Alias:W32.Atak.B@mm
Type:Worm 
Size:12.037 bytes 
Origin: 
Date:12-06-2004 
Damage: 
VDF Version:6.28.00.104 
Danger:Low 
Distribution:Medium 

General DescriptionAffected platforms: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, Windows XP, Windows Server 2003

Damage routine: email spreading

DistributionThe worm sends itself using its own SMTP engine and emailadresses, which it collects from specific filetypes from the infected system. An email sent by the worm can have different appearences:

From: %spoofed%

Subject: (one of the following)

-It's begin here!
-First Match!
-microsoft

Body: (one of the following)

-Hello %random_name%
-Your request has been accepted
-Your account info:
-Email: %random_name%
-Password: %random_name%
-Visit our website to get more info at: http://www.%random_name%NOTE: All your account information has been attached as file and ready to be printed.

Attachment:

The name of the attachment has a 7-characters-long filename, which will be randomly created.

Technical DetailsWhen the worm Worm/Atak.D is executed, it creates a copy of itself in the windows system directory (Windows9x: \Windows\System\ and Windows NT/2000/XP: \Windows\System32\ respectively) with the filename 'a1g.exe'.

The worm appends to the registry the following entry:

HKEY_CURRRENT_USER\Software\Microsoft\ WindowsNT\CurrentVersion\Windows
"load=%SystemDIR%\a1g.exe".


The file WIN.INI from the Windows directory will also be modified. The worm adds the following line to the file:

load = %SystemDIR%\a1g.ex

In order not to be executed twice, the worm Worm/Atak.D creates a mutex named 'mtxSSS'. The worm searches for email addresses in the files with the following extensions within all the local disks:

.log
.eml
.mht
.dbx
.asp
.php
.jsp
.htm
.txt

After browsing the system, the worm sends itself to those addresses using its own SMTP engine. Supposed that an email has got one of the following strings in the email address, the worm will not send itself to that address:

support
submit
none
virus
anti
samples
microsoft
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .