Virus: Worm/Minusia.A Date discovered: 22/03/2006 Type: Worm In the wild: Yes Reported Infections: Low Distribution Potential: Medium to high Damage Potential: Low Static file: No VDF version: 6.34.00.83
General Methods of propagation: Aliases: Platforms / OS: Side effects: %WINDIR% \ exists a file with the following name, muhammad_is_my_prophet.txt, the worm would not infect the machine. Files %SYSDIR% \svchost.exe%WINDIR% \safemode.exe%SYSDIR% \ERSvc.exe%WINDIR% \mmsg\mcAfee.Update.exe.exe%WINDIR% \Config\Easy.Windows.Monitoring.exe.exe%WINDIR% \Config\system.update.exe.exe%WINDIR% \mmsg\mmsg\mmsg.exe.exe%system drive root% \listname_of_terrorist.exe%WINDIR% \system_log.txt This is a non malicious text file with the following content:%WINDIR% \Registry1.dll This is a non malicious text file that contains information about the program itself. %WINDIR% \Registry1.dll This is a non malicious text file that contains information about the program itself. Registry %WINDIR% \mmsg\mcAfee.Update.exe.exe"%WINDIR% \Config\Easy.Windows.Monitoring.exe.exe"%PROGRAM FILES% \MSN Messenger\MsnMsgr.Exe .exe%PROGRAM FILES% \Messenger\msmsgs.exe .exe"%WINDIR% \Config.system.update.exe.exe"%SYSDIR% \svchost.exe%hex values% %SYSDIR% \srsvc.dll%hex values% %SYSDIR% \ERSvc.exe%hex values% %CLSID% \Software\Microsoft\Outlook Express\ Email Subject: %random character string% ,your name is listed in terrorism organisation..!!!%random character string% ,this file from me,%random character string% ,%random character string% ,Namamu termasuk dalam daftar terrorist..!!Body: Attachment: %random character string% .zip%random character string% .exe Network Infection IP address generation: Process termination File details Compilation date:
Description inserted by Andrei Ivanes on Wednesday, March 22, 2006
Back
.
.
.
.
