Virus: Worm/Arduk.G Date discovered: 15/07/2005 Type: Worm In the wild: Yes Reported Infections: Low Distribution Potential: Low to medium Damage Potential: Low to medium Static file: Yes File size: 13.312 Bytes MD5 checksum: 383a48fe9d8e8d8ba3240756d686c696 VDF version: 6.25.0.18
General Method of propagation: Aliases: Platforms / OS: Side effects: Files %SYSDIR% \%executed file% .exe%every *.htm file% .exe%every *.htm file% .exe With the following contents:%generated CLSID% "></OBJECT><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> Registry %executed file% .exe"%executed file% .exe] %executed file% .exe"%SYSDIR% \%executed file% .exe "%executed file% .exe\%executed file% .EXE\\0000"%executed file% .exe\%executed file% .EXE] %executed file% .EXE\0000] %executed file% .exe"%executed file% .exe"%executed file% .EXE\0000\Control] %executed file% .exe"%generated CLSID% }\LocalServer32] %malware execution directory% \\%executed file% .exe"%generated CLSID% }] %every *.htm file% .exe"%generated CLSID% }\LocalServer32] %malware execution directory% \\%every *.htm file% .exe" Email From: To: Subject: %three-digit random character string% Body: %three-digit random character string% %three-digit random character string% HERE!!Attachment: %three-digit random character string% Mailing Search addresses: Miscellaneous Mutex: Network shares:
Description inserted by Catalin Jora on Wednesday, August 3, 2005
Back
.
.
.
.
