I-Worm.Talorm

I-Worm.Talorm

Talorm is a worm virus spreading via the Internet as an attachment to infected emails and copies itself to IRC channels. The worm itself is a CHM file (compressed HTML file) about 17KB in length.

Infected messages have the following features:

The Subject Line text is randomly selected from the following variants:

- Fotos de Thalia
- Free Pics
- Fotos XXX de Thalia
- Fotos Exitantes de Thalia
The body text is randomly selected from the following variants:

- Checa estas fotos de Thalia
- Hola que tal? ya viste las super fotos exitantes de Thalia
- Como tas! aqui te mando unas fotos de Thalia
- Para mis mejores Amigos fotos de Thalia
- Fotos XXX de Thalia
- unas fotos bien padres de Thalia
- Imagenes insolitas de Thalia
- Apuesto a que no has visto desnuda a Thalia
- HOLA! TE RETO A CHECAR ESTAS FOTOS BIEN CHIDAS DE Thalia
- Fotos Exitantes de la cantante Thalia

Attach: Thalia.chm
An example of a "Talorm" email message:


The worm activates from infected emails only when a user clicks on the attached file. If this happens Talorm then installs itself to the system and runs its spreading routine.

The worm then overwrites a registry key with new text:

HKLM\Software\Microsoft\Windows\CurrentVersion
RegisteredOwner = Thalia"
and displays the message:


Installing
While installing the worm copies itself to the Windows directory with the "Thalia.chm" name and registers this file in the system registry auto-run key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Thalia = %WinDir%\Thalia.CHM

Spreading: EMail
To send infected messages the worm uses MS Outlook and sends messages to all addresses found in each victim machine's Outlook address book.


Spreading: IRC
The worm looks for the mIRC subdirectory in the "Program Files" directory and writes a new "script.ini" file to this location. This script file has instructions that send worm copies to every user who joins an infected IRC channel.



For more details please visit the Kaspersky Virus Encyclopedia at:
http://www.viruslist.com/eng/viruslist.html?id=58002