Alias:I-Worm.Inmota, W32.Inmota.Worm
Type:Worm 
Size: 
Origin: 
Date:00-00-0000 
Damage:Sent by email. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe worm counts the addresses in Microsoft Outlook or in Outlook Express and replies them with the attachment:
Default.html<222 blank spaces>.pif.

Technical DetailsWhen activated, Worm/Inmota.DLL copies itself as
default.html<222 blank spaces>.pif in %Systemdir% and %Windir% directories.

It creates the following files:
%WinDIR%\Rundl132.exe
%SystemDIR%\Rundl132.exe
%WinDIR%\Gate.dll
%SystemDIR%\Gate.dll

It makes the following autostart registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PowerProfile"="rundl132 kernel.dll,PowerProfileEnable

The following message is displayed:
"Welcome Microsoft CD Key web site
Press OK to open the Web"

It opens Internet Explorer and connects to a predefined website.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .