Worm/Inmota.DLL - Worm

Siehe auch

Vollständig

Alias:	I-Worm.Ínmota, W32.Inmota.Worm
Type:	Worm
Size:	variable
Origin:
Date:	00-00-0000
Damage:	Sent by email.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThe worm counts the addresses in Microsoft Outlook or in Outlook Express and replies them with the attachment:
Default.html<222 blank spaces>.pif.

Technical DetailsWhen activated, Worm/Inmota.DLL copies itself as
default.html<222 blank spaces>.pif in %Systemdir% and %Windir% directories.

It creates the following files:
%WinDIR%\Rundl132.exe
%SystemDIR%\Rundl132.exe
%WinDIR%\Gate.dll
%SystemDIR%\Gate.dll

It makes the following autostart registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PowerProfile"="rundl132 kernel.dll,PowerProfileEnable

The following message is displayed:
"Welcome Microsoft CD Key web site
Press OK to open the Web"

It opens Internet Explorer and connects to a predefined website.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück