Alias:W32/Melare@MM [McAfee], I-Worm.Melare, W32.Ahlem.A@mm
Type:Worm 
Size:6,144 Bytes 
Origin: 
Date:00-00-0000 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Low 
Distribution:High 

DistributionIt sends itself to all contacts in Windows Address Book. The email contains:

Subject: Alert! SARS Is being Spread.
Body: Hi!, This is a beta test SARS. Please check an attachment.
Attachment: a.exe

Technical DetailsWorm/Mapson copies itself as %Windir%\Csrss.exe.

It makes the autostart registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "SYSTEMSars32"="%WinDIR%\csrss.exe"

The worm also contains texts related to SARS, but they are irrelevant.
Descrizione inserita da Crony Walker su martedì 15 giugno 2004

Indietro . . . .