Email-Worm.VBS.Linong

tag:E-mail Worms

0 0

This is an Internet VBS worm that spreads attached to e-mails. To spread the worm opens MS Outlook, gets access to address book, gets all addresses from there and sends itself to all these addresses. The infected messages have:

Subject: "My-Linong...."
Body: "True Story...."
File name: mylinong.TXT.vbs

When an infected file is run (when a user clicks on attached file and activates it) the worm code gets control. First of all it drops (installs) its components to the system:

%windows%\mylinong.txt.shs
%windows%\SYSTEM\Kern32Lin.vbs
%windows%\Vbrun32DLL.vbs
%windows%\SYSTEM\mylinong.TXT.vbs

and registers some of them in auto-run registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run Kern32lLin = %windows%\SYSTEM\MSKernel32.vbs
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices Vbrun32DLL = %windows%\Win32DLL.vbs

The worm also changes the Internet Explorer start page.

The worm creates directories:

?\LINONG I LOVE YOU MY FOLDER1
?\LINONG I LOVE YOU MY FOLDER2
?\LINONG I LOVE YOU MY FOLDER3

and so on till 600:

?\LINONG I LOVE YOU MY FOLDER600

The worm then creates the %TEMP%\mylinong.txt text file and opens it (by default NOTEPAD.EXE opens that file and displays it):


 @@@@   @@@@            @@@@@    @@@      @@@  @@@@@@@@@    @@@    @@@   @@@@@
@@@     @@@
  @@     @@           @@     @@   @@      @@    @@           @@    @@  @@  
@@  @@     @@
  @@     @@           @@     @@   @@      @@    @@            @@  @@   @@  
@@  @@     @@
  @@     @@           @@     @@    @@    @@     @@@@@@         @@@@    @@  
@@  @@     @@
  @@     @@           @@     @@     @@  @@      @@              @@     @@  
@@  @@     @@
  @@     @@       @   @@     @@      @@@@       @@              @@     @@  
@@  @@     @@
 @@@@   @@@@@@@@@@      @@@@@         @@       @@@@@@@@@        @@       @@@@@
@@@@@

 @@@@         @@@@  @@@  @@@@      @@@@@   @@@  @@@@    @@@@@@
  @@           @@    @@ @   @@   @@     @@  @@ @   @@  @@    @@
  @@           @@    @@     @@   @@     @@  @@     @@  @@
  @@           @@    @@     @@   @@     @@  @@     @@  @@  @@@@@
  @@           @@    @@     @@   @@     @@  @@     @@  @@    @@
  @@        @  @@    @@     @@   @@     @@  @@     @@  @@    @@
 @@@@@@@@@@@  @@@@  @@@     @@@    @@@@@   @@@     @@@  @@@@@@

 I Love You, MyLinong - 5it3Ninty8

previous:Email-Worm.VBS.KakWorm
previous:Email-Worm.VBS.Loding

Virus Source from:

New articles

WORM_KELIHOS.SMhis worm may be downloaded from the following remote sites: http://{BLOCKED}.240.36/flash2.exe It may be downloaded from remote site(s) by the follow...Email-Worm.Win32.3DStars This is an Internet worm that spreads via e-mail as an attached EXE file. The worm itself is a Win32 executable file about 70Kb in length, and written in Visua...Email-Worm.Win32.Abotus This is the worm virus spreading via the Internet being attached to infected emails. The worm itself is Windows PE EXE file about 18Kb of length, written in De...Email-Worm.Win32.Aliz This is a virus-worm that spreads via the Internet, attached to infected e-mails. The worm itself is a Windows PE EXE file about 4Kb in length and written in A...Email-Worm.Win32.Bagle.ef This Bagle variant is unable to replicate independently. However, all other functionality indicated that this worm is a member of the Bagle family. It was mass...

Hot Articles

Email-Worm.VBS.Linong

Computer Virus Clounds