Via P2P File Sharing
In an attempt to spread via P2P file sharing networks, the worm initially locates the following shared folders of the most common P2P programs:
\KMD\Shared Folder
\Kazaa\My Shared Folder
\Morpheus\Shared Folder
\Grokster\My Grokster
\Bear Share\Shared
\Edonkey2000\Incoming
\limewire\Shared
\Shareaza\downloads
\icq\shared files
\WinMX\my shared folder
The worm searches for these folders in the “Program Files” directory, which it locates by referencing this registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir
The worm copies itself to these shared folders using the following file names (note: if these paths do not exist, the worm fails to copy itself):
Norton 2004 Crack
Kasperky AV Universal Key
Dark Coderz Alliance
Anti-hacker Utility
Cracks mega warez collection
Sex – totally free porn
Easy credit card validation
Yahoo hacker
Webmail official hacker
Free porn sites accounts
with these extensions
.exe
.scr
.pif
.bat
.com
.cmd
For example:
C:\Program Files\Kazaa\My Shared Folder\Cracks mega warez collection.pif
C:\Program Files\\Bear Share\Shared\Dark Coderz Alliance.cmd
Via IRC: Intended
In an attempt to spread via IRC networks, specifically targeting mIRC clients, the worm copies itself to the folder “c:\mirc” or “c:\mirc32” as “Manifesto AntiCensore Pilif.txt.exe”. The worm also modifies the file “script.ini” with the intention that the file “Manifesto AntiCensore Pilif.txt.exe” will be sent to anyone that joins a channel that the local affected user is already on.
Due to an error in the modified “script.ini” file, “Manifesto AntiCensore Pilif.txt.exe” is not sent to other mIRC clients. The following message, however, is still sent:
“DCA are fighting for free speech. Get their manifesto now!”
Via E-mail
Win32.Fili.A spreads via e-mail. The worm generates e-mail with variable Message Bodies and Attachment names, although the Subject line is blank. The worm locates e-mail addresses to send itself to using the user's address book. The worm creates the file %System%\adrbook to store collected e-mail addresses.
Possible Message Bodies:
Important legal notice
Do not delete this message. Analyse attachement and reply as soon as possible with manifesto details. Thank you.
Please help us to save the right of freedom of expression.
All details will be displayed in small attached file. Good luck and thank you.
You personal manifesto details are attached. Take good care of them.
Help us gather online votes for our anti-censore manifesto. We need you help now! Attachement will automatically send a vote to our online database once you run it and will be redirected to our webpage!
Thank you.
It’s curious, it’s scandalous… don’t be furious! Life is bitch so don’t take it serious.
Please help us be free! We need the basic right of expression. Enable an online vote for out manifesto with the help of the attachement. Many thanks.
Music is being censored, journalists are afraid, law has not been respected for long time. Why? Because of corruption and lack of right of expression. Help us! Enable the attachement and our voting system will track and record you help. Many thanks.
Parazitii need your help for the anti-censore campaign! See all details in the attachment. Thank you.
Its just hip-hop. Nothing else. Enjoy!
Oh yeah! One more thing: it’s a censore-related manifesto.
This is my manifesto. You can stop this individual, but you cant stop us all… after all, were all alike.
Possible Attachment names.
manifesto
pilif
sustain cause
details
attachment
request
Parazitii
JOS CeNzura
Freedom
Stolen rights
Details
Manifesto anti pilif
Manifesto details
Freedom of expression
Simple solution
Government issue
The attachment can have any of the following extensions:
.exe
.scr
.pif
.bat
.com
.cmd
Note: In our laboratory testing, the worm sent e-mail without a Subject or Message Body due to a bug in the worm's code. The worm was sent as an attached file with an empty message.
Please see below for an example of e-mail generated by the worm:
Return to top
|
Virus Information Center
