|
|
|
VIRUS
NAME : W32/Enemany.b@MM
Virus
Characteristics
This threat is detected
as New Malware, New BackDoor, or New Worm with the 4150 DATs, or newer,
when running with program heuristics enabled. Avert has yet to receive
a field sample of this worm. The 4206 DATs will detect this as W32/Enemany.gen@MM.
This is a basic mass-mailing worm, written in Visual Basic. When run,
it emails itself to all addresses found in the Microsoft Outlook Address
book with the following message:
Subject: Edonkey Update
Body:
Hello Edonkey User,
this is the Update tool, to fix our Edonkey Client to 35.16.51
Attachment: Esel_Update.Exe
Symptoms
When run, the virus copies itself to the following files:
- c:\WINDOWS\Esel_Update.Exe
- c:\WINDOWS\SYSTEM\Edonkey.scr
A registry run key is
created to load the virus at startup.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\(Default)=C:\WINDOWS\Esel_Update.EXE
Method
Of Infection
This worm arrives as an email attachment. Manually executing this attachment
causes the worm to send itself to all users in the Microsoft Outlook Address
book using the MAPI protocol.
|
|
|
