high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 22 October 2004 11:42:58 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Baba-A is a mass-mailing worm. W32/Baba-A is a mass-mailing worm.
When run the worm attempts to create a helper component csrss.exe in the C:\ folder and executes it. The helper component then creates the following registry entry so as to auto-start on user logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Key Logger = c:\csrss.exe
W32/Baba-A will attempt to harvest email addresses from files on the infected computer with the following extensions:
DBX WAB MBX EML MDB TBB NBOX DAT
Sent emails are composed as HTML and take the following form:
Subject:
Mail Delivery failure -
Mail body:
If the message will not displayed automatically,
you can check original in attached message.txt
Failed message also saved at:
www.<host>/inbox/security/read.asp?sessionid-<random number>
(check attached instructions)
+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com
W32/Baba-A contains the text "SoonChunHyang" and "Bucheon".
|
