W32/MSNSpamta.A

Download VIRUSfighter NOW
W32/MSNSpamta.A Destructivity: Spreading: Overall risk:
  
• Detected by virus detection files published: 11/22/2007 • Type: Worm
• Virus characteristics first published: 11/22/2007 • Spreading mechanism: Other
• Virus characteristics latest update: 11/22/2007 • Overall risk: Low
• Alias: • Payload: Harvests email adresses, steals documents
• Infection type: Microsoft Windows 95/98/98 SE/ME/NT 4/2000/XP/2003/Vista  

Virus type Spreading
mechanism 		Destructivity
and payload 		Additional
descriptions 		Detection
and removal

Changes to file system:

Copies itself to "C:\WINDOWS\SYSTEM32\IrBd.exe or nbismsnpatk.exe"

Process/Window: 

  • Creates a mutex 3477201870 
  • Creates two threads.

Changes to registry: 

  • Checks the values under key "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" 
  • Checks the values under key "Hardware\Description\System\CentralProcessor\0"

Network: 

  • Tries to open port 25 (TCP/UDP - Simple Mail Transfer Protocol). 
  • Attempts to connect to a Fast/Flux- network 
  • Enumerates running processes
# - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z
To protect and serve, VirusFighter