W32/Caric-A

Discussion in 'malware problems & news' started by Paul Wilders, Mar 22, 2002.

Thread Status:
Not open for further replies.
  1. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    Name: W32/Caric-A
    Aliases: W32.Caric@mm, W32/MyLife.b@MM
    Type: Win32 worm
    Date: 22 March 2002

    Sophos has received several reports of this worm from the wild.

    Description:

    W32/Caric-A is a worm which arrives in an email with the
    following characteristics:

    Subject line: bill caricature
    Attached file: cari.scr
    Message text:

    Hiiiii
    How are youuuuuuuu?
    look to bill caricature it's vvvery verrrry ffffunny :) :)
    i promise you will love it? ok
    buy

    ========No Viruse Found========
    MCAFEE.COM

    If you run the attachment and Outlook is installed, then
    W32/Caric-A will send itself to the addresses in your address book. The worm also displays a cartoon of a man wearing a "Bill" badge and playing a saxophone.

    The worm saves a copy of itself in the Windows system folder and adds the following value to the registry:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Run\win = "C:\Windows\System\cari.scr"

    Read the analysis at
    www.sophos.com/virusinfo/analyses/w32carica.html
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.