W32/Memesa Worm

 Information about the W32/Memesa Worm:

W32/Memesa is an email worm. The worm will infect Windows systems and spreads through email.

The subject of the infected email will be any one of the following;

FWD: foto mesra agnes vs f4!
Sstt..! foto2 panas agnes dengan f4!

The body of the infected email will be any one of the following;

Ssstt, kumpulan foto mesra f4 dengan agnes monica!
Apakah Anda sedang jatuh cinta? Apakah cinta Anda cinta sejati? Check this out!

The name of the infected attachment will be any one of the following;

agnes vs f4.zip
foto panas agnes.zip
foto mesra f4 vs agnes monica.zip

Upon execution, the worm creates svchost.exe, dllhost.exe, windos.exe, meme.bmp, memesayang.htm, happyday.htm and putuscinta.htm in the Windows Folder. It also copies itself as agnes vs f4.exe, foto panas agnes.exe and foto mesra f4 vs agnes monica.exe in the root drive.

The worm modifies registry at the following locations;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

The worm scans the files having the extensions doc, jpg, xls, pdf. Then copies itself as an executable using the file's name for all the files found.

The worm changes the desktop background.

It may send an ICMP Echo Request to: http://www.telk(blocked)

This worm first appeared on December 18, 2006.

 Other names of W32/Memesa Worm:

This Worm is also known as W32.Memesa.