W32/Baba-A is a mass-mailing worm.
W32/Baba-A is a mass-mailing worm.
When run the worm attempts to create a helper component csrss.exe in the C:\ folder and executes it. The helper component then creates the following registry entry so as to auto-start on user logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Key Logger = c:\csrss.exe
W32/Baba-A will attempt to harvest email addresses from files on the infected computer with the following extensions:
DBX WAB MBX EML MDB TBB NBOX DAT
Sent emails are composed as HTML and take the following form:
Subject:
Mail Delivery failure - <harvested name>
Mail body:
If the message will not displayed automatically,
you can check original in attached message.txt
Failed message also saved at:
www.<host>/inbox/security/read.asp?sessionid-<random number>
(check attached instructions)
+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com
W32/Baba-A contains the text "SoonChunHyang" and "Bucheon".