Alias:I-Worm.Choke.a, W32/Choke, W95/Worm.Choke, W32.Choke.Worm
Type:Worm 
Size:40,960 Bytes 
Origin: 
Date:00-00-0000 
Damage:Spreads using MSN Messenger. 
VDF Version:  
Danger:Low 
Distribution:Low 

DistributionThe worm spreads as ShootPresidentBUSH.exe, to all MSN Messenger users that chat with the infected user. The file contains the following text:

President bush shooter is game that allows you to shoot Bush balzz hahaha

Technical DetailsWhen activated, it remains memory resident and creates the following files:
C:\Choke.exe
C:\ShootPresidentBUSH.exe
C:\About.txt
C:\Dalist.txt

Then it displays the messages:
"This program needs Flash 6.5 to run!"
"Cannot run program!, Quiting"

Eventually, the worm makes the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
This relates to all files created on drive C:\.
설명 삽입자 Crony Walker   2004년 6월 15일 화요일

뒤로 . . . .

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

내 계정

https:// 이 창은 보안을 위해 암호화되었습니다.