Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email.
The email sent by Worm/Nedal contains:
Subject: Osama Bin Laden Comes Back!
Body: Hello People,
You have received Email from Osama Bin Laden.
Allah is The One Of God. No god in the World Accept Allah!
All people in the world love peace and no wars. America and Israel must be destroy to prevent from wars.
Osama Bin Laden
Attachment: The email has no attachment. The virus code is inserted as HTML text, used for showing the message.
Worm/Nedal is an Internet Worm, spread by email.
When the email is opened, the virus code is activated using ActiveX. Some computer systems show a Windows message to ask if ActiveX should be run. If the user answers YES, the worm is activated. Worm/Nedal creates the file OsamaLaden.vbs and copies it in:
Another worm copy is made in C:\Windows\, as 'OsamaBinLaden.vbs'.
A DOS window is displayed.
Worm/Nedal creates the following files:
-'Laden.EXE' in C:\Windows\ (4.608 Bytes). The Trojan component, which displays a window on every September, 11.
-'Osama.EXE' in C:\Windows\ (17.174 Bytes). It infects .exe files and affects their original contents.
-'Alta.EXE' (5.120 Bytes). It is a Windows Trojan. It displays the text: "Prepare to sleep..." and then shuts the system down.
-'Laden.BAT' in C:\ (103 Bytes). This file deletes the contents of Windows System directory. Then, the system is shut down.
The worm makes the following registry entries:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "OsamaBinLaden"="wscript.exe c:\\%WinDIR%\\%SystemDIR%\\OsamaLaden.vbs %""OsamaLaden"="C:\\OsamaLaden.bat" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "AltaWorm"="Alta.exe""Laden"="Laden.exe"
and with the following entry, it changes the Internet Explorer Start site:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\]Start Page=http://melhacker.netfirms.com/BinLaden.exe
Description inserted by Crony Walker on Tuesday, June 15, 2004