|
|
I-Worm.Runouce. Viruses Information
| Name: |
I-Worm.Runouce. |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Runouce.a
Runouce is a worm virus spreading via the Internet as an attachment to infected emails. Runouce also copies itself to shared network resources.
The Runouce worm is a Windows PE EXE file about 10KB in length and written in Assembly language.
Infected messages have the following properties:
Subject: Hi,i am %(Name of victim's computer)%
Attachment name: p.exe
The message body is blank.
To run from infected messages the worm exploits the IFRAME security breach.
Installation
The worm copies itself to the Windows System directory under the name "Runouce.exe" and then registers this file in the following registry auto-run key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Runonce = %System%Runouce.exe
%System% = the Windows System directory name.
When the Runouce is launched it creates a 'mutex' named "ChineseHacker" to avoid running multiple instances.
Spreading
The worm creates .EML files containing its copy in all available directories, and network resources, excluding the Windows directory. The name of the .EML files is the name of the victim's computer. For example, if the computer name is COMPUTER, the worm creates COMPUTER.EML files in that computer's directories.
Runouce searches for victim email addresses in WAB databases and files with .ADC and R.DB extensions on all available drives except the Windows directory, and sends infected messages to these addresses. To send infected messages, the worm directly accesses the SMTP server "btamail.net.cn".
Other
The Runouce worm searches for files with .EXE and .SCR extensions on all fixed and remote drives, except the Windows directory, and modifies their file access time data.
Runouce also closes programs with some Chinese titles (probably Chinese anti-virus programs). |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Jel.84
Angel_2 Famil
Macro.Word97.Redte
Screen.60
PM.73
BAT.Sy
Phardera.582
Gidra.46
Tranquilo.56
Macro.Word97.Zeitung.
|
|
