Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Affected platforms: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, Windows XP, Windows Server 2003
Damage routine: email spreading
The worm sends itself using its own SMTP engine and emailadresses, which it collects from specific filetypes from the infected system. An email sent by the worm can have different appearences:
Subject: (one of the following)
-It's begin here!
Body: (one of the following)
-Your request has been accepted
-Your account info:
-Visit our website to get more info at: http://www.%random_name%NOTE: All your account information has been attached as file and ready to be printed.
The name of the attachment has a 7-characters-long filename, which will be randomly created.
When the worm Worm/Atak.D is executed, it creates a copy of itself in the windows system directory (Windows9x: \Windows\System\ and Windows NT/2000/XP: \Windows\System32\ respectively) with the filename 'a1g.exe'.
The worm appends to the registry the following entry:
The file WIN.INI from the Windows directory will also be modified. The worm adds the following line to the file:
load = %SystemDIR%\a1g.ex
In order not to be executed twice, the worm Worm/Atak.D creates a mutex named 'mtxSSS'. The worm searches for email addresses in the files with the following extensions within all the local disks:
After browsing the system, the worm sends itself to those addresses using its own SMTP engine. Supposed that an email has got one of the following strings in the email address, the worm will not send itself to that address:
Description inserted by Crony Walker on Tuesday, June 15, 2004