..
Click anywhere to stop
Click anywhere to stop
Class | Email-Worm |
Platform | Win32 |
Description |
Technical Details
This is a worm virus spreading via the Internet being attached to infected emails. The worm Main file: "iLLeGaL.exe", about 81K of size Spreading component: "Mplayer.exe", about 14K (compressed by UPX, decompressed - 37K) SMTP control: "SMTP.ocx", about 26K (compressed by UPX, decompressed - 90K) InstallingWhen the main worm file is run it installs itself and its components to the system. While HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices iLLeGaL = %SystemDir%Mplayer.exe The worm then displays a fake Flash animation and the message: Sorry ! Looooooooool , thanx fo da time u spent thinkin ov me SpreadingThe worm reads victim emails from the MS Outlook address book and searches for email addresses in The infected messages have: Subject: Fwd: Crazy illegal sex ! Body: is randomly selected from a file on C: drive Attach: "iLLeGal.exe" or "illegalSex.zip"
PayloadThe worm creates new key (counter) in system registry: HKLMiLLeGal
This counter is being increased on each worm start. When the counter reaches ‘5’ the worm ZaCker No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r |
Find out the statistics of the threats spreading in your region |