This is Internet worm spreading with emails by affecting Eudora email client.
The infected message arrives with the text “Help us go back to home!” at the end of the message body and attached DOS COM file “www.back2afrika.com” (the virus tries to cheat an user by disguising its .COM extension with URL-like name).
If user activates the attached COM file, the worm gets control, creates EXE file with random name in temporary directory, and runs it. That EXE file is PE EXE file and contains main worm routine which registers worm text and
The worm code contains the text strings:
Last string is “And Vecna is his prophet” written backwards.
The known worm version has a bug and can’t spread.
|Find out the statistics of the threats spreading in your region|