Discussion in 'malware problems & news' started by FanJ, Jul 8, 2002.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    Name: W32/Calil-A
    Aliases: W32/Lilac.A@mm, WORM_LIAC.A
    Type: Win32 worm
    Date: 8 July 2002

    At the time of writing Sophos has received just one report of
    this worm from the wild.

    W32/Calil-A is an email worm which uses Microsoft Outlook to spread. The
    worm arrives in an email with the following characteristics:

    Subject line: FW: FW: LILAC project video attached
    Message text: Things that the govt. dont want you to know
    Attachment name: LILAC_WHAT_A_WONDERFULNAME.avi.exe.

    The icon of the attached file is identical to the icon of an AVI sound file.

    If the attachment is opened from Microsoft Outlook the worm runs and displays the fake error message "Error54:Media Player not installed correctly".

    The worm then sends itself to all contacts found in the Windows address book.

    W32/Calil-A adds or changes several registry entries. It adds the registry entry \HKLM\Software\Microsoft\Windows\CurrentVersion\ Run\Lilac so that the worm file runs during the Windows startup sequence.

    As a payload W32/Calil-A adds the registry entries


    so that the message box "Owned by xEnOcrAtEs" is displayed before the log-on dialog.

    More information about W32/Calil-A can be found at
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.