|
The worm then adds the mail user's name to the end of the
message, and sends the mail to all addresses in your Microsoft
Outlook address book.
Next, it copies itself to the \Windows folder as Karen.exe.
It then and adds the value
Karen c:\windows\karen.exe
to the registry key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
This will cause the worm to be run on each time that you
start Windows.
It then looks for the C:\Mirc folder. If it exists, it creates
the file Script.ini in that location, so that it will attempt
to send itself through mIRC when mIRC is run.
It also searches looks for the C:\inetpub\wwwroot folder,
and, if found, it copies itself there as Web.exe. (This folder
is found in Microsoft IIS web servers.) It then renames the
Default.htm file to Redesi.htm, and it creates a new Default.htm
file, which will display the text:
We Are Forever
Anyone who views this page will be asked to download the
Web.exe file.
|
