W32/Patahme Worm

 Information about the W32/Patahme Worm:

W32/Patahme is a worm. The worm will infect Windows systems and spreads by copying itself to network shares, various local folders and removable drives.

The 'Subject' and the 'Message Body' of the infected mail will be (random chosen string in Malay or Indonesian)

The 'Attachment' of the infected mail will be;

Rahasia Seorang Bill Gate.exe
pensiun muda pensiun kaya.exe
beda pemenang dan pecundang.exe

Upon execution, the worm creates the following files:

meme.bmp, sysexplorer.exe, sysprint.exe and wininit.exe in the Windows folder
patahhati.exe and memesayang.exe in the Windows System folder

The worm may also create the following files in the Windows folder and open them with Internet Explorer;

happyday.htm
memesayang.htm
putuscinta.htm

The worm modifies registry at the following locations;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The worm searches for word documents and hides them, in the same folder where these word documents are located. It then creates a copy of itself with the same name of these documents.

The worm sends ICMP Echo Requests to the following URLs and gathers email addresses to spam:

www.telkom.net
www.plazatelkom.net

The worm sends spam emails with a copy of itself as an attachment.

This worm first appeared on February 17, 2007.

 Other names of W32/Patahme Worm:

This Worm is also known as W32.Patahme@mm.