Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Spreads by email.
For email spreading, Worm/Tettona uses its own SMTP routine. It sends itself to all email addresses it can find in WAB (Microsoft Windows Adressbuch). The email contains:
Urgente! (vedi allegato)
Qualsiasi cosa fai, falla al meglio
hello, or ciao followed by:
see this interesting file.
okkio allallegato ;-)
devi assolutamente vedere il file che ti ho allegato.
apri subito lallegato, eMOLTO interessante......
Tettona spreads by email using its own SMTP routine. It also has a backdoor routine.
When the infected attachment is opened, the worm copies itself in Windows directory, as DLLMGR32.EXE and enters the following autorun registry key:
Worm/Tettona displays a false message:
"VBRUN49.DLL not found!
Unable to execute."
Description inserted by Crony Walker on Tuesday, June 15, 2004