Full
Name: |
MW.ORC |
| Type: |
Worm |
| Also Known As: |
Orc Worm malware.orc |
| Danger Level: |
8 |
| Category Description: |
Virus-like program that spreads automatically to other computers by sending itself out by email or by any other means. A program that propagates itself by attacking other machines and copying itself to the affected machine.
Worms have self-replicating code that travels from machine to machine by various means. A worms first objective is merely propagation. Worms can be destructive depending on what payload they have been given. Worms may replace files, but do not insert themselves into files. |
| Comment: |
Orkut is an "invite only" community run by Google. This particular threat infects a PC, then tries to steal various pieces of information from the PC (banking details, usernames / passwords) by having them emailed to the creator of the worm.
The infection takes advantage of Orkut's scrapbook feature (where users can send messages to each other, which are displayed on public pages within the user's profile). There is evidence of the infection links being self-propagating, however the links may also be delivered manually.
On some occasions, the infected user can also be placed into a Botnet designed to share large movie files.
The initial executable file creates two further files
when activated, winlogon_.jpg and wzip32.exe (located in the System32
Folder) The files appear to be variants of the PWSteal.Trojan or another generic trojan designed to steal passwords. When the user clicks the "My Computer" icon, a mail is sent containing their personal data. In addition, they may or may not be added to an XDCC Botnet (used for file sharing), and the infection link may be sent to other users that they know in the Orkut network.
For more informaton on XDCC see http://www.spywareguide.com/term_show.php?id=125 |
| |
|
| Properties: |
|
Back to the list of products removed by X-Cleaner
|
