Alias:VBS/Pica.worm.gen[McAfee], I-Worm.Kagra.b[AVP], VBS/Kagra@mm[Frisk], I-Worm.Magold.a, W32.HLLW.Magold
Type:Worm 
Size:2,557 Bytes 
Origin: 
Date:00-00-0000 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Low 

DistributionThe worm uses MAPI for replying to all emails it can find in Microsoft Outlook.
The email it sends, contains:
Subject: FREE PORN SITES
Attachment: Clickme.vbs

Technical DetailsFirst, the worm tries to copy itself into the last subfolder of the drive C:, beginning with "Win". Usually, it is C:\Windows or C:\Winnt. It copies itself as
Run32dll.vbs and Clickme.vbs.
Then, it changes the following registry autostart entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinUpdate wscript.exe \run32dll.vbs %

The worm searches for files on all local or network drives. If it finds a .vbs or .vba file, it tries to replace it.

If the system date is 26th of July, it displays a window message:
"FREE PORT SITES"
Descripción insertada por Crony Walker el martes 15 de junio de 2004

Volver . . . .