|
The worm has it's own SMTP engine and uses the SMTP settings
found at this registry key to send itself: HKCU\Software\Microsoft\Internet
AccountManager\Accounts\00000001
When it is executed, the worm first checks the date. If the
computer date is not between January 25 to 29, 2002 or if
the keyboard settings are set to Russian, the worm copies
itself to:
C:\Recycled-F-<random digits>-<random digits>-<random
digits>
and exits. Otherwise, the worm continues.
The worm next checks its own file name, and performs different
actions depending on the file name or extension:
- If the file name is "Access" the worm attempts
to launch your Web browser to http:/
/www.disney.com and exits. However, the worm does not contain
code which can generate a
file with the name Access.<any extension>, so it is
highly unlikely that this will trigger.
- If the file name has a .com extension, the worm copies
itself to one of the following locations:
C:\Regctrl.exe (Windows NT/2000/XP)
C:\Recycled\Regctrl.exe (Windows 95/98/Me).
and then executes the Regctrl.exe file.
- If the file name has a .exe extension such as Regctrl.exe,
the worm begins its propagation
routine:
1. The worm searches the Windows address book that is
used by Microsoft Outlook
and Outlook Express, and through files with the extension
.dbx in the Microsoft
Outlook Express folder for email addresses. (The .dbx
files are Microsoft Outlook
Express folders and inboxes.)
2. The worm sends itself to these email addresses using
its own SMTP engine. The
worm uses the default SMTP server address that is configured
on the computer. The
From: address is set to your email address.
3. On Windows NT/2000/XP computers the worm creates a
backdoor Trojan:
%Windows%\Start Menu\Programs\Startup\msstask.exe
so that it is executed when you start Windows. This backdoor
trojan contacts a
Webpage at 209.151.250.170 which allows the author to
have access to the computer.
Depending on the contents of the Webpage, the backdoor
will perform different actions.
The worm also sends an e-mail to: napster@gala.net, possibly
for the virus author to track it's spread.
|
