WORM_ZHELATI.AIR

This worm arrives as attachment to email messages spammed by another malware or a malicious user. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It creates registry entries to enable its automatic execution at every system startup.

It gathers target email addresses from files with certain file name extensions. It avoids sending email messages to addresses containing certain strings.

Related Items