Alias:
Type:Worm 
Size:416.256 Bytes 
Origin: 
Date:11-27-2001 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Low 

DistributionSubject: Pictures with your loved one

Body:
Hi!
I’m sorry I have to send you these compromising pictures with the one
you love, or you loved. :((
The quality is not so good because of the cheap camera, but you should
be able to quess where thy were taken.
I compresseed it as a self extracting archive because I didn’t knew if
you have WinZip. When you run it, it should display the extract dialog.
I´m really sorrry I have to be the one who told you about this. :((

Attachment:
Images_zipped.exe

Technical DetailsWhen the attachment is opened, W32.Paukor creates two files in Windows directory: Systray.exe and Msp.dll.

The following registry key is made:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunMsp= %WinDIR%\SYSTRAY.EXE

Then, other two files are created in Windows: Images_zipped.exe and Msd.vbs.
Images_zipped.exe is the attachment to be sent with Microsoft Outlook.
Msd.vbs runs the email sending routine with Outlook, using the address book.

A message window is displayed, with an "OK" button to be pressed:
"This WinZip archive seems to be incomplete. Please download again the file,or contact the vendor for an other copy"
Descrizione inserita da Crony Walker su martedì 15 giugno 2004

Indietro . . . .