WORM_WANOR.A

Discussion in 'malware problems & news' started by Randy_Bell, Mar 21, 2003.

Thread Status:
Not open for further replies.
  1. Randy_Bell

    Randy_Bell Registered Member

    Joined:
    May 24, 2002
    Posts:
    3,004
    Location:
    Santa Clara, CA
    WORM_WANOR.A propagates via email using Microsoft Outlook's Messaging Application Programming Interface (MAPI). It sends an email message with itself as an attachment to all addresses listed in the Microsoft Outlook address book. The message contains the following:

    Subject: SAY NOT WAR
    Message body:
    que caña tio

    http://www.puncown.org/rvb/F15/
    http://www.sundaerald.com/28224/
    Attachment: Winscr.scr
    This worm creates autorun entries certain registry entries that allow it to execute at every Windows startup. It was designed to drop copies of itself in shared folders of popular peer-to-peer file sharing applications such as eDonkey2000, Kazaa, Morpheus, Grokster, Bearshare, and ICQ. However, it fails to execute its peer-to-peer propagation routine.

    If this worm has run at least 20 times, it hides the desktop icons and the Start menu. It then displays an anti-war message with the following text:

    NOT WAR: NOT BLOOD FOR ...
    NOT WAR, SAY NOT WAR
    It also continuously blinks the Num Lock LED indicator.

    If you would like to scan your computer for WORM_WANOR.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/

    WORM_WANOR.A is detected and cleaned by Trend Micro pattern file #489 and above.
     
Thread Status:
Not open for further replies.