FRISK Software International


Summary of W32/Scano.L
Discovered: 9 May 2006
Definition files: 9 May 2006
Risk Level: Medium
Distribution:Low
 
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description
W32/Scano.L is a mass-mailing worm. It harvests e-mail addresses from the infected computer and sends a copy of itself via e-mail to the harvested addresses. It also tries to download and execute files from the internet.


Technical Description
Upon first execution of the worm it copies itself to %WINDIR%\csrss.exe and executes it.


The worm creates the registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]

and adds the value:

"Debugger"="%WINDIR%\csrss.exe"

to it.


The unpacked version of the worm contains the string:

/scannow

from this the worm derives its name.


It harvests e-mail addresses on all available hard drives, in all files having one of the following extensions:

adb
asp
cfg
cgi
mra
dbx
dhtm
eml
htm
html
jsp
mbx
mdx
mht
mmf
msg
nch
ods
oft
php
pl
sht
shtm
stm
tbb
txt
uin
wab
wsh
xls
xml
dhtml


It avoids sending itself to addresses containing any of the following substrings:

@example.
2003
2004
2005
2006
@microsoft
rating@
f-secur
news
update
.qmail
.gif
anyone@
bugs@
contract@
feste
gold-certs@
help@
info@
nobody@
noone@
0000
Mailer-Daemon@
@subscribe
kasp
admin
icrosoft
support
ntivi
unix
bsd
linux
listserv
certific
torvalds@
sopho
@foo
@iana
free-av
@messagelab
winzip
google
winrar
samples
spm111@
.00
---
abuse
panda
cafee
spam
pgp
@avp.
noreply
local
root@
postmaster@


Removal Instructions
For general removal instructions please click here.

Marteinn Žór Haršarson
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is