Home / malware Win32.Updatr.A@mm
First posted on 21 November 2011.
Source: BitDefenderAliases :
Win32.Updatr.A@mm is also known as I-Worm.Updater, I-Worm.Imelda.B.
Explanation :
This virus is an Internet Worm spreading through e-mail, using Outlook's Address Book to spread. It comes in an e-mail as an attached executable.
The infected mail has the following format:
Subject: is a combination of one word randomly chosen from the following groups:
Have you Check this Picture
You Should Check out my Program
Just Watch out For this Patch
Why Not you Open The Nude pic
How to Look at Report
Re: Document
Fwd: Quotation
Transaction
Bank Account
WTC Tragedy
Osama Vs Bush
Account
Private Pic
Body:
Hi:
This is the file you ask for, Please save it to disk and open this file, it's very important.
Attachment: an executable file named as described in the Symptoms section
An example of such an e-mail is this:
When the user executes this attachment the virus copies itself in the C:Windows directory under all the names shown above. After this it adds the following key to registry in order to be restarted at every reboot:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunUpdate with the value "C:WINDOWSUpdate.exe" using a generated reg file called c:iwing.reg
Also it creates a Visual Basic Script file in the Startup directory (which also will be executed at every startup).
To trick users it displays a fake error message like this:
To spread it reads all the contacts from Outlook Address Book and send to all the same generated e-mail.
The script dropped in startup will search for all the files with extension .exe, .doc and .txt on all drives, and create a file with the same name appended with the extension .vbs where it copies itself. On 12th of every month it displays the following message:
The virus contains bugs because sometimes it sends e-mails without attaching the file.
As marker the author wrote:
I-WORM.IMELDA.B
(C)2001, by Iwing
Virusindo - Indonesian Virus NetworkLast update 21 November 2011
