W32/Assiral Worm

 Information about the W32/Assiral Worm:

W32/Assiral is an email worm. The worm will infect Windows systems. The worm spreads through email and Network.

The subject of the infected email will be;

Re: LOV YA !

The body of the infected email will be;

Kindly read and reply to my LOVE LETTER in the attachments :-)

The name of the infected attachment will be;

LOVE_LETTER.TXT.exe

Upon execution, the worm copies these files:

MESSAGE.txt, MS_LARISSA.exe and LARISSA_ANTI_BROPIA.html in the root of C: drive.
SpoolMgr.exe, love_letter.txt.exe and WinVBS_32.vbs in the Windows folder.
MS_LARISSA.exe and REG_32.vbs in the Windows System folder.

It modifies the windows registry at the following locations to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

To propagate itself, the worm collects email addresses from the infected system and mails a copy of itself to all the collected email addresses using its own SMTP engine. It also copies itself to the root of all mapped network drives.

This worm first appeared on 22nd February, 2005.

 Other names of W32/Assiral Worm:

This Worm is also known as Assiral.A, W32.Assiral@mm, WORM_ASSIRAL.A.