Full description

Alias:	VBS.LoveLetter.C
Type:	Worm
Size:	17.245 Bytes
Origin:
Date:	06-01-2001
Damage:	Sent by email.
VDF Version:	6.23.00.00
Danger:	Medium
Distribution:	High

DistributionThe worm spreads over Microsoft Outlook email program and sends itself to all contacts found in the Address Book.
An email sent by the worm looks like this:

Subject: Where are you?

Body: This is my pic in the beach!

Attachment: JENNIFERLOPEZ_NAKED.JPG.vbs

Technical DetailsIf the file JENNIFERLOPEZ_NAKED.JPG.vbs is opened, the worm copies itself in c:\windows. Then, the worm registers twice:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunWORM"="wscript.exe C:\\WINDOWS\\JENNIFERLOPEZ_NAKED.JPG.vbs % HKEY_CURRENT_USER\Software\JENNIFFERLOPEZ_NAKED @="Worm made in algeria" mailed"="1

The worm searches all drives and mapped network drives for files with extension:
*.vbs *.vbe *.js *.jse *.css *.wsh *.sct *.hta *.jpg *.jpeq *.mp3 *.mp2
All these files are overwritten with the virus code.

Finally, the virus "W95/CIH.A" is dropped in "C:\%windDir%\". The file name is "Cih_14.exe".

설명 삽입자 Crony Walker 2004년 6월 15일 화요일

뒤로 . . . .

내 계정