I-Worm/SouthPark Scanner and Remover

South Park is a small Internet worm that will use Microsoft Outlook and other different techniques like copying "South Park.exe" to floppy disks and Mapped drives to spread.

The worm is 19,968 bytes long and written in Visual Basic. I-Worm/SouthPark needs "MSVBVM50.dll" to spread otherwise it will show dll missing error. The e-mail attachment name will be "South Park.exe".

While opening the e-mail attachment, the worm will copy "South park.exe" to all mapped drives and it creates "winguard.exe", "Windowsstart.dll", "Windowssystem.dll" and "s.bat" files in the C drive's root directory.

The dll files contain the date and infection count information and the batch file will contain routines to make the Floppy disk bootable. The "winguard.exe" is stored as a Hidden System file.

Then it changes the registry settings so that the the "c:winguard.exe" is automatically executed

￭ /SCAN - Scans the system for I-Worm/SouthPark Worm ￭ /REPAIR - Use this option to CLEAN the worm ￭ /SCAN - Scan all files ￭ /BAK - Create backup copy before cleaning ￭ /NOSUB - Sub Directories OFF ￭ /REPORT - Generates report - C:/VIRUSCAN.RPT ￭ /HELP - Detailed help to clean the I-Worm/SouthPark worm