¿Necesita ayuda? Pregunte a la comunidad o contrate a un experto.
Ir a Avira Answers
Alias:I-Worm.Melhack; OsamaLaden.vbs
Size:122.664 Bytes 
Damage:Sent by email. 
VDF Version: 

DistributionThe email sent by Worm/Nedal contains:
Subject: Osama Bin Laden Comes Back!

Body: Hello People,
You have received Email from Osama Bin Laden.
Allah is The One Of God. No god in the World Accept Allah!
All people in the world love peace and no wars. America and Israel must be destroy to prevent from wars.
Your Sincerely,
Osama Bin Laden
Al-Qaeda Network

Attachment: The email has no attachment. The virus code is inserted as HTML text, used for showing the message.

Technical DetailsWorm/Nedal is an Internet Worm, spread by email.
When the email is opened, the virus code is activated using ActiveX. Some computer systems show a Windows message to ask if ActiveX should be run. If the user answers YES, the worm is activated. Worm/Nedal creates the file OsamaLaden.vbs and copies it in:
Another worm copy is made in C:\Windows\, as 'OsamaBinLaden.vbs'.
A DOS window is displayed.

Worm/Nedal creates the following files:
-'Laden.EXE' in C:\Windows\ (4.608 Bytes). The Trojan component, which displays a window on every September, 11.
-'Osama.EXE' in C:\Windows\ (17.174 Bytes). It infects .exe files and affects their original contents.
-'Alta.EXE' (5.120 Bytes). It is a Windows Trojan. It displays the text: "Prepare to sleep..." and then shuts the system down.
-'Laden.BAT' in C:\ (103 Bytes). This file deletes the contents of Windows System directory. Then, the system is shut down.

The worm makes the following registry entries:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "OsamaBinLaden"="wscript.exe c:\\%WinDIR%\\%SystemDIR%\\OsamaLaden.vbs %""OsamaLaden"="C:\\OsamaLaden.bat" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "AltaWorm"="Alta.exe""Laden"="Laden.exe"

and with the following entry, it changes the Internet Explorer Start site:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\]Start Page=http://melhacker.netfirms.com/BinLaden.exe
Descripción insertada por Crony Walker el martes, 15 de junio de 2004

Volver . . . .
https:// Esta ventana está cifrada para su seguridad.