WORM_ORTUK.B

This worm is downloaded from remote sites or dropped by other malware. It can also be downloaded unknowingly by a user when visiting malicious Web sites.

It gathers target email addresses from the Windows Address Book (WAB).

It uses its own Simple Mail Transfer Protocol (SMTP) engine to send email messages that has a copy of itself as attachment. Having its own SMTP engine enables it to send messages without using other email applications such as MS Outlook.

This worm checks if an MSN messenger is installed in the affected system. If the said instant messaging application is not installed, it drops and execute a certain file.

Related Items