¿Necesita ayuda? Pregunte a la comunidad o contrate a un experto.
Ir a Avira Answers
Alias:W32/Aplore.A
Type:Worm 
Size: 
Origin: 
Date:04-10-2002 
Damage:Spreads over email, IRC or AIM. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Medium 

DistributionIt sends itself as email with Microsoft Outlook, using the Outlook Address Book.
The form of the email looks like this:
The subject and body are empty.
Attachment: psecure20x-cgi-install.version6.01.bin.hx.com

Technical DetailsWhen the attachment is opened, the worm is copied as Explorer.exe and psecure20x-cgi-install.vers.... in Windows directory and enters the following key in the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Explorer=C:\%WinDIR%\%SystemDIR%\Explorer.exe

The file Email.vbs is dropped in Windows system directory. This is used by the worm to send emails.

IRC-Client

Worm/Aphex has its own IRC-Engine and so it can log on open IRC servers.
Aphex switches between various channels and sends a private message to all logged users. The private message has the following contents:
FREE PORN: http://free:porn@192.xxx.xxx.xxx:8180
If the user clicks on the link, a website is displayed. If the user clicks on the link HERE on the displayed website, a download window opens. If the user chooses the "Open from current place" option, the worm Aphex infects the system.

AOL Instant Messanger (AIM)

If Worm/Aphex has infected your system, it waits for AOL Instant Messanger to be opened. Then, it sends one of the following messages to all users from the contact list:
-I wanted to show you this
-please check out
-hey go to try
-this this
-is cool
-I like this
-what about
-have you seen
-lol
-wow
-btw, download this
followed by a hyperlink (see "IRC-Client"). If the user accesses this link, a website is opened, from which Worm/Aphex can be installed.
Descripción insertada por Crony Walker el martes, 15 de junio de 2004

Volver . . . .
https:// Esta ventana está cifrada para su seguridad.