Alias:I-Worm.Choke.a, W32/Choke, W95/Worm.Choke, W32.Choke.Worm
Type:Worm 
Size:40,960 Bytes 
Origin: 
Date:00-00-0000 
Damage:Spreads using MSN Messenger. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe worm spreads as ShootPresidentBUSH.exe, to all MSN Messenger users that chat with the infected user. The file contains the following text:

President bush shooter is game that allows you to shoot Bush balzz hahaha

Technical DetailsWhen activated, it remains memory resident and creates the following files:
C:\Choke.exe
C:\ShootPresidentBUSH.exe
C:\About.txt
C:\Dalist.txt

Then it displays the messages:
"This program needs Flash 6.5 to run!"
"Cannot run program!, Quiting"

Eventually, the worm makes the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
This relates to all files created on drive C:\.
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .