Sonic worm

 Information about the Sonic:

This worm is a rapidly spreading email worm. This worm arrives through an email bearing subject: Choose your poison or I am your poison and no body text . The infected attachment can be either girls.exe or lovers.exe. Opening the infected attachment launches the worm. The worm displays a message with following text depending upon the attachment recieved.

Girls.exe is not a valid Win32 application.
or
Lovers.exe is not a valid Win32 application.

The worm copies itself under the Windows\System directory as GDI32.exe and modifies the registry entry at the following location

HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run

The worm tries to connect to this site http://www.geocities.com/olivier1548 every 10 minutes to check the updated version of the text file - latestversion.txt to be downloaded. The worm then tries to download the file specified in the text file. This worm also downloads some valid .DLL files to perform successful infection.

The worm then tries to spread itself to the users found in the Windows address book. This worm also has some backdoor trojan properties.

Win32.Sonic worm first appeared in October 2000.

 Other names of Sonic:

This worm is also known as Win32.Sonic, I-Worm.Sonic

 Removing Sonic from your computer: