|
|
I-Worm.Lohack. Viruses Information
| Name: |
I-Worm.Lohack. |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Lohack.a
This is a virus-worm that spreads via the Internet attached to infected e-mail. The worm itself is a Windows PE EXE file about 15Kb in length (compressed by UPX, decompressed size is about 41K), and it is written in Microsoft Visual C++.
Infected messages consist of the following:
Subject: Hacking courseall
Body: Look the hacking course - version 1.0 !
By Senna Spy - Made In Brazil
http://www.avpavp.hpq.com.br
Attachment: hacking.exe
The worm is activated from infected e-mail only when a user clicks on the attached file.
The worm does not install itself to the system and is not activated anymore (except in cases when a user clicks on the attached e-mail again).
To send infected messages, the worm scans the Windows directory and all subdirectories, and looks for files with the following extensions:
.IDX .NCH .MDX .DBX .MSG .EML .TXT .HTM
Then it looks for e-mail addresses in these files (text strings that are e-mail addresses), then sends infected messages to these addresses. To send infected messages, the worm uses Windows MAPI functions. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Datacrime.1280.
BachKhoa.442
Rushhour Famil
PL0006.48
Konkoor.307
Infector.82
Virdem.83
4on.134
Trojan-Spy.HTML.Bayfraud.h
Imi.165
|
|
