i-worm.gali-def1
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
I-Worm.Galil
This is a worm virus spreading via the Internet being attached to infected emails. The worm consists of several components. All of them are Windows PE EXE files, written in Visual Basic.
Main file: "iLLeGaL.exe", about 81K of size
Spreading component: "Mplayer.exe", about 14K (compressed by UPX, decompressed - 37K)
SMTP control: "SMTP.ocx", about 26K (compressed by UPX, decompressed - 90K)
Installing
When the main worm file is run it installs itself and its components to the system. While installing the worm copies its main file to the Windows system directory with the name "iLLegGaL.exe". Other worm components are installed to the same directory. The "Mplayer.exe" component is then registered in system registry auto-run key:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
iLLeGaL = %SystemDir%\Mplayer.exe
The worm then displays a fake Flash animation and the message:
Sorry !
Looooooooool , thanx fo da time u spent thinkin ov me
Spreading
The worm reads victim emails from the MS Outlook address book and searches for email addresses in .HTM and .HTML files. To send infected messages the worm uses direct connection to SMTP server.
The infected messages have:
Subject: Fwd: Crazy illegal sex !
Body: is randomly selected from a file on C: drive
Attach: "iLLeGal.exe" or "illegalSex.zip"
The worm activates from infected email only if a user clicks on the attached file. The worm then installs itself to the system, runs its spreading routine and payload.
Payload
The worm creates new key (counter) in system registry:
HKLM\iLLeGal
This counter is being increased on each worm start. When the counter reaches '5' the worm deletes all files on the D: E: F: G: drives and then displays the message:
ZaCker
No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r
Copyright @2006 i-worm.gali-def1