|
|
I-Worm.Nevezed (aka Never Viruses Information
| Name: |
I-Worm.Nevezed (aka Never |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.Nevezed (aka Never)
Nevezed is a worm virus spreading via Microsoft Outlook. The worm itself is a Java Script file about 4KB in size and written in Java.
Installation
During installation the worm copies itself to the Windows system StartUp directory under the name "StartUp.js" and the Windows System directory under the name "CmdWsh32.js". It them registers this later file in the system registry as a java-class file. The worm also creates a backup copy of itself in the root directory of other drives.
Spreading: Email
To send infected messages the worm uses MS Outlook to send messages to all the addresses found in a victim's Outlook address book.
Infected messages sent by the worm have various subject titles. Possible subject titles could be:
Hello name
Hey name
Fwd: Hey You!
Fwd: Check this!
Fwd: Just Look
Fwd: Take a look!
Fwd: Loop at this!
Fwd: Check this out!
Fwd: It's Free!
Fwd: Look!
Fwd: Free Mp3s!
Fwd: Here you go!
Fwd: Have a look!
Look name!
Fwd: Read This!
Message body text is as follows:
Hello!
Check out this great list of mp3 sites that I included in the attachments! I can get any Mp3 file that I want from these sites, and its free! And please don't be greedy! forward this email to all the people that you consider friends, and Let them benefit from these Mp3 sites aswell! Enjoy !
Infected messages contain one of following attachments:
Free_Mp3s.js
Fwd_Mp3s.js
Mp3_Sites.js
Mp3_Web.js
Mp3_List.js
Mp3_Pages.js
Web_Mp3s.js
Mp3-Sites.js
Fwd-Mp3s.js
Mp3-Fwd.js
Fwd-Sites.js |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Macro.Word.Dav
Saratov.179
Pac-Man Famil
HLLC.CP-Ma
Psycho.72
RedHack.140
Minosse.307
Arriba.159
Win32.Elkern.
Win32.Spit.
|
|
