VIRUS
NAME : W32/Enemany.a.intd
Virus
Characteristics
This threat is detected
as New Malware, New BackDoor, or New Worm with the 4150 DATs, or newer,
when running with program heuristics enabled. Avert has yet to receive
a field sample of this worm. The 4206 DATs will detect this as W32/Enemany.gen@MM.
This is an intended mass-mailing worm. However, due to a typo in the code,
messages sent by this worm do not contain the intended attachment. When
run, a message box is displayed.
All addresses found
in the Microsoft Outlook Address book are sent a message with the following
information:
Subject: The New Xerox Update for our WinXP
Body:
Dear, Microsoft WinXP User, here are the last Update from Xerox Security
System, please install this file and going to www.microsoft.com and finished
this Update too.
The worm fails to function properly as the program attempts to attach
the file, Xerox-Update.Exe.exe. However, this file is not created by the
worm.
Symptoms
The virus copies itself to the following locations:
- c:\WINDOWS\SYSTEM\Ati.scr
- c:\WINDOWS\Xerox-Update.Exe
- c:\WINDOWS\Start
Menu\Programs\StartUp\WinUpdate.exe
Method
Of Infection
N/A This is an intended virus that does not propagate as intended.
|
