Worm/Tettona - Worm

See also

Full description

Alias:
Type:	Worm
Size:	34.761 Bytes
Origin:
Date:	06-14-2002
Damage:	Spreads by email.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Medium

DistributionFor email spreading, Worm/Tettona uses its own SMTP routine. It sends itself to all email addresses it can find in WAB (Microsoft Windows Adressbuch). The email contains:

Subject:
Incredible...
Urgente! (vedi allegato)
Qualsiasi cosa fai, falla al meglio

Body:
hello, or ciao followed by:
see this interesting file.
okkio allallegato ;-)
devi assolutamente vedere il file che ti ho allegato.
apri subito lallegato, eMOLTO interessante......

Attachment:
tettona.exe
euro.exe
tattoo.exe

Technical DetailsTettona spreads by email using its own SMTP routine. It also has a backdoor routine.
When the infected attachment is opened, the worm copies itself in Windows directory, as DLLMGR32.EXE and enters the following autorun registry key:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "DllManager"="C:\%WinDIR%\dllmgr32.exe"

Worm/Tettona displays a false message:
"VBRUN49.DLL not found!
Unable to execute."

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back