Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
- Windows 95
- Windows 98
- Windows ME
- Windows NT
- Windows 2000
- Windows XP
- Windows Server 2003
Damage routine: email sending
Worm/Atak.I disposes of its own SMTP engine. One of the emails sent by the worm can have the following appearance:
-Subject: (one of the following)
HAPPY NEW YEAR!
Happy New Year!
-Body: (one of the following)
Happy New year and wish you good luck on next year!
Mery Chrismas & Happy New Year! 2005 will be the beginning!
-Attachment: (one of the following)
Worm/Atak.I is one of the three versions of the Atak worm, that within a period of one hour were souhgt 'in the wild'. Both other versions of the worm Atak (.H and .J) which behave very similarly, were packed with the FSG runtime packer.
When Worm/Atak.I is executed, it copies itself with the filename "DEC25.EXE" in the Windows system directory and creates the following registry entries:
-[HKEY_CURRENT_USER\Software\Microsoft\ Windows NT\CurrentVersion\Windows]
The worm Atak is also able to append an autorun entry to the WIN.INI file.
The worm searches for email addresses within files with the following extensions:
Description inserted by Crony Walker on Tuesday, June 15, 2004