Home Education E-BooksTravel Troubleshooting Linux Contact Us About Us
Troubleshooting Tips And Steps
Windows & Hardware Tips
Information On Viruses
Miscellaneous

virus file

VIRUS NAME: W32/Porkis@MM

VIRUS NAME: W32/Porkis@MM

Internet Worm Characteristics

This mass-mailing worm contains its own SMTP engine, and is designed to use the system default SMTP server for spreading itself to addresses found in the Windows Address Book. The worm failed to mail itself when executed on English/US operating systems. If successfully mailed, strings within the worm reveal the message details to be as follows:

Subject:

'Divertimento assicurato' or, 'Leggete urgentemente questa e-mail (se avete tempo da perdere)' or, 'Storielle'
From: <>

Attachment: 49,664 byte executable (not packed), named:

PORKIS.EXE or,
PIPPO.EXE or,
BAR.EXE
Once executed on the victim machine, the worm displays a series of message boxes (in Italian, progressing through a dialogue).
The worm copies itself to the Windows directory as DLLMGR.EXE. It also adds a Registry key to run this copy of the itself at subsequent system startups:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\_
Run "Dll Manager" = C:\WINDOWS\DLLMGR.EXE

Upon restarting, after a small time delay, the worm attempts to connect to the system default SMTP server (retrieved from the Registry), and mail itself to all entries in the Windows Address Book (the location of which is also retrieved from the Registry). As noted above, in testing on English/US operating systems, the worm did connect to the SMTP server, but failed to mail itself successfully.

Symptoms

Existence of the following file:

C:\WINDOWS\DLLMGR.EXE (49,664 bytes in length).

Method Of Infection

The worm infects the victim machine upon its execution, by copying itself to the Windows directory, and hooking the Registry to run at system startup. The worm attempts to mail itself to entries found in the Windows Address Book.

If you are fed up with any virus and not getting solution of it. mail us on amgroup@skillsheaven.com and please provide all the detail about virus.