Category: Computer Worm
Active & Spreading
Asia, North and South America, and some parts of Europe and Australia
16 Apr 2002
The [email protected]
application is a worm that delivers itself to every addresses in the address book of Microsoft Outlook. It changes the name of every files that are in the folder of Windows and that have the .scr or .exe file extension. This worm then replicates itself as the original name of the file. It also erases files that have detailed file extensions,as well as files Regedb32 and Regedit.
If you have Malware on your computer it will cause annoyances and will damage your system. You should either:
A. Manually remove the infected files from your computer, or
B. Automatically scan your system using trusted software
We recommend that you scan your system for malware. Our partner has a computer worm removal tool to automatically clean [email protected]
from your computer.
Once the [email protected]
was executed it replicates itself. It generates VBS (Basic Visual Script) files such as in the C:\Command.com.vbs an email will be sent to all of the contacts on the address book of the Microsoft Outlook. The email has a Subject containing ‘esto, jajaja, te vas a reir!!’, a Message containing ‘Jajajaja!!! Es la ostia!! Miralo!!’, with attachment of OperacionTriunfo.scr. In the :\X.vbs, there are messages that appears such as EN ESPAÑA - ABRIL 2002, I-Worm Elisabeth by Zirkov, RECUERDOS A TODAS MIS COMPAÑERAS DE MERYLAND CURSO 99-01, and HECHO EN ADMIRACION A GIGABYTE. In the :\Eurovision.vbs, the file tries to delete the files having .mid, .zip, .ace, .log, .rtf , .asm, .arj, .rm, .lhz, .pdf, .gbc, .txt, .asf, .wp, .mpeg, .mp3, and .mdb.
This program also deletes files with the following extension: .wav, .ppt, .xls, .rar, .gba, .jpg, .smc, .mov, .doc, .bmp, .mp2, . .mod, .avi, .mp, jpeg, .js, .gb, .mpg, and .gif. The [email protected]
deletes the files that contain the regedb32 or regedit names. The worm also ranames all of the files that are in the folder of the Windows and those files having .scr and .exe extension. It will then replicates itself as the file having thew original name. The worm modifies the value of the key of the registry so in case the Windows will start the worm will run at the same time.