11/13/2022 0 Comments Lover worm virus![]() ![]() To install the Trojan program to the system, the worm modifies the URL to the Internet Explorer start page. The worm also creates a HTM dropper in the Windows system directory to use it while spreading to mIRC channels (see below). HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesWin32DLL = Win32DLL.VBSĪs a result, the worm is re-activated each time Windows boots up. HKLMSoftwareMicrosoftWindowsCurrentVersionRunMSKernel32 = MSKERNE元2.VBS These files are then registered in the Windows auto-run section in the system registry: In Windows system directory: MSKERNE元2.VBS, It creates its copies in the Windows directories with the names: The worm also installs itself into the system. The message subject, body and attached file name are the same as above. Upon activation by a user, (by double clicking on an attached file) the worm opens MS Outlook, gains access to the Address Book, gets all addresses from thereĪnd sends messages with its attached copy to all of them. Message body: kindly check the attached LOVELETTER coming from me.Īttached file name: The message in the original worm version has: The worm arrives to a computer as an e-mail message with an attached VBS file that is the worm itself. The worm also has the ability to spread through the mIRC channels.īy: spyder / / Group / Manila,Philippines When run, the worm sends its copies by e-mail, installs itself into the system, performs destructive actions, downloads and installs a Trojan program. Spread itself, the worm accesses MS Outlook and uses its functions and address lists, which is available in Outlook 98/2000 only, so the worm isĪble to spread only in case one of these MS Oulook versions is installed. In Windows 98 and Windows 2000, WHS is installed by default. It operates only on computers on which the Windows Scripting Host (WSH) has been installed. The worm is written in the scripting language “Visual Basic Script” (VBS). As a result, an infected computer sends as many messages to as many addresses that are kept in the MS Outlook contacts list. While spreading, the worm uses MS Outlook and sends itself to all addresses that are stored in the MS Outlook Address Book. The worm spreads via e-mail by sending infected messages fromĪffected computers. This is the Internet worm that caused the global epidemic at the beginning of May 2000. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |