VIRUS NAME: W32/Porkis@MM
|VIRUS NAME: W32/Porkis@MM
Internet Worm Characteristics
This mass-mailing worm contains its own SMTP engine, and is designed to use the system default SMTP server for spreading itself to addresses found in the Windows Address Book. The worm failed to mail itself when executed on English/US operating systems. If successfully mailed, strings within the worm reveal the message details to be as follows:
'Divertimento assicurato' or,
'Leggete urgentemente questa e-mail (se avete tempo da perdere)' or,
Attachment: 49,664 byte executable (not packed), named:
Once executed on the victim machine, the worm displays a series of message boxes (in Italian, progressing through a dialogue).
The worm copies itself to the Windows directory as DLLMGR.EXE. It also adds a Registry key to run this copy of the itself at subsequent system startups:
Run "Dll Manager" = C:\WINDOWS\DLLMGR.EXE
Upon restarting, after a small time delay, the worm attempts to connect to the system default SMTP server (retrieved from the Registry), and mail itself to all entries in the Windows Address Book (the location of which is also retrieved from the Registry). As noted above, in testing on English/US operating systems, the worm did connect to the SMTP server, but failed to mail itself successfully.
Existence of the following file:
C:\WINDOWS\DLLMGR.EXE (49,664 bytes in length).
Method Of Infection
The worm infects the victim machine upon its execution, by copying itself to the Windows directory, and hooking the Registry to run at system startup. The worm attempts to mail itself to entries found in the Windows Address Book.
If you are fed up with any virus and not getting solution of it. mail us on firstname.lastname@example.org and please provide all the detail about virus.