VIRUS NAME : W32/Enemany.b@MM
Virus Characteristics
This threat is detected as New Malware, New BackDoor, or New Worm with the 4150 DATs, or newer, when running with program heuristics enabled. Avert has yet to receive a field sample of this worm. The 4206 DATs will detect this as W32/Enemany.gen@MM.
This is a basic mass-mailing worm, written in Visual Basic. When run, it emails itself to all addresses found in the Microsoft Outlook Address book with the following message:
Subject: Edonkey Update
Body:
RHello Edonkey User,
this is the Update tool, to fix our Edonkey Client to 35.16.51
Attachment: Esel_Update.Exe
Symptoms
When run, the virus copies itself to the following files:
c:\WINDOWS\Esel_Update.Exe
c:\WINDOWS\SYSTEM\Edonkey.scr
A registry run key is created to load the virus at startup.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\(Default)=C:\WINDOWS\Esel_Update.EXE
Method Of Infection
This worm arrives as an email attachment. Manually executing this attachment causes the worm to send itself to all users in the Microsoft Outlook Address book using the MAPI protocol.
|
