W32/Onamu-A

Name: W32/Onamu-A
Aliases: I-Worm.Radix.a, Pe_Moe.A
Type: Win32 executable file virus
Date: 23 April 2002

Sophos has received several reports of this virus from the wild.

Description:

W32/Onamu-A is a Win32 virus which may arrive as a randomly
named attachment to an email from a fake email address such as
wer937@hotmail.com or lecs2462@yahoo.com.

The email will have a randomly chosen subject line and message
text, in Spanish.

When run, the virus copies itself to the Windows folder and adds
the path to this file to a new value in the registry at:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

W32/Onamu-A then searches the Windows, system and current
folders for EXE and SCR files to infect. It also sends itself
out to all contacts in the Windows address book.


Read the analysis at
http://www.sophos.com/virusinfo/analyses/w32onamua.html