- fameh32.exe
- fch32.exe
- fih32.exe
- fnrb32.exe
- fsaa.exe
- fsav32.exe
- fsgk32.exe
- fsm32.exe
- fsma32.exe
- fsmb32.exe
- gbmenu.exe
- gbpoll.exe
- iamapp.exe
- iamserv.exe
- lockdown2000.exe
- navapsvc
- navapsvc.exe
- netstat.exe
- notstart.exe
- npscheck.exe
- ntrtscan.EXE
- nvapsvc
- pathping.exe
- pavproxy.exe
- pccntmon.EXE
- pccwin97.EXE
- pcscan.EXE
- ping.exe
- rapapp.exe
- route.exe
- routemon.exe
- sbserv.exe
- sharedaccess
- tracerpt.exe
- tracert.exe
- vbcmserv.exe
- vsmon.exe
- zapro.exe
- zonealarm.exe
A hacker can also use MAPI to email itself to all the contacts in the Windows address book. The email has the following characteristics:

Subject: Microsoft Windows OutLook Express urgent updates
Body: There is a new virus spreading called Win32.darkirc virus. This email was sent to you as a precaution as ur version of OutLook Express has not been updated. Patch available attached to the email
Attachment: Svchost.exe

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Reverse the changes made to the registry.
Run a full system scan and delete all the files detected as W32.Darker.Worm.

For details on each of these steps, read the following instructions.

1. Disabling System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

2. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

3. Reversing the changes made to the registry

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
In the right pane, delete the value:

"ServiceProcess"="%Windir%svchost.exe"
Exit the Registry Editor.
Restart the computer.

4. Scanning for and deleting the infected files

Start your Symantec antivirus program and make sure that it is configured to scan all the files.
- For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
- For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
Run a full system scan.
If any files are detected as infected with W32.Darker.Worm, click Delete.

Spy Sweeper 5.2 stops spyware in its tracks while offering home computer users the ability to configure the program to suit their specific needs, such as:

Choose a Quick, Full or Custom Sweep: With Spy Sweeper 5.2, you can easily choose to perform a quick, full or customized sweep. If you're looking for an immediate diagnosis, choose a quick sweep. For a pinpointed search, customize your sweep to have Spy Sweeper skip files by folder or file extension. For a deep cleaning, opt for a full sweep.

Exclude Files from a Sweep: Spy Sweeper allows you to save time during a sweep by skipping specific files or different sections of your PC. You can select specific file extension, such as .xls or .mpg to exclude.

Additional Highlights

As soon as it's installed, Spy Sweeper gives 360 degrees of protection against spyware, including:

Simple Sweeps: Detecting spyware and removing unwanted programs found on your computer in three effortless steps

Easy Management: Quickly and simply configure program, sweep and upgrade options

Fast Home: Use the home screen to access the most commonly used functions of Spy Sweeper

Shields Summary: A redesigned shields summary page makes it simple to see at a glance which shields are on or off

Action Alerts: Receive clear, easy-to-understand notifications when new spyware threats are detected

"Spy Sweeper remains a favorite for protection from spyware."

"This program's dominance is apparent as soon as you install it."