Worm/Aphex.3 - Worm

See also

Full description

Alias:	I-Worm.Aphex, Psec. Aplore.A
Type:	Worm
Size:	319.488 Bytes
Origin:
Date:	00-00-0000
Damage:	Worm/Aphex.3 makes a registry entry and prompts the user to download it.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Low

DistributionThe Visual Basic file "email.vbs" contains the damage routine and is attached to the virus email.
After the worm terminates the Outlook application, the script is deleted. The virus email looks like this:
From: infected-user-name
The subject and body contain only ".".
Attachment: psecure20x-cgi-install.version6.01.bin.hx.com

Technical DetailsWhen the worm is activated, it copies itself in Windows System directory as "explorer.exe". The registry entry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Explorer
ensures the automatic start of the virus.

The worm has its own IRC engine and tries to connect to an IRC server. It connects to various ports and sends private messages to the users that try to connect to the server.
It offers a link to the infected computer. The site shows that a download should be performed in order to see the contents. The download is requested every second. After the user opens the file, the worm starts infecting the system.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back