Discussion in 'malware problems & news' started by FanJ, Apr 23, 2003.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    W32/Coronex-A Aliases: I-Worm.Coronex

    Win32 worm

    W32/Coronex-A is an internet worm which emails itself to every contact in the Windows address book.

    The email characteristics vary depending upon the current day of the week, as follows:

    ---snip by FanJ (see that Sophos page !)---

    When first run, the worm displays a message box with the text "SARS Virus, corona virus", copies itself to the Windows folder as Corona.exe and creates the following registry entry so that corona.exe is run automatically each time Windows is started:

    = %WINDOWS%\corona.exe -A

    The worm copies itself to the C:\My Downloads folder using 1 of the 24 filenames listed below, depending upon the current hour of the day:

    Age Of Mythology.exe
    Battlefield 1942 (full).exe
    Black Hawk Down (full).exe
    Command & Conquer: Generals.exe
    Cossacks Full Version.exe
    Dark Age of Camelot.exe
    Doom 3.exe
    Grand Theft Auto 3 (full).exe
    Jedi Knight II.exe
    Master Of Orion 3.exe
    Medel Of Honor: Allied Assault.exe
    Oni full.exe
    Quake 3 Full Version.exe
    Rainbow 6 Full.exe
    Return to Castle Wolfenstien (Full).exe
    Starcraft full.exe
    The Lord of the Rings.exe
    The Sims: Unleashed.exe
    Tribes 2 (full).exe
    Ultima Online.exe
    Unreal 2: The Awakening (full).exe
    Warcraft III Full.exe
    White and Black.exe

    When run with a -A command line switch (i.e. on startup), the worm runs continuously in the background and emails itself when the time is 1 minute past any hour.

    The worm also changes the start page for Microsoft Internet Explorer by setting the registry entry

    HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
    ---deleted by FanJ---
  2. FanJ

    FanJ Guest


    You will have to copy and paste the link because of the @.

    With thanks to Pieter ! ;)
  3. spy1

    spy1 Registered Member

    Dec 29, 2002
    Clover, SC
Thread Status:
Not open for further replies.