Virus Characteristics
-- Update September 14th, 2004 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://news.zdnet.com/2100-1009_22-5363988.html
--
Proactive detection:
Products running the 4.2.40 engine with the 4253 DATs (03/19/2004) or greater detect this threat as "virus or variant W32/Generic.a@MM" (with scanning of compressed files enabled).
4314DATs (01/14/2004) are required for complete removal of this worm.
This worm spreads by email using the MAPI/Outlook. It searches the Windows Addressbook (WAB) for addresses.
Subject:
Listen and Smile
Body:
Hey. I beg your pardon. You must listen.
Attachment:
masum.exe
Example:
On Windows XP, the worm calls the Microsoft Speech engine and user will hear this message:
A playback of the message can be downloaded here
. (72kb/MP3)
The worm creates this registry key, so it gets executed each time the system starts:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Microzoft_Ofiz" = %windir%\KdzEregli.exe
It also created this key:
- HKEY_CURRENT_USER\Software\Microsoft\Masum
"Who" = OnEmLi_DeGiL
and copies itself to following folders:
- C:\Masum.exe
- C:\WINDOWS\Adapazari.exe
- C:\WINDOWS\Ankara.exe
- C:\WINDOWS\Anti_Virus.exe
- C:\WINDOWS\Cekirge.exe
- C:\WINDOWS\KdzEregli.exe
- C:\WINDOWS\Messenger.exe
- C:\WINDOWS\Meydanbasi.exe
- C:\WINDOWS\My_Pictures.exe
- C:\WINDOWS\Pide.exe
- C:\WINDOWS\Pire.exe
Payload:
The worm tries to delete files from the Windows directory, based on the systemdate:
- *.DLL on the 2nd, 15th and 17th of each month.
- *.INI on the 10th and 23rd of each month.