Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Worm/Calil spreads by email.
It sends itself to all email addresses in WAB (Windows Address Book) using Outlook. The email looks like this:
Subject: FW:FW: LILAC project video attach
Body: Things that the govt. dont want you
It is possible that the attachment may have 0 Bytes or it may be completely forgotten. This happens because of a worm programming error.
Worm/Calil is an 12208 Bytes (30720Bytes unpacked)Internet worm, written in Visual Basic language.
When activated, the worm sends itself using Outlook to all email addresses in WAB.
When the email attachment is opened, a window is displayed, while the worm copies itself as "Lilac_What_a_wonderfulname.avi.exe" in one of the directories:
Then, the worm changes the following registry key:
-[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] RegisteredOwner=xEnOcrAtEsLegalNoticeCaption=Owned by:LegalNoticeText=Owned by: xEnOcrAtEs
and makes the following entry:
If the worm is not correctly activated, the following non-virulent messages appear in Autoexec.bat:
echo MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!
echo HAPPY HALLOWEEN !!!
echo HAPPY VALENTINES DAY !!!
echo HAPPY LABOR DAY !!!
echo BONIFACIO DAY !!!
echo RIZAL DAY !!!
echo HAPPY INDEPENDENCE DAY !!!
echo HOLY WEEK !!!
echo from: OPEY A . pause
Description inserted by Crony Walker on Tuesday, June 15, 2004