Worm/Inmota.1 - Worm

See also

Full description

Alias:	I-Worm.Inmota, W32.Inmota.Worm
Type:	Worm
Size:
Origin:
Date:	00-00-0000
Damage:	Sent by email.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThe worm counts the addresses in Microsoft Outlook or in Outlook Express and replies them with the attachment:
Default.html<222 blank spaces>.pif.

Technical DetailsWhen activated, Worm/Inmota.DLL copies itself as
default.html<222 blank spaces>.pif in %Systemdir% and %Windir% directories.

It creates the following files:
%WinDIR%\Rundl132.exe
%SystemDIR%\Rundl132.exe
%WinDIR%\Gate.dll
%SystemDIR%\Gate.dll

It makes the following autostart registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PowerProfile"="rundl132 kernel.dll,PowerProfileEnable

The following message is displayed:
"Welcome Microsoft CD Key web site
Press OK to open the Web"

It opens Internet Explorer and connects to a predefined website.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back