FRISK Software International


Summary of W32/Mitglieder.UZ
Discovered: 12 Dec 2006
Definition files: 12 Dec 2006
Risk Level: Medium
Distribution:Medium
 
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description
W32/Mitglieder.UZ is a mass mailing worm that has its own SMTP engine. It also harvests e-mail addresses from the infected computer.


Technical Description
Upon execution W32/Mitglieder.UZ creates the file the text file C:\error.txt and opens it notepad. The file contains the following text:

Text decoding error.

Creates the folder in %APPDATA% named hidn and copies itself there as hldrrr.exe and hidn2.exe

Adds the value:

"drv_st_key" = "%APPDATA%\hidn\hidn2.exe"

to the registry key:

[CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Harvests e-mail addresses from all files on the infected computer having one of the following extensions:

wab
txt
msg
htm
shtm
stm
xml
dbx
mbx
mdx
eml
nch
mmf
ods
cfg
asp
php
pl
wsh
adb
tbb
sht
xls
oft
uin
cgi
mht
dhtm
jsp

E-mails attaches a zipped copy of itself to e-mails it sends to the harvested e-mail addresses. The zip archive is named one of the following:

price_<Date>.zip
price-<Date>.zip
price<Date>.zip
new_price<Date>.zip
latest_price<Date>.zip

where <Date> is the date it was sent.

It tries to download and execute additional code and updates itself from the Internet.


Removal Instructions
For general removal instructions please click here.

Marteinn Žór Haršarson
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is