Discussion in 'malware problems & news' started by FanJ, Feb 21, 2002.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    Name: W32/Maldal-I
    Type: Win32 worm
    Date: 21 February 2002

    Sophos has received several reports of this worm from the wild.


    W32/Maldal-I is an email worm. It arrives in an email with one of the following subject lines:

    "Fwd: WoOoOoOow"
    "Fwd:Wow , We are the same !"
    "Fwd: [Muzicana-Group] Download what you want"
    "Zakia Zakaria & Najati :p"
    "Fwd:The demand of sex ... where does it lead us to ?"
    "Take a picture for your self (Don't be mad its only a joke)"
    "Fwd:Is there any true love ?"
    "Fwd:Have u ever seen your face?! (Funny)"
    "Fwd:Against the power of women"
    "Fwd:Fwd:If you care about your wife"
    "Fwd:Say 'I Love You' in 300 languages"
    "Fwd:Send it to every body you love ;)"
    "Re:Fwd:Romantic Day"
    "Fwd: Let's Dance & forget pains"
    "Fwd:Loneliness ..."
    "Fwd: [sex-is] HoT MoVies"
    "Fwd: [SpanishGirlsGroup] Hola ..."
    "Fwd: [LsbianLovers-group] Lick my asshole"
    "Fwd:[Anal-sex-team] OOOH Faster"
    "Fwd: [PussyLand-egroup] How sweet..."
    "Fwd: [DrFun-egroup] Let's Laugh"
    "Fwd: [FuNnY-egroup]Hehehehehe damn"
    "Fwd: [SexyGurls-egroup] Raping a little girl"
    "Fwd: [Scr-News-egroup] Have u ever seen BLOOD"
    "Fwd: [Yabdoo-egroup]For HaCkers Lovers"
    "Fwd: [Jews-egroup] Sharoon Owns The World"
    "Fwd: [FunMaiL-group]Bush under bin laden's **** !!!"
    "Fwd: [Teen-egroup] Three Ways For Love"
    "Fwd: [RomanticLife-group] Learn How To Love ..."
    "Fwd: [Gays-egroup]Oh Shittttt"
    "Fwd:Remember our survivors"
    "Fwd: [JewsFood-egroup] Dogs Meat !!!"
    "Fwd: [PianoMoZart-egroup] Wow Romantic"
    "Fwd:Tonight is... The Night Of Sex"
    "Fwd: Are you looking for FUN !!!?"
    "Fwd: [PussyPiss-egroup] Piss On my face :O"
    "Fwd: [Finance-group] Do you wanna be a rich man?"
    "Fwd: [lovedreams-egroup] love speaks from the heart ..."
    "Fwd:Change your life with Dr.Jobreee"
    "Fwd: [TeroNews-Group] Too Late ... Bin Laden has been killed"
    "Fwd: [Pc.CLup-Group] Learn how to deal with DOS"
    "Fwd:[RapingTeen-eGroup] Oh My God !!!"
    "Fwd: The rights of women !!! "

    The body text of the email is likely to be blank and the
    filename of the attachment is most likely to be PROGRAM.EXE.

    The worm can extract email addresses from web pages on the hard drive as well as from the Microsoft Outlook address book.

    When first run W32/Maldal-I will set the registry key

    When next run it will display a box with a black background and
    red text stating:

    "Sorry you have not registered
    Please contact us"

    along with some phone numbers, email addresses and instructions on how to subscribe. It will then set the registry key

    The worm will create several entries in the registry Run key all pointing to copies of itself scattered over the harddisk, although it may not actually create the associated files.

    Five minutes after being run, the worm may display a black background with the following text in red letters:

    ZaCker Is N YoUr MaChiNe

    Read the analysis at
  2. FanJ

    FanJ Guest

    How can someone sink so low that he/she writes such words as seen above ?   :mad:  :(
    Does that 'person' have the faintest idea .......   :'(
  3. Detox

    Detox Retired Moderator

    Feb 9, 2002
    Texas, USA
    well there's just some really sick bastards out there :-(
Thread Status:
Not open for further replies.