[email protected]

Aliases: W32.Invalid.worm, TROJ_INVALID.A, W32/[email protected], W32/InvalidSSL
Variants: N/A

Classification: Malware
Category: Computer Worm

Status: Active & Spreading
Spreading: Slow
Geographical info: North America
Removal: Easy
Platform: W32
Discovered: 30 Aug 2001
Damage: Medium

Characteristics: [email protected] is an Internet worm. It arrives as an email disguised as a message from Microsoft Technical Support.The worm arrives as an email message using the email address [email protected] It is disguised as a Microsoft Technical Support message to trick the user into clicking the attachment sslpatch.exe.

More details about [email protected]

When executed, the worm [email protected] checks if there is an Internet connection available. If it detects an Internet connection, it sends itself through email. The email is disguised as a message from Microsoft Technical Support. While sending emails, the worm searches for .ht files in the My Documents folder. It searches for the string mailto and copies the email address next to it. After gathering email addresses, the worm connects to mail.bezequint.net and sends the email containing the attachment sslpatch.exe. The worm corrupts EXE files and looks for other EXE files in the current folder. When the worm finds EXE files, it uses the CryptEncrypt API function to encrypt the files. It then uses the user key Invalid.Worm. Encrypted files will no longer be valid

Corrupted EXE files will display an error message: ie C:\WINDOWS\CALC.EXE is not a valid Win32 application. To prevent the worm from infecting your computer, block all file attachments with the name sslpatch.exe at the SMTP gateway. Apart from downloading and installing unwanted components, the [email protected] application is also capable of spreading threats to other computers. Propagation of threats is done through other programs, as Trojan applications are not capable of spreading by themselves. Common programs that are capable of transmitting threats include P2P (peer-to-peer) file sharing programs and instant messaging applications.