'icload95', 'icloadnt', 'icmon', 'icmoon', 'icssuppnt', 'icsupp' If a window contains one of the strings below, it will receive a “PostQuitMessage”. When the worm is active in memory, it periodically scans the windows registered in the system. – this key will allow the worm to get executed when the user attempts to open a registry file.Īlso, the worm modifies the registry key and adds the value of 1 (true) to the key “ DisableRegistryTools”. – this key will allow the worm to get executed when the user attempts to open a COM file.

– this key will allow the worm to get executed when the user attempts to open a PIF file. – this key will allow the worm to get executed when the user attempts to open a BAT (MS-DOS batch file) – this key will allow the worm to get executed when the user attempts to open an EXE (executable file) – this key will allow the worm to get executed when the user attempts to open a SCR (screen saver file) Once ran, the worm checks if it’s already running it does that by checking several registry keys if the worm is already installed and running, it displays the following message box: The email messages are quite realistic and may fool some users to open the infected attachement.

When arriving in an email message, the worm disguises as a Microsoft patch. The worm may become active by running the infected attachment of an e-mail, or by running an infected file from the Mirc download folder, Kazaa, etc) The subject and the body of the e-mail may vary, but the attachment is always 106.496 bytes long. Technische beschrijving: is an internet worm, which spreads mainly via e-mail, but also via Kazaa, Mirc.

Mirc download directory