Worm/Aphex.1 - Worm

See also

Full description

Alias:	W32.Aphex@mm, Bloodhound.VBS.Worm, I-Worm.Aphex,
Type:	Worm
Size:	319,488 Bytes, variable.
Origin:
Date:	00-00-0000
Damage:	Spreads over Outlook Express, Mirc, Xirc, AIM, MSN, WebServer.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Low

DistributionThe email sent has the following structure:
From: the name of the infected computer.
The subject and body contain only ".".
Attachment: psecure20x-cgi-install.version6.01.bin.hx.com

Technical DetailsThe worm is a mass mailer, which spreads using its own webserver on port 8180.
When activated, the worm creates a VBScript in C:\%SystemDir%\Email.vbs.
This file is sent to all addresses found in Windows Address Book. Then the worm closes Outlook Express and deletes the file.
It copies itself in C:\%SystemDIR%, usually as -psecure20x-cgi-install6.01.bin.hx.com
-explorer.exe
It also makes the following registry entries, for automatic start:
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Explorer ="%SystemDIR%\[filename]" -HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ResourceMonitor = "%SystemDIR%\[filename]"

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back