Email Propagation
To propagate, it sends itself as email attachment to all contacts listed in the Microsoft Outlook address book. It uses any of the following email messages:
Subject: You have a ecard!
Message Body: You have recieved a E-Card! Check your attatchments!
Attachment: attachment.exe
Subject: Technical Support - File you Requested.
Message: Hey, Here is the Attachment you Requested. Please Respond Back. Thanks Technical Support.
Attachment: attachment.exe
Payloads
The worm attempts to delete the following files:
C:\Program Files\Yahoo!\Messenger\*.exe
C:\Windows\*.ini
C:\Windows\System\*.scr
Other Details
This worm is written and compiled in Visual Basic.
Reply With Quote