Name : Winguard.exe
Path : C:\Winguard.exe
type : Internet
Alias : I-Worm.SouthPark,
level : Low
is dropped by South Park worm. It is an Internet
Microsoft Outlook and other different techniques
like copying "South Park.exe" to floppy
drives and Mapped drives to spread. The worm is
19,968 bytes long and written in Visual Basic. It
needs "MSVBVM50.dll" to spread
otherwise it will show dll missing error. The e-mail
attachment name will be "South Park.exe".
While opening the e-mail
attachment, the worm will copy "South park.exe"
to all mapped drives and it creates "winguard.exe",
and "s.bat" files in the C drive's root
directory. The dll files contain the date and
infection count information and the batch file
will contain routines to make the Floppy disk
bootable. The "winguard.exe" is stored
as a Hidden System file.
Then it changes the
so that the the "c:\winguard.exe" is
automatically executed when the system is
restarted. It creates a temporary file c:\v.reg
to modify registry information and then deletes
it. The registry modifcations are given below.
It opens the Microsoft
Outlook Address book and sends email to all the
email Ids stored. The message subject will be
"Servus Alter!", the message body will
be "Hier ist das Spiel, das du unbedingt
wolltest! ;-)" and the attachment name will be
"South Park.exe". The e-mail message is
written in German language.
In case of floppy drive,
the worm periodically checks "South Park.exe",
if not found it runs "s.bat" to make
the disk bootable and creates "Autoexec.bat".
The floppy disk "Autoexec.bat" contains
the following code
copy South Park.exe C:\WINDOWS\STARTM~1\PROGRAMS\STARTUP\South
Some times it failed to
put the entire path. In case of other Mapped
drives it checks for "South Park.exe"
periodically, if not found it copies to the root
The payload of
this worm is somewhat different. It creates
"Swapfile.vxd" in windows directory and
fills with garbage "D" upto the entire
hard disk. So the windows will show Hard disk
full alert message.
Our Technical team has
found that more attacking capablity is dormant in
this virus and it could activate in different
How can I protect my
Solo has incorporated Winguard.exe
signature file to protect users from this worm
attack. Solo antivirus registered users are
already protected from this worm. Make sure that
you have installed registered version of Solo
Antivirus to protect your system from all virus
to remove this worm?
you are already infected with Winguard.exe
can remove it from your computer using Solo
Antivirus software. Solo antivirus can
detect and remove W32.SouthPark@mm safely.
Use the following link to Download 30 day
trial version of Solo antivirus to
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts, Trojans,
Backdoors, boot sector, partition table and macro
purchase Solo antivirus using the link