W32/Caric-A

Discussion in 'malware problems & news' started by Paul Wilders, Mar 22, 2002.

Thread Status:
Not open for further replies.
  1. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    Name: W32/Caric-A
    Aliases: W32.Caric@mm, W32/MyLife.b@MM
    Type: Win32 worm
    Date: 22 March 2002

    Sophos has received several reports of this worm from the wild.

    Description:

    W32/Caric-A is a worm which arrives in an email with the
    following characteristics:

    Subject line: bill caricature
    Attached file: cari.scr
    Message text:

    Hiiiii
    How are youuuuuuuu?
    look to bill caricature it's vvvery verrrry ffffunny :) :)
    i promise you will love it? ok
    buy

    ========No Viruse Found========
    MCAFEE.COM

    If you run the attachment and Outlook is installed, then
    W32/Caric-A will send itself to the addresses in your address book. The worm also displays a cartoon of a man wearing a "Bill" badge and playing a saxophone.

    The worm saves a copy of itself in the Windows system folder and adds the following value to the registry:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Run\win = "C:\Windows\System\cari.scr"

    Read the analysis at
    www.sophos.com/virusinfo/analyses/w32carica.html
     
Thread Status:
Not open for further replies.