WORM_EMAIL.FU

It arrives as attachment to email messages spammed by another malware or a malicious user. It may be downloaded from remote sites by other malware. It may also be dropped by other malware.

Upon execution, this worm drops several files. It stays memory-resident by injecting codes into a certain process. It then creates registry entries to enable its automatic execution at every system startup.

This worm gathers target email addresses from files with certain file name extensions. It uses its own Simple Mail Transfer Protocol (SMTP) engine to send email messages with a copy of itself as attachment. However, it avoids sending email messages to addresses containing certain strings.

Related Items