|
Description:
This memory-resident worm propagates via email. It drops several copies of itself in the Windows and the Windows system folders. Some of the dropped files compressed using the WinZip application.
It also drops a valid .DLL file, OSSMTP.DLL, which it uses to send email messages.
The email message that it sends out has the following details:
From:
• <admin@newmovies.com>
• <fack_back06@mail.com>
• <gustes@msn.com>
• <hot_woman2362@freevideos.net>
• <King_sexy@hotmal.com>
• <linda200@gmail.com>
• <lost_love705@yahoo.com>
• <sandra@oxygen.com>
• <thomas_gay6@iopus.com>
• <user377@worldsex.com>
• Bad Love
• Binnn MT
• Genius
• Lola Ashton
• Ralph
• Sara GL
• spoofed_names
• Sweet Women
• The Moon
• Thomas
Subject/Message body: (any of the following)
• For all Members repit the reactive one time.
• Hello
• Important
• Please reactive now
• Please reactive now.
• Please Read
• reactive now
• Thank you
• Thanks
Attachment: (Refer to the dropped files in the Installation section.)
The email attachment may also arrive in ZIP format.
This worm attempts to termdelete registry entries and applications that are associated with security and antivirus products.
This worm uses a Real player file as its stealth mechanism, and runs on Windows 95, 98, NT, 2000, and XP.
For additional information about this threat, see:
Solution
Technical Details
Description created: Sep. 8, 2004 8:34:03 PM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
