From: "Elene" <F*CKENSUICIDE@HOTMAIL.COM>
Subject: Important information for you. Read it immediately !
The email carries an attachment named Myphoto.zip. Encased in the zip is myphoto.jpg <numerous spaces> .exe. The technique of adding spaces before the actual .exe extension could stymie some poorly configured filtering products.
- L32x.exe
Vxd32v.exe
Dumaru.Z also drops Dllxw.exe to the Startup directory and Zip.tmp to the Windows Temp directory.
The following files are created in the Windows directory:
- Winload.log
Vxdload.log
Rundllx.sys
On Windows 9x/ME, the system directory (by default) is located at C:\Windows\system. On Windows NT/2000, the Windows system directory is located at C:\WINNT\system32 and on Windows XP at C:\Windows\system32.
Registry keys modified:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"load32"="%system%\l32x.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
The value 'Shell' is changed from "explorer.exe" to "explorer.exe %Windir%\system32\vxd32v.exe"
HKEY_LOCAL_MACHINE\SOFTWARE
adds the value 'SARS'
System.ini is also modified on Win9x/ME as follows:
- [boot]
shell=explorer.exe %System%\vxd32v.exe
