W32/Scano.AC Worm

 Information about the W32/Scano.AC Worm:

W32/Scano.AC is an email worm. The worm will infect Windows systems and spreads through email.

The body of the infected mail will be;

pRIWET, WOT KUDA TY WS#WREMQ
PROPADAE[X??? kAK TOLXKO BUDE[X W
INTERNETE NAPI[I MNE!!! kSTATI
PROGRAMMU KOTORU@ TY PROSIL, Q
WLOVIL W PISXMO... POKAI

The infected attachment will be any one of the following;

Passwords
secret
Readme
README
confidential
private
Message
your_documents
Important
images
Archive
Fotos
backup
Document

Upon execution of the infected attachment, the worm copies itself as csrss.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

dhtm, dhtml, html and shtm.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on May 15, 2006.

 Other names of W32/Scano.AC Worm:

This Worm is also known as WORM_ARESES.AC .